In brief
- Regulation: AI Act.
- Manufacturers and equipment suppliers providing AI-based driving systems are concerned as providers.
- Qualifying the security role.
- Managing risks and data.
- Ensure oversight.
- Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk non-compliance, in addition to type-approval requirements.
Regulatory deadlines
The key dates of this regulation.
August 2024
Entry into force
In forceFebruary 2025
Ban on prohibited practices
In forceAugust 2025
General-purpose AI models (GPAI) & governance
In forceAugust 2026
High-risk system obligations (Annex III)
In forceAugust 2027
High-risk embedded in products (Annex I)
UpcomingWhat does the AI Act cover?
The AI Act classifies as high risk those AI systems that constitute a safety component of products subject to harmonisation legislation. In the automotive sector, this classification interacts with the type-approval framework, which already governs vehicle safety and cybersecurity.
Uses with no safety role (infotainment, voice assistants) generally fall under limited risk.
Is the 'Automotive' sector affected?
Manufacturers and equipment suppliers providing AI-based driving systems are concerned as providers. Qualification depends on the safety role of the system and its interaction with type approval.
Ancillary functions (comfort, information) most often fall under lighter regimes, but remain subject to GDPR when they process personal data.
Detailed obligations
Qualify the security role
Determine whether the AI is a safety component (high risk) or an ancillary function (limited risk).
Manage risks and data
Implement risk management and data quality controls for high-risk systems.
Ensure supervision
Ensuring human oversight appropriate to the level of automation.
Align with reception by type
Coordinating AI Act compliance with the sectoral vehicle reception and cybersecurity framework.
Monitoring after market placement.
Organising post-market surveillance and incident escalation.
Sanctions & risks
Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk non-compliance, in addition to type-approval requirements.
A poorly classified driving AI exposes the manufacturer to sanctions and market access restrictions.
Application timeline
- 1Entry into force. 1 August 2024.
- 2High risk. According to the roadmap of the products concerned (2026–2027), aligned with type-approval requirements.
Common mistakes in the sector
- 1Underestimated security role. Treat a steering AI as an ancillary function.
- 2Separate frameworks. Managing AI Act and reception by type in silos.
- 3Uncontrolled data. Using non-representative training data.
- 4Inadequate supervision. Planning for supervision ill-suited to the level of automation.
Practical case
A supplier provides a lane-keeping assistance system. As a safety component, it falls under high risk: the supplier documents risk management, data quality and human oversight, and coordinates its AI Act assessment with type-approval requirements rather than treating them separately.
Compliance roadmap
- 1
Inventory. Inventory embedded AI systems (driving, comfort, information).
- 2
Qualify. Distinguishing the safety component (high risk) from ancillary functions.
- 3
Align the frameworks. Articulate the AI Act and reception by type.
- 4
Frame. Implementing oversight and documentation.
- 5
Monitor. Organising post-market surveillance.
Frequently asked questions
No: only AI playing a safety role is generally covered; infotainment falls under limited risk.
Take action on AI Act
Free assessment or a chat with an expert dedicated to automotive.
They already trust us
See how organisations in the automotive sector secured their compliance with DCO.