How vehicle AI becomes high-risk
Annex I lists the EU harmonisation legislation that, when an AI system is a safety component of a covered product, automatically pulls the AI into Article 6(1) high-risk status. For automotive that includes:
- Regulation (EU) 2019/2144 (General Safety Regulation 2 — driver-assistance systems, AEB, ISA, drowsiness detection).
- Regulation (EU) 2018/858 (motor vehicle type-approval framework).
- UN-ECE Regulation 79 (steering equipment), Regulation 152/153 (AEB), Regulation 155 (cybersecurity), Regulation 156 (software updates), Regulation 157 (Automated Lane Keeping Systems).
If the AI is a safety component of any vehicle subject to those regimes, it is high-risk. ADAS, autonomous-driving stacks, AI components of EBS, AI-based driver monitoring — all are captured.
Integrated conformity assessment under Article 43(3)
Article 43(3) is the manufacturer's most important provision. It directs that the AI Act requirements are checked as part of the existing type-approval procedure, not as a parallel process. Practically:
- The type-approval authority (KBA in Germany, UTAC in France, RDW in the Netherlands) acts as the relevant conformity-assessment body.
- The technical service performing the type-approval tests is the de facto AI Act notified body for the automotive case.
- The AI Act technical documentation under Annex IV is filed alongside the existing type-approval file.
- The EU declaration of conformity under Article 47 is integrated with the certificate of conformity issued for the vehicle.
Provider obligations in automotive
- Article 9 risk management aligned with ISO 26262 — the AI-specific risks (data drift, edge-case behaviour, training-data bias) are layered on top of the functional-safety hazard analysis.
- Article 10 data governance — training-data documentation including the geographic, weather, and lighting conditions covered; bias testing across pedestrian populations and atypical scenarios.
- Article 11 + Annex IV technical documentation, integrated into the type-approval file.
- Article 14 human oversight — for non-autonomous ADAS, the driver remains in the loop; for ALKS Level 3+, the system must support a safe transition of control.
- Article 15 robustness and cybersecurity — UN-ECE Regulation 155 cybersecurity management system serves the AI Act cybersecurity requirement.
- Article 72 post-market monitoring — the manufacturer's existing field-monitoring under GSR feeds the AI Act surveillance plan.
Who deploys, who provides
The OEM is the provider. Tier-1 suppliers furnishing AI subsystems are providers of those subsystems and may also act as authorised representatives for non-EU OEMs (Article 22). Fleet operators using vehicles in commercial service are deployers under Article 26 — including taxi and logistics fleets running L4 vehicles when they become available. Traffic-management operators (city traffic-control AI) are providers when they build the system in-house, deployers when they procure it.
Where the AI Act stretches existing automotive practice
- Article 10 data-governance evidence is more explicit than the type-approval data submissions to date — expect type-approval authorities to ask for representativeness statistics they have not asked for before.
- Article 49 EU AI Database registration is in addition to the existing vehicle-VIN tracking.
- Article 73 serious-incident reporting (15 days) is shorter than some sector recall timelines — the AI Act clock controls for AI-implicated events.
- Article 14 human-oversight evidence requirements apply even when the existing UN-ECE Regulation 79/152/157 already addresses control authority.
Cross-regulatory data update
Auto-merged from the Fontvera archetype dataset on 2026-05-12. The sections below are extracted verbatim from the `obligations` and `obligation_crossrefs` tables; the page itself was last reviewed manually before this update.
Practical steps
What the obligations on this page actually require you to do, ordered by article. Use this as a starting checklist; verify each item against the underlying article text before treating it as legal advice.
- Art 107 — consider (European Commission)
Obligation reference table
| Article | Obligated entity | Deadline | Penalty |
|---|---|---|---|
| Art 107 | European Commission | — | — |
| Art 104 | Commission | — | — |
| Art 103 | European Commission | — | — |
| Art 109 | Commission | — | — |
Penalty exposure
None of the 4 obligations on this page carry an explicit penalty figure in the AI Act text itself — the fine ceiling is set elsewhere in the regulation and applies by reference. Refer to AI Act's general penalties article (or the diagnostic below) to estimate exposure before signing off on a compliance programme.