Annex I Explained: AI in Regulated Products Under the EU AI Act

Annex I of the EU AI Act covers AI systems that are integrated with — or constitute — products already regulated under EU product-safety legislation. It is the "vertical" half of the high-risk regime, complementing the "horizontal" Annex III categories that classify AI by use case rather than by product type.

Understanding Annex I matters most for manufacturers of regulated products: medical devices, machinery, toys, vehicles, aircraft, ships, and many others. If your product already requires CE marking and notified-body involvement, and you are adding AI to it, you are almost certainly in scope.

This article walks through the Annex I list, the Article 6(1) trigger, the interaction with sector-specific product legislation, and the practical conformity-assessment path.

What Changed in July 2026

Regulation (EU) 2026/1744 ("Digital Omnibus on AI"), in force since 27 July 2026, is the first amendment to the AI Act, and it moves the Annex I date.

The deferral is unconditional. The Commission's original proposal would have tied the new dates to a decision confirming that harmonised standards were available — a "stop-the-clock" trigger — but the co-legislators dropped it. There is no standards-readiness condition in the adopted text, and no further automatic delay.

What did not move matters just as much. 2 August 2026 remained the AI Act's general application date, and the AI Office and national authorities began enforcing the Regulation on that date. The Article 50 transparency obligations — chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content — are in force now, as is Article 49 registration.

Two further amendments bear directly on Annex I. Machinery moved from Annex I, Section A to Section B. And a new Article 43(3) deadline requires notified bodies already notified under Annex I, Section A sectoral legislation to apply for designation under Chapter III, Section 4 of the AI Act by 28 January 2028. Separately, two new Article 5 prohibitions — covering non-consensual intimate imagery and child sexual abuse material — apply from 2 December 2026, and generative AI systems placed on the market before 2 August 2026 have until that same date to meet the Article 50(2) machine-readable marking duty under the new Article 111(4).

How Annex I Differs from Annex III

The EU AI Act classifies high-risk AI systems under two distinct pathways:

• Article 6(1) and Annex I capture AI systems integrated with regulated products. The classification is product-centric: it follows the existing Union harmonisation legislation that governs the product.
• Article 6(2) and Annex III capture standalone AI systems used in sensitive areas. The classification is use-case-centric: it depends on where the AI is deployed, not what product it powers.

A single AI system can fall under both pathways. For example, AI-driven diagnostic software that meets the definition of a medical device falls under Annex I via the Medical Devices Regulation, but if the same software is used by or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, it may additionally fall under Annex III, point 5(a).

The Article 6(1) Trigger

Article 6(1) classifies an AI system as high-risk under Annex I if two cumulative conditions are met:

1. The AI system is intended to be used as a safety component of a product, or is itself a product, covered by Union harmonisation legislation listed in Annex I, Section A or Section B; and
2. The product whose safety component the AI system is, or the AI system itself as a product, is required to undergo a third-party conformity assessment pursuant to that Union harmonisation legislation.

Both conditions matter. The first identifies which products are relevant. The second narrows the trigger to those products whose conformity already requires notified-body involvement.

Why the "Third-Party Conformity Assessment" Requirement?

The second condition is a calibration choice. EU product safety law treats different product classes with different rigour. Class I medical devices and machinery outside the high-risk categories can self-certify; higher classes need a notified body. The AI Act follows this gradient: AI added to a product already requiring third-party assessment is high-risk; AI added to a self-certifying product is not (under this pathway).

This can produce surprising results. The same AI feature may be high-risk in one device class and not in another, depending on the underlying product classification.

Annex I, Section A — Harmonisation Legislation

Section A lists Union harmonisation legislation that is closely integrated with the AI Act. The list, as amended by Regulation (EU) 2026/1744, which moved machinery to Section B:

These are the legislative regimes where AI Act obligations are fully integrated. Conformity assessment, post-market surveillance, and incident reporting can be conducted as a single, coordinated process under both regimes.

Annex I, Section B — Additional Legislation

Section B adds further legislation that mostly governs transport and motor vehicles, and — since Regulation (EU) 2026/1744 — machinery:

For Section B legislation, Article 2(2) provides that only Article 6(1), Articles 102 to 109 and Article 112 of the AI Act apply. The AI Act's substantive high-risk requirements are not imposed directly on the provider. Instead, Articles 102 to 109 amend the transport and vehicle acts listed above so that the Commission or the sector regulator — the European Union Aviation Safety Agency for civil aviation, for instance — must take the AI Act requirements into account when adopting delegated or implementing acts under that legislation. Regulation (EU) 2026/1744, which moved machinery into Section B, amended Regulation (EU) 2023/1230 directly. Articles 102 to 110 of the AI Act have applied since 27 July 2026.

Cross-Cutting Sectors

A few sectors deserve specific attention because they account for a large share of practical Annex I exposure:

Medical Devices and IVDs

Software qualifying as a medical device or in vitro diagnostic medical device falls within MDR or IVDR. Most software-only medical devices that incorporate AI require notified-body involvement (Class IIa, IIb, or III under MDR; Class B, C, or D under IVDR), which triggers high-risk classification under the AI Act.

The AI Act and MDR/IVDR share several concepts — risk management, clinical evaluation, technical documentation, post-market surveillance — but they are not identical. The AI Act adds requirements (data governance, bias assessment, human oversight) that go beyond MDR/IVDR. See AI in healthcare compliance for the integration in practice.

Machinery

Machinery has moved. Regulation (EU) 2026/1744 relocated the machinery entry from Annex I, Section A to Annex I, Section B. The entry covers Directive 2006/42/EC on machinery, read as Regulation (EU) 2023/1230 from 20 January 2027, when the new Machinery Regulation repeals and replaces the Directive. The Machinery Regulation explicitly covers safety components with fully or partially self-evolving behaviour using machine-learning approaches, which fall within its own Annex I list of high-risk machinery and related products — Part A of that list requiring notified-body assessment.

Industrial AI used in safety-critical machinery (collision avoidance in mobile robots, safety interlocks in automated production lines, AI-based hazard detection) therefore still falls within Annex I of the AI Act, and the Article 6(1) trigger applies as before. What changes is the route by which the requirements bite: as a Section B entry, machinery is now governed by Article 2(2), under which only Article 6(1), Articles 102 to 109 and Article 112 of the AI Act apply directly. Regulation (EU) 2026/1744 amended Regulation (EU) 2023/1230 itself, so machinery manufacturers should read the AI Act requirements through the Machinery Regulation as amended rather than as free-standing AI Act duties. The Machinery Regulation restructures the old Annex IV list of the Directive into an Annex I list split into Part A and Part B, and adds several new AI-relevant categories.

Toys

Directive 2009/48/EC covers AI features in toys, including increasingly common AI-driven interactive toys. Most toy compliance is self-certification, so the AI Act's Annex I trigger does not apply to typical toy AI. However, where no harmonised standard covers all the relevant safety requirements, or where the manufacturer has not applied such standards in full, Article 19 of Directive 2009/48/EC requires EC-type examination by a notified body, and integrating AI into such a toy would then trigger the Article 6(1) route.

Automotive

Regulation (EU) 2018/858 provides the motor-vehicle type-approval framework, and Regulation (EU) 2019/2144 sets the general safety and occupant and vulnerable-road-user protection requirements within it, including the Advanced Driver Assistance Systems (ADAS) requirements. Both are listed in Annex I, Section B. AI used in safety-critical driver-assistance functions, automated driving systems, and event-data recorders therefore falls within Section B, and automotive AI compliance flows through the established type-approval procedure run by national type-approval authorities. Under Article 2(2) the AI Act does not add free-standing obligations on top of that procedure; its requirements are brought in through the amendments made by Article 109 to Regulation (EU) 2019/2144.

Aviation

The aviation entries in Section B are narrower than they look. Regulation (EU) 2018/1139 is listed only in so far as the design, production and placing on the market of unmanned aircraft — and their engines, propellers, parts and remote-control equipment — are concerned, so AI in manned aircraft is not captured by that entry. Regulation (EC) No 300/2008 covers civil aviation security. In both cases Article 2(2) means the AI Act requirements reach manufacturers through the sectoral regime rather than as free-standing AI Act obligations: Article 108 amends Regulation (EU) 2018/1139, under which the European Union Aviation Safety Agency supervises certification, and Article 102 amends Regulation (EC) No 300/2008. The European Union Aviation Safety Agency has issued guidance materials clarifying how AI applications in aviation systems are assessed.

Conformity Assessment under Annex I

For Annex I high-risk systems, the conformity assessment procedure is integrated with the sectoral procedure, not run in parallel. Article 43(3) provides:

For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, the provider shall follow the relevant conformity assessment procedure as required under those legal acts. The requirements set out in Section 2 of this Chapter shall apply to those high-risk AI systems and shall be part of that assessment.

In practice, this means:

• For MDR/IVDR products: the notified body conducting the medical-device conformity assessment also verifies AI Act compliance
• For the remaining Section A legislation (toys, lifts, pressure equipment, radio equipment, personal protective equipment and the rest): the sectoral notified-body procedure absorbs the Section 2 requirements in the same way
• For Section B legislation (aviation, automotive, machinery since Regulation (EU) 2026/1744, and the rest): only the sectoral procedure applies. Under Article 2(2) the AI Act's own requirements do not bind the provider directly; they are taken into account when the Commission adopts delegated or implementing acts under the sectoral acts as amended by Articles 102 to 109

Regulation (EU) 2026/1744 also added a deadline for the bodies that will carry out these assessments: notified bodies already notified under the Annex I, Section A sectoral legislation must apply for designation under Chapter III, Section 4 of the AI Act by 28 January 2028 under the new Article 43(3). No harmonised standard has yet been cited in the Official Journal, so no CEN-CENELEC deliverable currently confers a presumption of conformity under Article 40; the standardisation request M/613 runs to 28 February 2027.

The single CE marking under Article 48 covers both the AI Act and the underlying product legislation. There is no separate AI Act marking.

The Annex I Timeline

Annex I high-risk systems benefit from a longer transition period than Annex III systems. Regulation (EU) 2026/1744 pushed the dates back:

The staggered dates acknowledge that integrating AI Act compliance into existing notified-body workflows takes time. Notified bodies must extend their designations to cover the AI Act — with the Article 43(3) application deadline of 28 January 2028 in between — common specifications and harmonised standards must be finalised, and product certification cycles run on multi-year timelines.

Two points of context. First, the deferral is unconditional: there is no standards-readiness trigger in the adopted text, so 2 August 2028 is a fixed date rather than a provisional one. Second, the deferral covers Chapter III, Sections 1 to 3 only. The rest of the AI Act applies now, and has been enforceable since 2 August 2026 — including the Article 50 transparency obligations, which bite on any AI-enabled product that interacts with people or generates synthetic content, whatever its high-risk status.

The Annex I date is roughly two years out, which is not as much slack as it sounds. The full conformity-assessment chain — risk management, data governance, technical documentation, post-market monitoring — takes 12–24 months to set up, particularly for highly regulated sectors, and it has to be ready before you can submit under the AI Act's integrated procedure rather than after.

What If My Product Is Covered by Both Annex I and Annex III?

This happens frequently. An AI clinical decision support system can fall under Annex I via MDR/IVDR and under Annex III, point 5(a) if it is used by or on behalf of a public authority to evaluate eligibility for essential public assistance benefits and services, including healthcare services.

The two Article 6 pathways are alternative: a system that meets either trigger is high-risk. There is no double regulation, however — the substantive requirements (Articles 8–15) apply once. The procedural pathways differ:

• For Annex I: conformity assessment integrated with sectoral procedure; registration under sectoral rules; CE marking
• For Annex III: conformity assessment per Article 43; EU database registration under Article 49

When both apply, the most demanding procedural path generally takes precedence, but with coordinated execution where possible.

Practical Checklist for Annex I Compliance

If you are placing an AI-enabled product on the EU market that may fall under Annex I:

1. Identify the applicable Union harmonisation legislation. Is the product covered by anything in Annex I, Section A or B?
2. Determine the conformity-assessment route under that legislation. Does it require notified-body involvement?
3. If both yes, the AI is high-risk under Article 6(1). For Section A legislation, plan for AI Act Articles 8–15 in addition to sectoral requirements. For Section B legislation, note that Article 2(2) applies only Article 6(1), Articles 102 to 109 and Article 112 — the substantive requirements arrive through the amended sectoral regime.
4. Engage a notified body that has been designated for both the sectoral legislation and the AI Act. Notified-body capacity is a known bottleneck, and bodies notified under Annex I, Section A legislation have until 28 January 2028 to apply for AI Act designation under Article 43(3).
5. Coordinate technical documentation. Annex IV of the AI Act maps onto sectoral documentation requirements; structure documentation so the same evidence supports both.
6. Plan post-market monitoring to satisfy both Article 72 of the AI Act and the sectoral post-market surveillance obligations.
7. Affix a single CE marking covering all applicable legislation.
8. Work back from 2 August 2028, the Annex I deadline as amended, when designing your compliance schedule — and do not overlook the obligations already in force, such as the Article 50 transparency duties.

Conclusion

Annex I is technically narrower than Annex III but commercially huge: it captures medical AI, industrial AI in machinery, automotive AI, aviation AI, and many other regulated-product sectors. The integration with existing CE-marking workflows is a feature, not a workaround — it lets manufacturers extend established compliance functions rather than building parallel ones.

For the use-case-driven half of the high-risk regime, see Annex III explained. For a step-by-step run through the full high-risk obligations once classification is settled, the high-risk AI systems requirements article is the reference.