When AI Must Say No – Part 2: How requirements for AI will intensify by 2027.
By early to mid-2027, four EU regulations will converge to form a new framework for the operational B2B use of AI: The EU AI Act, the new EU Product Liability Directive, and the Cyber Resilience Act will affect virtually every provider, while the new Machinery Regulation will additionally impact the mechanical engineering sector in particular. Those who build with technical integrity will automatically fulfill a large portion of the requirements. However, building with integrity requires active decision-making. This article outlines the deadlines and impacts, illustrates the interdependencies, and identifies key levers in the newly defined AI supplier-customer relationship.
Three dates, one direction
Three key dates will soon apply across all industries, with a fourth applying specifically to mechanical engineering:
- August 2, 2026. The high-risk obligations of the EU AI Act under Annex III come into force, including for AI used as a safety component in the supply of water, gas, heating, or electricity.
- December 9, 2026. Deadline for the national implementation of the new EU Product Liability Directive (PLD). From this date, software and AI systems will be explicitly classified as products.
- August 2, 2027. The obligations under the EU AI Act take effect for AI used as a safety component in machinery subject to third-party assessment. This is, for example, the standard case in mechanical engineering.
- January 2027. Application of the new Machinery Regulation. For machines with AI components, the CE marking process will be expanded to include AI-specific aspects.
In parallel, the reporting obligations of the Cyber Resilience Act (CRA) will apply from September 11, 2026, with its main obligations, including CE conformity, taking effect from December 11, 2027.
Four parallel regulations
The four listed regulatory frameworks cover different risk classes and complement one another:
- EU AI Act requires documented risk management, technical documentation, human oversight, proof of data quality, transparency measures, and audit logs for high-risk AI. Violations are subject to fines of up to 15 million euros or 3% of global annual turnover under Art. 99(4) (and up to 35 million euros or 7% of global annual turnover in the case of prohibited practices).
- Product Liability Directive (PLD) explicitly classifies software and AI systems as products. In external relations with injured parties, machine manufacturers and AI component manufacturers (AI suppliers) are jointly and severally liable. In the event of proven AI Act violations, the burden of proof is reversed in favor of the injured party.
- Cyber Resilience Act (CRA) specifically mandates secure-by-design, systematic vulnerability management, security updates throughout the entire product lifecycle, coordinated vulnerability disclosure, and a Software Bill of Materials (SBOM).
- New Machinery Regulation explicitly addresses AI components in safety functions. Risk assessment, technical documentation, and cyber resilience are becoming mandatory.
The four regulations apply in parallel, not as alternatives. For a modern machine with AI components, communication interfaces, and update capabilities, this means three parallel CE marking paths with documentation that is partially overlapping but not identical. As of 2026, a fully bundled conformity assessment is not yet possible.
The underestimated turning point: Product liability and the supply chain
The Product Liability Directive is the most inconspicuous of the four points, yet it has the most significant consequences for supplier architecture. Three effects must be considered:
- Software and AI are becoming products. As such, they fall under the same liability regime as a mechanical defect.
- Joint and several liability. Machine manufacturers and AI component manufacturers are jointly liable to the injured party, regardless of who caused the defect.
- Reversal of the burden of proof. Anyone who can prove a violation of the AI Act no longer needs to independently establish the causal link between the violation and the damage.
Pure financial losses, such as production downtime or contractual penalties, remain outside the scope of the PLD and must continue to be regulated by contract.
In the internal relationship between the machine builder and the AI supplier, the distribution of liability is a matter of contract. Three contractual levers are therefore becoming mandatory: audit rights for AI components, recourse clauses for AI Act violations, and update obligations throughout the machine's lifecycle.
Compliance as a byproduct of clean architecture
This brings us back to Part 1 of this series (Building and operating reliable AI agents in industry): Audit logs, a policy layer, systematic evaluations, and machine-readable trace events provide the necessary compliance evidence. Those who build and operate AI agents cleanly will meet many of these requirements without additional effort..
Most obligations cannot be met through a generic AI subscription. Documentation, acceptance, and traceability requirements demand architectural, procedural, and contractual responses. If you were inclined in Part 1 to view tool registries, continuous integration, and machine-readable audit events as mere engineering conveniences, you will now see them in their true regulatory context.
Support for SMEs
In light of the wave of AI regulations heading toward companies of all sizes, the EU Commission is working on relief measures for small and medium-sized enterprises: simplified templates for technical documentation, sample checklists for quality management, and secure environments where new AI applications can be tested under regulatory supervision before entering the market. However, it remains to be seen what will actually be available and when.
Key Takeaway
The effort a company invests today in the clean development and operation of its AI agents will become a competitive advantage by 2027 at the latest. Those who begin working with technical precision over the next 18 months will meet the majority of regulatory requirements as a byproduct. Those who wait will have to retrofit these requirements under time pressure. Both are possible, but starting early is more cost-effective.
For those who want to know more, our whitepaper "When AI Agents Must Say No" provides further details and practical recommendations for mechanical and plant engineering.
