Iain Bowes. Head of Management System Assurance Services for TUV SUD Business
The world’s first comprehensive AI regulation is reshaping the way electronics manufacturers develop, deploy and manage AI-enabled products. This article from Iain Bowes, head of management system assurance for TÜV SÜD Business, examines high-risk AI classifications, supply chain obligations, compliance deadlines and the steps organisations should take to achieve trustworthy AI.
The European Union’s (EU) AI Act is the world’s first comprehensive legal framework for artificial intelligence (AI). It mandates that organisations must integrate technical safeguards with ethical and legal compliance across the entire AI lifecycle. Organisations must therefore take a risk-based approach to comply with legal requirements for AI applications. This places the heaviest compliance burdens on systems that pose threats to health, safety and fundamental rights. For the electronics and manufacturing sectors, this is not merely an IT challenge; it is a fundamental governance mandate.
The impact on UK supply chains
A common misconception is that the AI Act is confined only to the EU. However, UK-based businesses are fully bound by its requirements if their AI systems are placed on the EU market, or if the output of those systems (e.g., a prediction or decision) is used within the EU. Consequently, UK organisations trading with or supplying EU partners must align their operational practices with the Act.
The AI Act categorises entities based on their interaction with the AI system across the value chain of providers, importers or distributors, and deployers/users. It applies to users located in the EU, and third country users where the AI system’s output is used in the EU. Providers are developers and manufacturers who train or place AI models on the market, and they face the most severe compliance obligations. If a UK organisation deploys AI tools internally, for example for supply chain logistics, managing business functions or for assembly operations, it is acting as a deployer and is subject to obligations relating to responsible use, human oversight and record keeping. Importers must guarantee that non-EU systems satisfy European requirements before market entry, while distributors that sell or supply AI systems without modifying them must ensure systems are supplied safely.
Classifications and the double compliance burden
The manufacturing and electronics sectors are greatly impacted by the Act’s high-risk classifications, particularly regarding embedded AI. Under Article 6(1), an AI system is automatically classified as high-risk if it acts as a safety component of a product covered by existing EU product safety laws (listed in Annex I), and that product requires a third-party conformity assessment.
If a company manufactures smart machinery or industrial IoT devices, they must follow both the AI Act and the relevant existing safety laws. This creates a complex double compliance burden for manufacturers, and directly impacts:
- Industrial machinery – AI used to control robotic arms, automated assembly lines, which falls under both the AI Act and the Machinery Regulation
- Electronics and radio equipment – AI integrated into smart devices or industrial IoT sensors subject to the Radio Equipment Directive.
- Medical devices – hardware using AI-powered diagnostic algorithms
- Lifts and pressure equipment – AI deployed to manage critical safety protocols.
For these systems, an organisation cannot apply a CE Mark unless the high-risk requirements of the AI Act have been entirely fulfilled alongside the existing safety directives.
Enforcement timelines and the penalty structure
Following the May 2026 AI Act Omnibus, the European Parliament and Council amended the legislation to ease the transition for businesses. The enforcement deadlines for high-risk AI rules have been extended to 2 December 2027 for standalone systems, and 2 August 2028 for systems embedded within regulated products.
Organisations failing to establish verifiable compliance face a three-tiered penalty system:
- Unacceptable risk violations – fine of up to €35 million or 7 per cent of total worldwide annual turnover, whichever is higher.
- Non-compliance with obligations – violations relating to data governance or transparency carry fines up to €15 million or 3 per cent of total worldwide annual turnover.
- Misleading authorities – supplying incorrect information results in fines up to €7.5 million or 1 per cent of total worldwide annual turnover
To foster innovation, regulatory simplifications regarding technical documentation have been extended beyond SMEs to include small mid-caps (SMCs).
Bridging the gap
The EU AI Act takes AI from being a technical issue to a board-level compliance priority. However, regulatory compliance is merely the floor. To engineer genuine operational trust, businesses must shift from traditional perimeter defence to securing the intelligence itself.
This systemic resilience is achieved by implementing the ‘Three Pillars of Trust’:
- Technical resilience – hardening systems against logic-based manipulation, such as prompt injection, to ensure the AI cannot bypass safety filters.
- Ethical governance (The Compass) – aligning algorithmic behaviour with legal requirements through bias monitoring and mandatory human-in-the-loop oversight.
- Supply chain transparency – creating complete visibility across the AI stack and using an AI asset registry to track data provenance and eliminate unauthorised shadow AI.
As an organisation cannot secure what it has not catalogued, a critical component of governance is continuous maintenance of the AI asset registry. Organisations should therefore integrate the six core principles of the AI Essentials framework:
- Pillar 1 – Security and Data Integrity: Securing data pipelines and deploying semantic firewalls to defend against adversarial attacks.
- Pillar 2 – Transparency and Explainability: Providing clear notification to stakeholders that they are interacting with an AI system.
- Pillar 3 – Human-in-the-Loop and Accountability: Mandating that any AI output leading to a high-risk operational decision receives final sign-off from a designated human authority.
- Pillar 4 – Fairness and Bias Mitigation: Actively testing datasets and outputs to ensure the AI does not produce discriminatory results.
- Pillar 5 – Reliability and Hallucination Management: Grounding the AI in verified, factual data using Retrieval-Augmented Generation (RAG) to minimise fabrications.
- Pillar 6 – Societal, Ethical, and Consequential Impact: Executing comprehensive assessments to evaluate the broader effects of AI deployment on the workforce and society.
AI-enabled systems must be designed for the safety of the end-user, not just to satisfy a regulator. By the end of the August 2028 transition window, the electronics manufacturers that thrive will be those that didn’t just ‘tick the box’ of the EU AI Act, but those that actively embed frameworks like AI Essentials to foster a verifiable and human-centric AI ecosystem.
www.tuvsud.com/en-gb/cybersecurity
For more news please visit: News – CIE
