Annex I High-risk AI: Safety Components in Regulated Products (Deadline: 2 August 2028)

Annex I of the EU AI Act covers AI systems that are safety components of products already regulated under EU product safety legislation — medical devices, machinery, vehicles, aviation, toys. The compliance deadline is 2 August 2028, extended by 24 months by the 2026 Digital Omnibus.

What Annex I covers — AI embedded in regulated products

Annex I of the EU AI Act lists EU legislation governing product safety. When an AI system constitutes a safety component of a product covered by these laws, that AI system is classified as high-risk under Art. 6(1). The deadline is 2 August 2028, extended by 24 months by the 2026 Digital Omnibus.

The defining characteristic: the AI is embedded within a regulated product and performs a safety-critical function. The AI is not placed on the market independently — it ships as part of the product.

Which product legislation triggers Annex I?

How Annex I conformity assessment works

Unlike Annex III (which has its own standalone conformity procedure), Annex I compliance is integrated into the existing conformity assessment for the relevant sector legislation.

For medical devices (MDR/IVDR): The MDR/IVDR conformity assessment (Annex IX Technical Documentation review, or Annex X Type Examination) is extended to cover AI Act requirements. Technical documentation must additionally include:

• AI-specific risk management (Art. 9)
• Training and validation data description (Art. 10)
• Accuracy, robustness, and cybersecurity measures (Art. 15)
• Human oversight design (Art. 14)

The MDR/IVDR notified body handles the combined assessment where qualified. Where an AI Act notified body is required separately, coordination between the two is needed.

For machinery and vehicles: Similar integration applies. The type-approval or conformity assessment procedure for the product is extended to include AI Act requirements. The technical file is a combined document.

Obligations for providers of Annex I AI (by 2 August 2028)

Why 2028 — and what to do now

The 24-month extension acknowledges real-world complexity: coordinating AI Act compliance across two overlapping regulatory regimes (sector law + AI Act) while harmonised standards are still being developed takes longer than standalone systems.

But the extension is not a reason to wait. Start now on:

1. AI inventory — identify which products contain AI safety components
2. Classification — confirm which qualify as Annex I high-risk (safety component test)
3. Gap assessment — map current technical documentation against Art. 11/Annex IV requirements
4. Notified body engagement — determine whether your current MDR/IVDR/Machinery notified body is also designated for AI Act assessment, or whether coordination with a separate AI notified body is needed
5. QMS extension — begin extending your ISO 13485 (medical) or ISO 9001 (machinery) QMS to cover AI lifecycle requirements

Notified body capacity for AI Act assessments will be constrained as 2028 approaches. Early engagement is a competitive advantage.

Intersection with DORA and NIS2

Medical device manufacturers and industrial equipment providers in critical sectors also face NIS2 obligations. AI systems embedded in networked medical devices or critical infrastructure equipment may simultaneously be Annex I high-risk AI (AI Act), subject to NIS2 security measures, and — if used in financial contexts — DORA ICT requirements. See our convergence analysis →.