Quick summary

The EU AI Act regulates AI by risk, and AI used as a safety component in critical infrastructure such as electricity can fall into its most demanding high-risk category. A 2026 simplification package moved the timeline, but not the substance. This article explains when energy and industrial AI counts as high-risk and what operators should be doing now.

Introduction

Artificial intelligence is spreading quickly through energy and industrial systems: forecasting demand, optimising grids, detecting faults, monitoring equipment and assisting control decisions. Much of this is straightforward, low-risk automation. Some of it is not. When an AI system sits close enough to physical operations that its failure could endanger people or infrastructure, the EU AI Act treats it very differently.

The Act takes a risk-based approach, and its heaviest obligations fall on systems classified as high-risk. For energy and industrial operators, the central question is deceptively simple to ask and harder to answer: does a given AI system count as a safety component in critical infrastructure, and therefore as high-risk? Getting that judgement right, and acting on it in time, is what this comes down to.

How the high-risk classification works

The AI Act's high-risk category is defined largely through its annexes, and two routes are most relevant to energy and industrial AI.

The first runs through Annex III, which classifies as high-risk any AI system intended to be used as a safety component in the management and operation of critical infrastructure, including the supply of electricity, gas and heating. The Act draws its definition of critical infrastructure broadly, spanning the energy value chain from production through transmission and distribution to supply, and an AI system qualifies as a safety component where its failure could cause physical damage or harm to people or property (Baker Botts, 2026).

The second route runs through product safety legislation. Where an AI system is embedded as a safety component in a product already subject to third-party conformity assessment under EU harmonisation rules, such as the Machinery Regulation, it can be classified high-risk on that basis. A single AI system can trigger high-risk status under both routes at once, each carrying its own obligations.

Notably, AI used purely for cybersecurity is expressly excluded from the safety-component classification, as is, under draft guidance, an AI system used only for grid optimisation where core safety functions are handled separately.

The reason classification deserves careful attention rather than a quick assumption is that the line between a high-risk safety component and an excluded optimisation tool can be fine, and regulators are unlikely to read "safety component" narrowly in a critical-infrastructure context. Where the judgement is borderline, under-classifying carries the greater risk.

Takeaway: Energy AI is high-risk when it acts as a safety component in critical infrastructure, a classification that is often borderline and best assessed carefully.

What the 2026 simplification changed, and what it did not

Anyone tracking the AI Act needs to understand a significant 2026 development. As part of a broader simplification effort, the Commission proposed the AI Omnibus in November 2025, a political agreement was reached in May 2026, and the European Parliament voted in favour in June 2026, with enactment expected shortly after (European Commission, 2026).

The most important practical effect concerns timing. The obligations for Annex III high-risk systems, including those in critical infrastructure, were originally due to apply from 2 August 2026. Under the revised approach, application of these high-risk rules was postponed to 2 December 2027, linking the date to the availability of supporting standards and guidance (Osborne Clarke, 2026).

What the simplification did not change is the substance. The classification criteria, the obligations on providers and deployers, and the direction of travel remain in place. Systems already in use before the new date are largely outside scope unless they undergo significant design changes or are operated by public authorities, but the core compliance expectations are unchanged.

The extended timeline is therefore best read as preparation time, not reprieve. The Commission also published draft classification guidelines in 2026, with a public consultation, interpreting the high-risk test broadly enough that more systems may fall in scope than a casual reading suggests.

Takeaway: The AI Omnibus pushed high-risk critical-infrastructure obligations to December 2027 but left the classification criteria and obligations intact.

What energy and industrial operators should do now

For operators, the extended timeline is an opportunity to get ahead of a complex obligation rather than a reason to defer it. The work that matters most can begin now.

A practical starting point is an inventory and classification exercise. Operators should map their AI systems, including those procured from vendors, and assess each against the high-risk criteria, documenting the reasoning. Under the Act, a provider that considers an Annex III system not to be high-risk must document that assessment, so the analysis itself is part of compliance.

Roles also need to be clarified. An organisation may be a provider of AI systems it develops, a deployer of systems it buys, or commonly both, and the obligations differ. Provider obligations are the most extensive, spanning risk management, data governance, technical documentation and post-market monitoring across the system lifecycle.

The interpretive point is that the binding work of AI Act compliance, classifying systems, assigning roles and building governance, is independent of the deadline, so the postponement to 2027 is most valuable to operators who use it to prepare rather than to wait. The systems in scope are often already deployed or in procurement today.

For operators across the Nordics, DACH and Benelux markets, many of whom are also subject to NIS2 as critical entities, the efficient path is to integrate AI Act readiness into existing risk-management and governance frameworks rather than treating it as a wholly separate compliance track.

Takeaway: Operators should inventory and classify AI systems, clarify provider and deployer roles, and build governance now, using the extended timeline to prepare.

The procurement dimension operators often miss

Much of the AI used in energy and industrial settings is not built in-house. It is procured from vendors, embedded in larger systems, or delivered as part of a control or monitoring platform. That makes procurement one of the most important, and most overlooked, places where AI Act readiness is won or lost.

When an operator deploys a vendor's high-risk AI system, the operator typically becomes a deployer with its own obligations, while the vendor is the provider carrying the heavier ones. But the operator can only meet its duties, and rely on the system lawfully, if the vendor has done its part: the conformity assessment, the technical documentation, the risk management and the information needed for proper oversight. A deployer inherits the consequences of a provider's gaps.

This argues for building AI Act expectations into procurement now, while the extended timeline allows it. Contracts can require vendors to confirm how their systems are classified, to supply the documentation the Act requires, and to support the operator's oversight obligations. Discovering after deployment that a critical system lacks the necessary conformity evidence is a far worse position than establishing it as a purchasing condition up front.

The interpretive point is that AI Act compliance flows through the supply chain, so operators that embed clear classification and documentation requirements into procurement protect themselves far more effectively than those that assess only the systems they build themselves. Much of the exposure sits in bought-in systems, not home-grown ones.

For operators across the Nordics, DACH and Benelux markets sourcing AI-enabled control and monitoring systems from a range of vendors, making AI Act evidence a standard procurement requirement is among the most practical preparatory steps available.

Takeaway: AI Act obligations flow through the supply chain, so building classification and documentation requirements into procurement is a key way operators reduce their exposure.

Conclusion

The EU AI Act brings AI used in critical infrastructure into a demanding regulatory regime, and energy and industrial operators sit squarely within its reach when their AI systems act as safety components. The 2026 simplification moved the deadline for high-risk obligations to December 2027 but left the underlying requirements unchanged.

The sensible response is to treat classification as a careful, documented judgement, to clarify whether the organisation is acting as provider or deployer, and to build the governance the Act requires now. The operators who use the extended timeline to prepare, rather than to defer, will be the ones ready when the obligations bite.

FAQ

When is an AI system high-risk under the EU AI Act?

An AI system is high-risk when it falls within the use cases listed in Annex III, which includes AI used as a safety component in the management and operation of critical infrastructure such as electricity, gas and heating. It can also be high-risk when embedded as a safety component in a product subject to third-party conformity assessment under EU harmonisation legislation. A single system can qualify under both routes.

Is all AI used in energy high-risk?

No. Only AI that functions as a safety component, where failure could cause physical harm or damage, falls into the high-risk category on that basis. AI used purely for cybersecurity is expressly excluded, and draft guidance indicates that grid optimisation tools may not be high-risk where core safety functions are handled separately. Classification depends on the system's specific role.

What did the AI Omnibus change in 2026?

The AI Omnibus, agreed politically in May 2026 and supported by the European Parliament in June 2026, postponed the application of high-risk obligations for Annex III systems, including critical infrastructure, from August 2026 to 2 December 2027. It linked the timeline to the availability of supporting standards and guidance, but did not change the classification criteria or the substantive obligations.

What is the difference between a provider and a deployer?

A provider develops an AI system or places it on the market, while a deployer uses an AI system under its authority. Many organisations are both. Provider obligations are the most extensive, covering risk management, data governance, technical documentation, conformity assessment and post-market monitoring. Deployers also carry duties, including ensuring appropriate human oversight and monitoring.

Sources

• AI Act – European Commission, Shaping Europe's digital future – 2026 – https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

• The EU AI Act: What Energy Executives Should Know Before August 2026 – Baker Botts – 2026 – https://www.bakerbotts.com/thought-leadership/publications/2026/march/the-eu-ai-act

• European Commission publishes draft AI Act guidelines on high-risk classification – Osborne Clarke – 2026 – https://www.osborneclarke.com/insights/european-commission-publishes-draft-ai-act-guidelines-high-risk-classification-and

• Critical Infrastructure Spotlight: EU AI Act – Draft Guidelines on High-Risk AI Classification – McCann FitzGerald – 2026 – https://www.mccannfitzgerald.com/knowledge/construction-and-infrastructure/critical-infrastructure-spotlight-eu-ai-act-draft-guidelines-on-high-risk-ai-classification