In brief
- Regulation: AI Act.
- Network operators and operators deploying AI that plays a safety role in control systems are concerned — as providers if they develop the system, as deployers otherwise.
- Qualifying the security role.
- Managing risks and data.
- Ensuring human oversight.
- Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk infringements.
Regulatory deadlines
The key dates of this regulation.
August 2024
Entry into force
In forceFebruary 2025
Ban on prohibited practices
In forceAugust 2025
General-purpose AI models (GPAI) & governance
In forceAugust 2026
High-risk system obligations (Annex III)
In forceAugust 2027
High-risk embedded in products (Annex I)
UpcomingWhat does the AI Act cover?
Annex III of the AI Act targets AI systems used as safety components in the management and operation of critical infrastructure, including the supply of water, gas, heat and electricity. These systems are subject to high-risk obligations.
Forecasting or optimisation uses with no direct security role generally fall under the limited-risk category.
Is the "Energy & environment" sector concerned?
Network operators and operators deploying AI that plays a safety role in control systems are concerned — as providers if they develop the system, as deployers otherwise.
Purely analytical use cases (demand forecasting, maintenance) most often fall under lighter regulatory regimes.
Detailed obligations
Qualify the security role
Determine whether the AI is a security component of network management.
Manage risks and data
Implement risk management and data quality controls for high-risk systems.
Ensuring human oversight
Ensuring effective human oversight of AI-assisted management.
Document and assess
Compiling the technical documentation and conformity assessment.
Monitoring after market placement.
Organise incident monitoring and escalation.
Sanctions & risks
Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk non-compliance. A failing governance AI can affect the provision of an essential service.
Application timeline
- 1Entry into force. 1 August 2024.
- 2High risk. From 2026–2027 for critical infrastructure management.
Common mistakes in the sector
- 1Underestimated security role. Treating a steering AI as a simple analytical tool.
- 2Neglected robustness. Underestimating robustness requirements for critical infrastructure.
- 3Superficial oversight. Displaying human oversight without real means.
- 4Missing documentation. Failing to build the technical documentation.
Practical case
A power grid operator deploys a real-time balancing AI. As a safety component, it falls under high risk: documentation, robustness and human oversight are required, along with a manual fallback capability in the event of AI failure.
Compliance roadmap
- 1
Inventory. Map AI systems used for management and analysis.
- 2
Qualify. Isolating security components (high risk).
- 3
Strengthen reliability. Addressing data quality and robustness.
- 4
Document. Producing documentation and assessment.
- 5
Supervise. Implement human oversight and post-market monitoring.
Frequently asked questions
No: only AI that constitutes a security component of network management qualifies; forecasting often falls under limited risk.
Take action on AI Act
Free assessment or a chat with an expert dedicated to energy & environment.
They already trust us
See how organisations in the energy & environment sector secured their compliance with DCO.