AB KineticsBook an intro call
● AI governance for industryDrawing no. ABK-03

Regulation, translated into controls you can build.

Four EU regulations now touch AI on machines. We turn them into autonomy levels, approval gates and audit trails — so compliance speeds agents up instead of freezing them.

§01 — Revision history

The dates that matter.

Reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744), which deferred the high-risk deadlines. Status is calculated live from today's date.
  • A02.02.2025AI Act · Prohibited practices banned; AI-literacy measures for staff (Art. 4)Everyone using AI
  • B02.08.2025AI Act · Obligations for general-purpose AI modelsModel providers
  • C02.08.2026AI Act · Transparency duties (Art. 50): disclose AI interaction, label generated contentAnyone deploying chatbots & agents
  • D11.09.2026Cyber Resilience Act · Reporting of actively exploited vulnerabilities and severe incidentsMakers of products with digital elements
  • E12.09.2026Data Act · New connected products must give users direct access to their machine dataMachine builders, OEM service
  • F20.01.2027Machinery Regulation · Applies in full; ML-based safety components need notified-body assessmentMachine builders, integrators
  • G02.12.2027AI Act · High-risk obligations for Annex III systems (deferred by the Digital Omnibus)HR, critical infrastructure, access
  • H11.12.2027Cyber Resilience Act · All essential cybersecurity requirements applyMakers of products with digital elements
  • I02.08.2028AI Act · High-risk obligations for AI in regulated products — incl. machinery (Annex I)Machine builders
§02 — Questions we get from machine builders

Three questions, straight answers.

Q1 · AI Act

Is our service agent high-risk?

Usually not by itself — but transparency duties apply from August 2026, and AI inside safety functions of machinery moves into high-risk scope by August 2028.

Q2 · Machinery Regulation

What changes for AI on the machine?

From 20 January 2027, safety components with self-evolving ML behaviour require notified-body assessment. Agents that act on machines need clear boundaries to stay outside safety functions.

Q3 · Data Act

Who else can service our machines?

Users can now access — and share — the data your machines generate. Third-party service gets easier. The best defence is a service experience competitors can't match.

§03 — Our framework

Autonomy, by level.

The core of every governance engagement: decide how much an agent may do, then build exactly the controls that level requires — no more, no less.
Human does→ Autonomy →Agent does

Level L2 · Acts with approval

Executes the fix on the machine after a named engineer signs off.

Controls required

  • Source citations on every answer(L0)
  • Access scoped to role and site(L0)
  • Evidence & confidence shown(L1)
  • Engineer feedback loop into evaluation(L1)
  • Human approval gate per action
  • Action audit log
  • Rollback plan per action class
§04 — Engagements

Fixed scope. Clear exit.

  • G-01

    AI Readiness Check

    Inventory every AI use — shadow AI included — classify it under the AI Act and Machinery Regulation, and leave with a prioritised gap list.

    2 weeks
  • G-02

    Agent Governance Framework

    Autonomy levels, action permissions, approval gates, audit trails and a kill switch — designed for agents that touch real systems.

    4–6 weeks
  • G-03

    ISO/IEC 42001 AI Management System

    Policies, roles, risk and impact assessments and a lifecycle process that can grow into certification.

    90 days
  • G-04

    AI Literacy Programme

    Role-specific training for engineers, service teams and managers — documented to show the measures Art. 4 asks for.

    Ongoing

We are engineers, not lawyers. Our work turns regulation into technical and organisational controls, and we coordinate with your legal counsel and notified bodies where required.

Sources

  1. [1]Bitkom — Erstmals nutzt die Mehrheit der Unternehmen KI (14 Sept 2026)
  2. [2]Gibson Dunn — EU AI Act Omnibus agreement: postponed high-risk deadlines
  3. [3]TÜV SÜD — EU Machinery Regulation: tips for manufacturers and operators
  4. [4]Wilson Sonsini — EU Data Act September 2026 deadline

Release for production

Pick one machine. One failure. One quarter.

A 30-minute call is enough to find the first agent worth building — and the controls it will need.

Checked
Scope & data
Approved
Your name here
Date
This week