Artificial intelligence (AI) is becoming increasingly embedded across modern engineering, from autonomous industrial robotics and intelligent sensors to generative design software. Consequently, product development faces a fundamental shift. Iain Bowes, head of Management System Assurance for TÜV SÜD Business, comments.
The European Union’s AI Act establishes the world’s first comprehensive legal framework for artificial intelligence, mandating that technical safeguards, safety and ethical compliance is integrated across the entire product lifecycle. This means that, for design engineers, AI compliance can no longer be treated as a post-development afterthought but must be engineered into the system architecture from the start.
Design and supply chain impact
A common misconception is that post-Brexit operations are immune to European regulations. In practice, the EU AI Act enforces strict extraterritorial jurisdiction. This means that the regulation applies directly to any UK organisation that places AI systems or AI-enabled products on the EU market. This includes AI outputs, such as diagnostic data, predictive control decisions or automated classifications, that are used within the EU.
The legislation categorises market participants based on their role within the technology value chain:
- Providers – organisations that develop, train, fine-tune or commercialise AI systems under their own brand. Providers bear the most comprehensive obligations, particularly for high-risk applications and general-purpose AI (GPAI).
- Deployers (users) – organisations using AI systems within their operations. In engineering, this includes design teams using AI-driven simulation platforms, automated quality control vision systems or generative engineering tools. Deployers must ensure proper operational oversight, adherence to operating parameters and rigorous record-keeping.
- Importers and distributors – entities placing third-party AI hardware or software onto the European market are responsible for verifying that non-EU systems satisfy all regulatory prerequisites.
High-risk embedded AI and the double compliance burden
The engineering and electronics sectors face significant exposure under the Act’s high-risk classification criteria. Under Article 6(1), an AI system is automatically classified as high-risk if it fulfils two conditions: it functions as a safety component of a product (or is the product itself) covered by EU harmonisation legislation listed in Annex I, and it requires a third-party conformity assessment before placement on the market. This creates a double compliance requirement across critical engineering sectors:
- Industrial machinery – AI governing automated assembly lines, robotic kinematics or safety light curtains under the Machinery Regulation.
- Electronics and radio equipment – AI embedded in smart IoT sensors, industrial controllers and connected telecommunications hardware under the Radio Equipment Directive.
- Medical devices – AI-driven diagnostic hardware, embedded imaging and surgical robotics.
- Lifts and pressure systems – AI managing automated safety logic and pressure regulation.
If a company manufactures smart machinery or industrial IoT devices, they must follow both the AI Act and the relevant existing safety laws. For some products or systems, a CE Mark cannot be applied unless the high-risk requirements of the AI Act have been fulfilled.
Penalty system
In May 2026 the European Parliament and Council agreed the AI Act Omnibus, a set of amendments to adjust and simplify parts of the EU AI Act. The Omnibus pushes back the enforcement of high-risk AI rules to allow time for standards and conformity tools to be finalised. Deadlines are now 2 December 2027 for standalone high-risk AI systems (Annex III), and 2 August 2028 for high-risk AI systems embedded in regulated products.
Failing to comply carries severe financial penalties under a three-tiered system:
- Unacceptable risk violations – fine of up to €35 million or 7% of total worldwide annual turnover, whichever is higher.
- Non-compliance with obligations (e.g., data governance, transparency, human oversight) – fine up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
- Misleading authorities – fine up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher.
To foster innovation and ease this burden, regulatory simplifications regarding technical documentation and penalty applications have now been extended beyond SMEs to include small mid-caps (SMCs).
AI governance
The EU AI Act represents a significant shift in how business is conducted, moving AI from a tech-team project to a board-level compliance and ethics priority. For organisations navigating this transition, compliance is the floor not the ceiling. To truly succeed, businesses must bridge the gap between legal requirements and operational trust.
This is where adopting a structured governance framework becomes critical. To turn these regulatory hurdles into a competitive advantage, organisations should therefore adopt the core principles of the AI Essentials framework:
- Pillar 1 – Security and Data Integrity: Protecting against logic-based attacks and securing data pipelines.
- Pillar 2 – Transparency and Explainability: Ensuring stakeholders understand they are interacting with AI and can explain how decisions are made.
- Pillar 3 – Human-in-the-Loop and Accountability: Preventing irreversible AI decisions without human review.
- Pillar 4 – Fairness and Bias Mitigation: Ensuring AI does not discriminate or reinforce harmful stereotypes.
- Pillar 5 – Reliability and Hallucination Management: Using techniques like Retrieval-Augmented Generation (RAG) to ground theAI in factual data and mitigate fabrication.
- Pillar 6 – Societal, Ethical and Consequential Impact: Proactively assessing the broader effects of AI on the environment, workforce, and society.
It is vital to remember that AI-enabled systems should not be built for a regulator but for end users. By the time the August 2028 transition window closes, the businesses that thrive will be those that didn’t just ‘tick the box’ of the EU AI Act, but those that implemented AI Essentials to create a transparent, resilient and human-centric AI ecosystem.
Learn more www.tuvsud.com/en-gb/cybersecurity
https://designsolutionsmag.co.uk/category/iiot-smart-manufacturing/
