AI Act, GDPR and sovereignty for industrial AI.

THE TIMELINE What applies, and when.

The AI Act entered into force on 1 August 2024 and applies in phases. The date most industrial buyers were given — 2 August 2026 for high-risk systems — is no longer correct: the Digital Omnibus on AI, in force since 27 July 2026, pushed the Annex III high-risk obligations back by sixteen months.

THE REAL QUESTION Is maintenance AI actually high-risk?

Usually not — and this is where a lot of RFP anxiety is misplaced. Annex III lists specific uses: biometrics, critical infrastructure, education, employment and worker management, essential services, law enforcement, migration, justice. Reading a machine manual, correlating work orders or ranking maintenance risk in a general manufacturing plant is not on that list.

• It can become high-riskif your plant is critical infrastructure — energy, water, transport — where AI is a safety component in its management or operation.
• It can become high-riskif the AI is embedded as a safety component in a product already regulated under Annex I, such as machinery placed on the market.
• Worker management is the one to watchAI used to allocate tasks, monitor performance or evaluate people at work falls under Annex III regardless of sector. A maintenance tool that starts scoring technicians has changed category.

GDPR Where GDPR actually bites in a plant.

The AI Act and GDPR run in parallel: the first governs the system, the second any personal data it touches. Plenty of industrial AI processes no personal data at all — sensor readings and machine manuals are not personal data. But maintenance records are more personal than teams expect.

• Work orders name peoplewho performed the intervention, when, how long it took. That is personal data about an identifiable worker.
• Voice reports are personal dataa recording of a technician dictating a report is their voice, and often their assessment of their own work.
• Anything that ranks peoplefirst-time-fix rate by technician is performance monitoring, with the works-council implications that follow in France.

PROCUREMENT What to ask any supplier.

1. 01Where does the data physically sit?Ask for the region, not the company’s head office. “European company” and “data stored in the EU” are different claims.
2. 02Is our content used to train your models?Ask for it in the contract, not the brochure. This is the single clause most likely to be softer than the sales conversation implied.
3. 03Read-only or read/write?A connector that only reads has a smaller blast radius, and a smaller compliance surface, than one that writes back.
4. 04Can it run in our own tenant, or offline?For a defence, pharmaceutical or critical-infrastructure site this is often the deciding question, not a preference.
5. 05Which certifications exist today?Insist on the distinction between certified, in progress and on the roadmap. All three are legitimate answers; only one is a certificate.
6. 06What happens to personal data in maintenance records?Retention, access, and whether the tool can avoid surfacing individual performance where you do not want it to.

OUR POSITION Where AutomAssist stands.

Stated plainly, so you can check it against the questions above: data residency in the EU by default; GDPR compliant; read-only connectors by default; and we do not train models on your data. ISO 27001 is in progress — our ISMS is under audit, which is not the same as certified, and we will not describe it as certified until it is. Deployment can be our Azure tenant, your own Azure tenant, or fully on-premise with a local model for air-gapped sites.