AI rules for manufacturers in 2026

Which AI rules apply to manufacturers in 2026?

A manufacturer that builds AI into a product sold in the EU faces product safety, liability, cybersecurity, and data law that each treat AI or software directly. In the US, the duties that reach AI in products come from general product safety and workplace safety law. As of October 2026, the EU Cyber Resilience Act reporting duty, the Data Act, and the General Product Safety Regulation already apply. The Machinery Regulation, the revised Product Liability Directive, the full Cyber Resilience Act, and the AI Act’s product rules follow between December 2026 and August 2028.

Most of the list turns on two facts: whether the AI performs a safety function, and whether the product is sold or used in the EU. A plant that only uses AI-driven equipment is mainly answering to workplace safety law and to the rules on monitoring workers.

AI-relevant rules for manufacturers, as of October 2026

Rule	Who enforces	Applies when	Status and key date
EU AI Act, Annex I Section A products	National market surveillance authorities; notified bodies where the sectoral law requires third-party assessment	The AI system is a safety component of, or is itself, a product under listed EU harmonisation law, and that product must undergo third-party conformity assessment	High-risk duties apply August 2, 2028 (Regulation (EU) 2026/1744)
EU AI Act, machinery (now Annex I Section B)	European Commission (delegated acts); machinery market surveillance authorities	The AI system is high-risk under Article 6(1) as a safety component of machinery or as machinery itself	Only Article 6(1), Article 60a, and Articles 102 to 112 of the AI Act apply; machinery delegated acts must apply by August 2, 2028
Machinery Regulation (EU) 2023/1230	National market surveillance authorities; notified bodies	Machinery or a related product placed on the EU market, including safety components with self-evolving, machine learning behaviour	Applies January 20, 2027, replacing the Machinery Directive
Product Liability Directive (EU) 2024/2853	National courts, under national transposing law	A defective product, including software, causes death, personal injury, property damage, or loss of non-professional data	Transposition due December 9, 2026; covers products placed on the market or put into service after that date
Cyber Resilience Act (EU) 2024/2847	National market surveillance authorities; CSIRTs and ENISA for reports	A hardware or software product with a data connection to a device or network is made available in the EU	Reporting since September 11, 2026; full application December 11, 2027
Data Act (EU) 2023/2854	National competent authorities	A connected product or related service generates data the user can access	Applies since September 12, 2025; design duty for connected products placed on the market after September 12, 2026
General Product Safety Regulation (EU) 2023/988	National market surveillance authorities	A consumer product is placed or made available on the EU market	Applies since December 13, 2024
Consumer Product Safety Act, Section 15(b)	U.S. Consumer Product Safety Commission	A manufacturer, distributor, or retailer obtains information reasonably supporting the conclusion that a consumer product has a reportable defect or risk	In force; report within 24 hours (16 CFR 1115.14)
OSH Act General Duty Clause	OSHA and State Plans	An employer runs a workplace, including one with AI-driven robots or machinery	In force; OSHA has no robotics-specific standard
NIST AI RMF 1.0	None (voluntary)	Any organization that chooses to use it	Version 1.0 current as of October 2026; revision under way

Is the AI in my product high-risk under the EU AI Act?

It is high-risk under Article 6(1) if it is a safety component of a product covered by EU harmonisation law listed in Annex I, or is itself such a product, and that product must undergo third-party conformity assessment. Both conditions must be met.

Regulation (EU) 2026/1744 also narrowed what counts as a safety component. A component fulfils a safety function where its intended purpose is to prevent or mitigate risks to the health and safety of persons or property. AI used solely for non-safety aspects of user assistance, performance optimisation, service efficiency, automation, convenience, or quality control does not qualify, unless its failure or malfunctioning would endanger health and safety. A product that must undergo third-party assessment solely because of risks other than health and safety, such as radio spectrum or electromagnetic interference, does not meet the conformity assessment condition (amended Article 3(14) and new Article 6(1a) to (1c)).

Which section of Annex I the product falls under now decides how much of the AI Act applies. For Section A products, which include toys, lifts, equipment for explosive atmospheres, radio equipment, pressure equipment, personal protective equipment, gas appliances, and medical devices, the full high-risk regime applies from August 2, 2028. For Section B products, which now include machinery alongside vehicles and agricultural tractors, the amended Article 2(2) says only Article 6(1), Article 60a, and Articles 102 to 112 apply; Articles 57 to 59 apply only once the AI requirements have been integrated into the sectoral law. For a machine builder, the practical result is that the AI requirements arrive through machinery law rather than through the AI Act’s own high-risk chapter.

Regulation (EU) 2026/1744 states the reason for moving machinery: a sectoral approach to simplify the rules for AI-enabled machinery while keeping a level of protection consistent with the AI Act. It amends the Machinery Regulation to require the Commission to adopt delegated acts adding health and safety requirements for high-risk AI systems that reflect Chapter III, Section 2 and Articles 17, 19, 72, and 73 of the AI Act. Those delegated acts shall apply by August 2, 2028. Until machinery-specific AI standards are referenced or adopted, a high-risk AI system in machinery that complies with harmonised standards or common specifications under the AI Act is presumed to conform with the machinery requirements for high-risk AI systems.

What does the Machinery Regulation require of self-learning safety functions?

From January 20, 2027, a safety function with self-evolving, machine learning behaviour cannot be self-certified. Annex I Part A lists two categories: safety components with fully or partially self-evolving behaviour using machine learning approaches that ensure safety functions, and machinery with such an embedded system that was not placed on the market separately (in respect only of that system). Both must use one of the Article 25(2) procedures: EU type-examination followed by conformity to type, full quality assurance, or unit verification. Internal production control is not available for them.

Recital 55 states that these provisions do not apply to software incapable of learning or evolving and programmed only to execute certain automated functions. The Regulation does not define self-evolving behaviour, and it does not say whether a model that was trained before sale and does not change in use falls within Annex I Part A. As of October 2026, the Commission’s machinery page offers an application guide only for the old Machinery Directive.

Annex III sets design duties that reach further than safety components. Control systems of machinery with self-evolving behaviour or logic designed to operate with varying levels of autonomy must not cause the machine to act beyond its defined task and movement space. They must enable recording of data on the safety-related decision-making process after placing on the market and keep it for one year after collection, and it must be possible at all times to correct the machine to maintain its inherent safety. For all control systems, a tracing log of interventions and of safety software versions uploaded after placing on the market must be enabled for five years after upload. Both records exist only to demonstrate conformity on a reasoned request from a competent national authority. Software and data critical to compliance must be protected against accidental or intentional corruption, and the machine must collect evidence of legitimate or illegitimate interventions in, or modifications of, its installed software or its configuration.

Does the new EU product liability law cover AI software?

Yes. The revised Product Liability Directive defines a product to include software, and it applies to products placed on the market or put into service after December 9, 2026, the deadline for Member States to transpose it. Free and open-source software developed or supplied outside a commercial activity is excluded.

Three provisions change the exposure for AI. A court assessing defectiveness must consider the effect of any ability to continue to learn or acquire new features after placing on the market (Article 7(2)(c)). A manufacturer cannot use the defense that the defect arose after placing on the market where the defect is due to software, a software update, or a lack of updates necessary to maintain safety, if within the manufacturer’s control (Article 11(2)). A court must presume defectiveness or causation, or both, where the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and shows that defectiveness or causation is likely; the defendant can rebut the presumption (Article 10(4) and (5)).

Recital 40 adds a timing point. Where a substantial modification is made through a software update or upgrade, or due to the continuous learning of an AI system, the modified product should be considered made available on the market or put into service at the time the modification is actually made. The recital explains the Directive rather than setting a rule, and not every change counts. Where product safety law sets no threshold, a modification is substantial only if it changes the product’s original performance, purpose, or type in a way not foreseen in the manufacturer’s initial risk assessment, and also changes the nature of the hazard, creates a new hazard, or increases the level of risk (Article 4(18)). A person who substantially modifies a product outside the manufacturer’s control and then makes it available is treated as its manufacturer (Article 8(2)), and the 10-year expiry period runs again from the date the modified product is made available or put into service (Article 17(1)(b)).

Compensation covers death, personal injury including medically recognised psychological harm, property damage, and destruction or corruption of data not used for professional purposes; property used exclusively for professional purposes is excluded.

What cybersecurity and data duties attach to connected products?

A connected product sold in the EU now has a live reporting duty under the Cyber Resilience Act and a data access duty under the Data Act. The Cyber Resilience Act does not apply to products covered by the EU medical device, in vitro diagnostic, and motor vehicle general safety regulations, to aviation products certified under Regulation (EU) 2018/1139, or to marine equipment (Article 2(2) to (4)). Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform, with an early warning within 24 hours and a fuller notification within 72 hours. The duty also covers products placed on the market before December 11, 2027, the date most of the rest of the Act applies.

A product that is a high-risk AI system and meets the Cyber Resilience Act’s essential cybersecurity requirements is deemed to comply with the AI Act’s Article 15 cybersecurity requirements, if the declaration of conformity demonstrates it (Article 12). Accuracy and robustness requirements still apply separately.

Under the Data Act, connected products placed on the market after September 12, 2026 must be designed so that product data and related service data are easily, securely, and free of charge accessible to the user by default, with the metadata needed to interpret them, in a comprehensive, structured, commonly used, machine-readable format, and directly accessible where relevant and technically feasible. Sellers must give pre-contract information on the data the product generates. Proposed amendments to the Data Act, including to the grounds for refusing data access to protect trade secrets, have not been adopted. In July 2026, Greenberg Traurig described the Council compromise text as still subject to negotiation. As of October 21, 2026, the European Parliament’s Legislative Observatory lists the proposal, procedure 2025/0360(COD), as awaiting committee decision.

What is the US position on AI in products?

The US reporting duty that reaches AI in consumer products is the general one. Under Section 15(b) of the Consumer Product Safety Act, a manufacturer that obtains information reasonably supporting the conclusion that a consumer product contains a defect which could create a substantial product hazard, or creates an unreasonable risk of serious injury or death, must inform the CPSC. The CPSC’s rule sets that as within 24 hours of obtaining such information. Where information is not clearly reportable, a firm may investigate, and the investigation should not exceed 10 days unless the firm can demonstrate that a longer period is reasonable.

The CPSC has not proposed or issued an AI-specific rule in the Federal Register. Its AI-specific product safety work includes a May 19, 2021 staff report proposing a framework to screen consumer products for AI and machine learning and assess whether those capabilities create hazards. The report states it has not been reviewed or accepted by the Commission, so it is staff guidance, not a rule.

The AI LEAD Act (S. 2937), introduced September 29, 2025, finds that AI systems are products and would create a federal cause of action against developers and deployers. It is a bill, and it has not passed. Its latest action as of October 21, 2026 is referral to the Senate Judiciary Committee.

What governs AI-driven robots on the plant floor?

OSHA states that it has no specific standards for the robotics industry, so the General Duty Clause and general machine standards apply. The General Duty Clause requires each employer to keep a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. OSHA’s robotics page lists related general industry standards, including machine guarding and the control of hazardous energy (lockout/tagout).

The consensus standards were revised in 2025. ISO 10218-1:2025 and ISO 10218-2:2025 were published in January 2025, and A3 and ANSI announced the US adoption, ANSI/A3 R15.06-2025, on September 10, 2025. According to A3, both parts add cybersecurity requirements and many more listed safety functions, and Part 2 folds in collaborative application content from ISO/TS 15066. ANSI describes a Part 3, R15.06-3-2025, that sets safety requirements for users of industrial robot cells. These are voluntary standards, not OSHA regulations; OSHA’s page lists the 2012 edition of R15.06 as guidance. The drafting subcommittee chair told A3 that artificial intelligence “will need to be dealt with in future safety standards development.”

For governance, the NIST AI Risk Management Framework 1.0 is the voluntary US reference. NIST is revising it under the July 2025 AI Action Plan; version 1.0 remained current as of October 2026.

What about AI that monitors plant workers?

AI that watches or directs plant workers falls under a different set of rules from AI built into a product. The EU AI Act has banned emotion recognition in the workplace, except for medical or safety reasons, since February 2, 2025, and lists AI that monitors and evaluates worker performance or allocates tasks based on individual behaviour as high-risk from December 2, 2027. New York Civil Rights Law 52-c requires notice and acknowledgment before an employer with a place of business in New York monitors employee phone, email, or internet use. The employers and HR page covers these and the state rules on automated decisions about workers.

Export controls on AI chips, models, and equipment are covered on the importers and exporters page.

What should a manufacturer do now?

• Inventory every product with AI or machine learning, and mark which ones perform a safety function
• Map each product to its EU harmonisation law and note whether it now sits in Annex I Section A or Section B
• For machinery with self-evolving, machine learning safety components, book a notified body for the January 20, 2027 rules and build the decision logging, movement-space limits, and correction capability Annex III requires
• Track Commission delegated acts adding AI requirements to the Machinery Regulation, which must apply by August 2, 2028
• Confirm your process for reporting actively exploited vulnerabilities and severe incidents to ENISA’s platform within 24 hours, including for products within the Act’s scope already on the market
• Plan software update support for the product’s life; under the Product Liability Directive a missing safety update within your control can defeat a defense
• Check that connected products placed on the EU market after September 12, 2026 give users default data access
• Set CPSC Section 15(b) escalation rules that treat a model or software defect like any other defect
• Run robot cell risk assessments against ANSI/A3 R15.06-2025, and document how AI-driven functions are validated
• Check plant monitoring tools for emotion recognition and for New York notice requirements

Where to read more

The EU AI Act guide covers provider duties, penalties, and the Digital Omnibus dates. The governance frameworks guide covers NIST and ISO programs, and the AI compliance guide explains how the layers fit together.

This page is general information as of October 2026, not legal advice. Confirm obligations with product safety counsel, your notified body, or the relevant agency in each market where you sell.