The short answer: the EU AI Act became broadly applicable on 2 August 2026, but high-risk obligations are staged: Annex III high-risk uses apply from 2 December 2027, and Annex I high-risk AI embedded in products covered by EU product-safety law applies from 2 August 2028. The AI Omnibus, in force on 27 July 2026, adjusted this timeline. Manufacturers exporting to the EU must first decide whether their AI is a safety component, a recruitment/critical-infrastructure use, or merely an assistive inspection, support, or content tool. Not every AI system needs CE marking or the same compliance file. This is public-source research, not legal advice.
This guide is for Chinese manufacturers exporting equipment, software, or industrial AI to the EU, and for their EU importers, distributors, and IT teams. Data cut-off: 25 October 2026. Sources are the European Commission AI Act page, Regulation (EU) 2024/1689, the AI Omnibus Regulation, and the AI Act Service Desk. Classification depends on intended purpose, product law, and deployment; confirm with qualified legal/compliance counsel.
Not all AI is high-risk. Not all high-risk obligations start in 2026. Exporter, importer, distributor, and deployer duties depend on role and actual control.
What does the EU AI Act regulate for manufacturers?
It regulates AI placed on or used in the EU market by risk tier; manufacturers mainly face product-safety components, recruitment/critical infrastructure, transparency, and general-purpose model rules.
The Act uses four risk levels. Unacceptable-risk practices are banned. High-risk systems must meet risk management, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, and post-market monitoring requirements before market placement. Limited-risk systems mainly face transparency duties. Minimal-risk systems have no additional AI Act obligations. It applies to AI placed on the EU market or put into service, regardless of where the provider is established.
For manufacturers, the key question is not “do we use AI?” but what is the AI’s intended purpose? Is it a safety component of machinery, or an engineer’s advisory tool? Is it used for hiring/workforce management, or only to inspect cosmetic defects? The same vision model can fall into different categories depending on purpose.
Which AI functions may be high-risk?
Safety components, AI covered by machinery/medical product law, and Annex III uses such as recruitment or critical infrastructure may be high-risk; ordinary inspection assistance and support chat usually are not.
| Manufacturing scenario | What to assess | Common mistake |
|---|---|---|
| AI visual inspection | Does it only assist a human? Does it control line stop or a safety interlock? Is it a machinery safety component? | Assuming all inspection AI is high-risk, or that none is covered |
| Predictive maintenance | Is it advisory? Does it trigger automatic shutdown or safety action? Does it affect critical infrastructure? | Treating an advisory alert as a safety control |
| Industrial robot/equipment AI | Is it a safety component under machinery/product law? What is the intended purpose? | Classifying only by “robot”, not by function |
| Support/sales chatbot | Does it interact with people? Is AI disclosed? Does it make high-risk decisions? | Ignoring transparency duties |
| Recruitment/workforce AI | Screening, evaluation, scheduling, promotion; Annex III | Assuming “internal tool” is out of scope |
| Generative content/marketing | Synthetic-content labelling, deepfakes, copyright/data | Focusing on model capability, not disclosure |
Examples for compliance mapping, not legal classification. High-risk status depends on intended purpose, product law, deployment, and whether the system is a safety component; confirm with counsel.
How does the 2026–2028 timeline work?
The Act applies broadly from 2 August 2026; Annex III high-risk duties apply from 2 December 2027 and Annex I product-embedded high-risk AI from 2 August 2028.
| Date | Milestone | What it means for exporters |
|---|---|---|
| 1 Aug 2024 | AI Act enters into force | Start role and use-case mapping |
| 2 Feb 2025 | Prohibitions and AI literacy apply | Screen banned uses; train staff |
| 2 Aug 2025 | GPAI models, governance, some penalties apply | Check upstream model responsibilities |
| 2 Aug 2026 | Main application; AI Office/member-state enforcement | Transparency, roles, documentation, incident process |
| 2 Dec 2026 | Synthetic-content and some prohibition dates | Generative marketing and labelling |
| 2 Dec 2027 | Annex III high-risk duties apply | Recruitment, critical infrastructure, other listed uses |
| 2 Aug 2028 | Annex I product-embedded high-risk AI applies | Machinery/equipment safety components and technical file |
Based on the European Commission AI Act page (updated 19 Oct 2026) and the AI Omnibus timeline. Dates can change; check the official text.
What do equipment makers, software vendors, and exporters need to do?
A Chinese manufacturer placing its own-brand AI equipment on the EU market may be a provider; importers, distributors, and deployers have separate duties based on contract and control.
| Role | Typical situation | First action |
|---|---|---|
| Provider | Places an AI system/equipment on the EU market under its own brand, or substantially modifies it | Determine risk class, technical file, QMS, conformity assessment, CE/declaration where applicable |
| Importer | Imports a third-country AI system into the EU | Verify provider compliance, marking, and documentation; keep records |
| Distributor | Sells in the supply chain without changing the system | Check CE/documentation/labels; stop if non-compliance is found |
| Deployer | Uses AI in an EU factory, including internal systems | Use per intended purpose, human oversight, logs, worker information, incident reporting |
Roles are not assigned by nationality alone; they depend on placing on the market, import, distribution, use, and actual control. Contracts should allocate duties.
Which documents and evidence should be prepared now?
Start with intended purpose, risk classification, technical documentation, data governance, logs, human oversight, security testing, post-market monitoring, and incident reporting.
| Evidence pack | Content | Common gap |
|---|---|---|
| Intended purpose | Use, users, boundaries, prohibited uses, relationship to safety functions | Marketing copy and engineering definition differ |
| Risk classification | Annex I/III, safety component, transparency duties | Classifying by technology type only |
| Data governance | Training/validation sources, bias, labelling quality, customer data | Data provenance cannot be traced |
| Technical file | Architecture, model, interfaces, version, tests, limits | Only a demo deck, no versioned documents |
| Logs and oversight | Input/output, human review, exceptions, retention | Logs missing or not exportable |
| Accuracy/robustness/security | Test set, edge conditions, adversarial/failure scenarios, cybersecurity | Only average accuracy is reported |
| Post-market monitoring | Drift, incidents, corrective action, supplier changes | No owner after launch |
| Incident reporting | Serious-incident process, owner, timeline, records | Contract omits notification duty |
A general preparation checklist, not a complete compliance template. Annex-specific conformity assessment and product-law duties must be confirmed for the actual use.
Which AI functions are usually not high-risk?
Advisory tools that do not control safety and are not used for recruitment or critical infrastructure are usually lower risk; transparency, data, and product-safety duties may still apply.
“Not high-risk” does not mean “no obligations”. A support chatbot should disclose that it is AI; generative marketing content must follow synthetic-content labelling; personal data still triggers GDPR; equipment still faces machinery, EMC, cybersecurity, and other product rules. The AI Act is not the only applicable law.
For many internal efficiency tools (document summaries, knowledge Q&A, non-safety inspection assistance), the focus is usually transparency, data governance, worker information, and supplier contracts. Do not assume a full high-risk conformity assessment just because the tool uses AI, and do not ignore the Act because it is “only assistance”.
What should procurement ask suppliers?
Contracts should define AI function boundaries, training/customer data, logs, human oversight, incident notification, change control, model/supplier exit, and compliance responsibility.
- Function boundary: Does AI control safety/stop/quote/compensation, or only advise? Who can change thresholds?
- Data: Training data, customer data, retention, cross-border transfer, training use, export, and deletion.
- Logs and oversight: Input/output logs, human review records, audit access, retention.
- Incidents and change: Serious-incident notice, model/rule changes, regression tests, rollback.
- Roles: Provider/importer/deployer allocation, CE/document duties, subcontractors, and model suppliers.
- Exit: Model/supplier replacement, data/log export, continued operation after service ends.
What can Lingyi do — and not do?
Lingyi can support data, logs, permissions, human oversight, and documentation, but is not a law firm or notified body and cannot replace CE conformity assessment.
LingHarness can serve as a private AI foundation with model access, permissions, logs, and agent execution boundaries; LingMOE can carry equipment, work-order, quality, and ERP/MES/OA data. We can help put intended purpose, data, logs, human review, and change processes into the system, but we do not provide legal advice, act as a notified body, or guarantee CE or a compliance conclusion. High-risk classification and product-law questions need qualified legal/compliance advisers and a notified body where applicable.
Related reading: China’s agent rules and procurement checklist, manufacturing AI in 2026, and AI inspection cost and ROI. To map AI boundaries and evidence, talk to us.
FAQ
Does the EU AI Act apply to every AI product exported to the EU?
No. It is risk-based; most AI is minimal or limited risk with transparency duties. High-risk status depends on intended purpose, safety-component status, and Annex I/III use. The presence of AI alone does not determine the category.
Do all obligations start on 2 August 2026?
No. Main application and enforcement start then, but Annex III high-risk duties apply from 2 December 2027 and Annex I product-embedded high-risk AI from 2 August 2028; synthetic-content and other dates also apply. Check the latest official text.
Is a Chinese equipment maker always a provider?
Not necessarily. It depends on whether it places its own-brand system on the EU market, substantially modifies it, and who imports, distributes, or uses it. Direct own-brand exports may create provider duties; sales through an EU importer may allocate roles differently. Put this in the contract.
Is AI visual inspection always high-risk?
No. Inspection that only assists a human and does not control a safety interlock is often not high-risk. If it is a machinery safety component or controls a safety action, Annex I/product law may apply. Assess the intended purpose and actual function.
If we use a third-party model, is the model vendor responsible for everything?
No. The model vendor may have GPAI duties, but the provider integrating AI into equipment/software and the deployer using it still have transparency, human oversight, logging, and incident duties. Allocate responsibilities in the contract.
Can Lingyi certify EU AI Act compliance?
No. Lingyi is not a law firm or notified body and cannot issue a CE/compliance conclusion. We can help systemise data, logs, permissions, human oversight, and documentation, but high-risk classification, conformity assessment, and product-law questions require qualified advisers.
Sources, method, and limits
This is public-source research and editorial synthesis, not legal advice, interviews, or a compliance audit. Data cut-off: 25 October 2026. AI Act timelines, guidance, and standards are still evolving; obligations depend on the product, use, role, and member-state enforcement. “May” and “usually” are not legal conclusions; consult qualified counsel before placing AI on the EU market.
- European Commission, AI Act (page updated 19 Oct 2026): risk tiers, high-risk timeline, GPAI, transparency, AI Omnibus, enforcement.
- Regulation (EU) 2024/1689 (AI Act): official EUR-Lex text.
- AI Omnibus Regulation (in force 27 Jul 2026): high-risk timeline changes, SME simplifications, prohibitions, governance.
- AI Act Service Desk: official Q&A and implementation support.
The Chinese version is at 欧盟 AI Act 制造业出海合规.