[Home](/)/[Resources](/resources)/EU AI Act for Hardware EUAI Regulation # EU AI Act for Hardware: Risk Classification and Obligations When Your Product Uses AI Embedding AI into hardware doesn't just make your product smarter — it makes you a regulated provider under EU law. The AI Act's obligations scale with risk, but even minimal-risk products need to understand the framework. This guide cuts through the regulation so hardware teams can identify their tier and act accordingly. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Feu-artificial-intelligence-act-hardware) At a glance Regulation (EU) 2024/1689 AI Act Applies from August 2024 (phased) High-risk hardware Annex I + II categories Notified body Required for high-risk AI ## How the AI Act applies to hardware products ### AI system definition and hardware scope The AI Act applies to AI systems, not to hardware per se, but hardware manufacturers are treated as 'providers' of AI systems when the AI runs on or is embedded in their device. A smart camera with AI-based object detection, a wearable with on-device health inference, or an industrial robot with ML-driven motion planning all make the hardware manufacturer subject to AI Act obligations as a provider. ### Risk tiers for hardware-embedded AI The Act defines four risk levels. Unacceptable risk practices are banned outright — real-time biometric surveillance in public spaces, social scoring, and cognitive behavioural manipulation. High risk covers Annex III categories including biometric identification, safety-critical infrastructure, medical devices, and employment tools. Limited risk products face transparency obligations only. Minimal risk products have no mandatory obligations under the Act. ### High-risk hardware obligations Products embedding high-risk AI systems must implement a quality management system, produce detailed technical documentation per Annex IV, build in automatic logging of operations, design human oversight measures into the hardware interface, and test the AI system for accuracy, robustness, and cybersecurity. High-risk AI systems must be registered in the EU AI database before being placed on the market. ### General-purpose AI (GPAI) models in hardware If your hardware ships with a general-purpose AI model — for example an on-device LLM used for voice commands or inference — additional GPAI obligations apply to the model provider. Systemic-risk GPAI models face the strictest requirements including mandatory adversarial testing, incident reporting, and cybersecurity measures. Hardware makers who also develop the embedded GPAI model are both 'providers' under the product rules and 'GPAI model providers' under the GPAI chapter. ## Steps to AI Act compliance for hardware manufacturers 01 Determine whether your product includes an AI system as defined in Article 3(1) of the AI Act — a system that, given inputs, generates outputs such as predictions, decisions, recommendations, or content using machine learning techniques qualifies; purely rule-based or deterministic software does not. 02 Classify the AI system by risk tier — check Annex III for high-risk application domains relevant to your product (medical, safety-critical infrastructure, biometrics, critical infrastructure control, and employment tools); verify whether the AI falls into the unacceptable risk category; otherwise determine whether it is limited-risk or minimal-risk. 03 For high-risk AI systems embedded in hardware: implement a quality management system covering the AI system lifecycle, prepare technical documentation per Annex IV, build in logging that records the AI system's operations sufficient to identify risks post-deployment, and ensure the hardware interface enables human oversight and intervention. 04 Complete conformity assessment — most high-risk AI systems can use internal control (Annex VI) where harmonised standards fully cover the system; AI systems used in biometrics or safety-critical infrastructure at the highest risk levels require assessment by an EU notified body. 05 Register the high-risk AI system in the EU AI database before placing on the EU market; affix the CE mark alongside the AI Act Declaration of Conformity; establish a post-market monitoring plan and report serious incidents to the relevant national market surveillance authority. ## Frequently asked questions ### Does the AI Act apply to hardware that runs AI models but doesn't develop them? Yes. A hardware manufacturer who integrates a third-party AI model into their product and places it on the EU market is a 'provider' under the AI Act and bears the provider's obligations, unless the original AI model developer has already met all requirements and the hardware maker has not substantially modified the model. In practice, most hardware integrations involve some degree of customisation that creates provider obligations. ### When do AI Act obligations for high-risk hardware start applying? The AI Act entered into force in August 2024. Prohibited practices apply from February 2025. Obligations for general-purpose AI models apply from August 2025. High-risk AI system obligations under Annex III apply from August 2026. High-risk AI systems that are safety components of products covered by existing EU product legislation (such as machinery or medical devices) have until August 2027. ### What hardware categories are automatically high-risk under the AI Act? Annex III lists the high-risk application areas. Hardware-relevant categories include: AI used as safety components in critical infrastructure (energy, water, transport), AI used in medical devices or in vitro diagnostic devices, AI systems in robots used in professional settings, and AI used in biometric identification or categorisation of natural persons. Annex I covers AI embedded in products already subject to EU product safety legislation — these are automatically high-risk when the AI is a safety component. ### Does the AI Act require CE marking? Yes, high-risk AI systems must bear the CE mark. Where the hardware product is also subject to other EU legislation requiring CE marking (such as the Machinery Regulation or the Medical Devices Regulation), a single CE mark covers all applicable requirements, and the Declaration of Conformity must reference all applicable legislation. The CE mark signals that the complete product — including its AI system — has been assessed against all applicable EU requirements. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇪🇺 CE Marking roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $199](/courses/56-eu-ce-marking-high-risk-ai-systems)[Prefer to read? Get the book — $34.99](/books/56-eu-ce-marking-high-risk-ai-systems) Related guides * [EU Cyber Resilience ActEU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [EU RED CybersecurityEU RED cybersecurity delegated regulation: network protection, personal data safeguards, and anti-fraud measures for radio equipment with internet connectivity or financial functions.](/guides/eu-radio-equipment-directive-cybersecurity) * [EU EcodesignEU Ecodesign implementing regulations under Directive 2009/125/EC: mandatory standby power limits, energy performance parameters, and how the transition to ESPR (EU 2024/1781) changes requirements.](/guides/eu-ecodesign-implementing-regulations) * [EU GPSREU Regulation (EU) 2023/988 GPSR replaced the GPSD in December 2024: new traceability rules, online marketplace duties, digital product identifiers, and the SAREF rapid-alert notification obligation.](/guides/eu-gpsr-general-product-safety)