Annex I Part A of Regulation (EU) 2023/1230 holds exactly six categories, and items 5 and 6 are the machine learning ones: safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, and machinery with such systems embedded that were not placed independently on the market. For those, Article 25(2) offers three routes, module B plus module C, module H, or module G, and every one runs through a notified body whose identification number then follows the CE marking under Article 24(3). What Annex I Part A removes is module A standalone self-declaration, not internal production control, because module C in route (a) is internal production control and it stays. Annex III 1.2.1 binds separately and more widely: its self-evolving block carries no safety-function qualifier, so a machine that escapes the notified body still owes a hard task and movement space bound, a one-year record of safety-related decisions, and correctability at all times. Three retention durations run in parallel, one year for the safety-decision record, five years for the tracing log of uploaded safety software versions, and ten years for the technical documentation, which includes the source code or programming logic on a reasoned request. The Regulation applies from 20 January 2027, not 14 January 2027, because a corrigendum in OJ L 169 moved it, and Member States notify their penalty rules by 20 October 2026. On 27 July 2026 the Digital Omnibus moved machinery from Section A to Section B of the AI Act's Annex I and left Article 25, Annex I and the application date untouched. Start this week by opening your cell's risk assessment and marking every function whose failure increases a risk that a learned model touches.
Two entries in Annex I decide this. Regulation (EU) 2023/1230, the EU Machinery Regulation, lists exactly six categories in Annex I Part A, and items 5 and 6 are the machine learning entries. A safety component with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions loses self-declaration: you pick one of three conformity assessment procedures, all run through a notified body, whose number joins the CE marking.
The date almost every page gives is wrong. A corrigendum in OJ L 169 of 4 July 2023 moved the application date from 14 January 2027 to 20 January 2027, and the penalties trigger to 20 October 2026.
Then the law moved again. On 27 July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved machinery from Section A of the AI Act's Annex I into Section B. That changes which instrument carries the AI obligations, not Article 25, so a plant running vision quality control or predictive maintenance faces the same scope question.
The two Annex I Part A entries that name machine learning
Annex I Part A is six items long. The first four are mechanical and old: removable mechanical transmission devices, guards for them, vehicle servicing lifts, and portable cartridge-operated fixing machinery. The last two are why this post exists.
5. Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. 6. Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems. # Regulation (EU) 2023/1230, Annex I Part A. OJ L 165, 29.6.2023.
Two entries exist because of Article 3(3): a safety component is one intended to fulfil a safety function and which is independently placed on the market. A model built into your own cell never is, so item 5 cannot reach it. Item 6 does, in respect only of those systems.
Annex II is indicative only, per Article 7(1): item 19 mirrors Part A item 5, but item 18, "Software ensuring safety functions", has no Part A twin and triggers nothing on its own. Recital 55 excludes software incapable of learning or evolving.
What Article 25 removes, and what it leaves you
Self-declaration is the default, and survives everywhere except Annex I Part A.
Article 25(2), the routes available for Annex I, Part A:
(a) EU type-examination (module B) set out in Annex VII, followed by
conformity to type based on internal production control (module C)
set out in Annex VIII;
(b) conformity based on full quality assurance (module H) set out in Annex IX;
(c) conformity based on unit verification (module G) set out in Annex X.
Article 25(4): where the category is not listed in Annex I, the manufacturer
"shall apply the internal production control procedure (module A)".
# Regulation (EU) 2023/1230, Article 25. OJ L 165.Read those side by side and the usual summary falls apart. Annex I Part A does not delete internal production control: route (a) is literally conformity to type based on internal production control, and you run module C on every unit. What Part A deletes is module A standalone. Article 25(3) keeps module A for Annex I Part B, but only where you design to harmonised standards or common specifications covering every relevant health and safety requirement.
The consequence lands on the product. Under Article 24(3) the CE marking is followed by the notified body's identification number, and field 8 of the Annex V Part A declaration names the body and its certificate. On cost the Regulation says one thing, Article 25(5): fees shall take account of the needs of small and medium sized enterprises.
The scope test: does your model ensure a safety function?
Everything turns on three words, "ensuring safety functions". Article 3(4): a safety function serves to fulfil a protective measure designed to eliminate, or if that is not possible reduce, a risk which, if it fails, could result in an increase of that risk. The test is causal: is the model's output what stops the hazard?
A learned policy choosing which part to pick, where a light curtain and a safety-rated controller perform the stop, influences motion without implementing protection. No authority has tested that reading and no harmonised standard covers it, so document the position in your risk assessment.
Recital 54 is the integrator's one clean exit: embedding a system whose safety component was already third-party assessed when placed independently on the market should not by itself require re-certification. Article 3(18)(b) folds into "manufacturer" anyone who puts products in scope into service for its own use, so a plant integrating its own cell is the manufacturer, and Article 18 passes that role to whoever makes a substantial modification. Article 3(16) defines that narrowly, so a retrain inside the approved type does not qualify.
Row five is won or lost on engineering evidence: what the camera sees, and what the controller does with it. What the rig owes as documentation is in where to put cameras for robot imitation learning; the pharmaceutical version is does Annex 22 ban LLMs in critical GMP applications.
| What the ML touches | Independently on the market? | Annex I entry | Article 25 route | Notified body number on the plate? |
|---|---|---|---|---|
| Output is the protective measure, sold separately | Yes | Part A item 5 | B+C, H or G | Yes, Article 24(3) |
| Same function, inside a machine you place on the market | No | Part A item 6, that system only | B+C, H or G | Yes |
| Embedded system already assessed independently | Prior assessment | Recital 54, no re-certification for embedding | Host machine's category | Per host |
| Rule-based safety software, no learning or evolution | Either | Recital 55 excludes it | Module A | No |
| Learned pick or inspection policy, outside the safety chain | Either | Not Part A, on your Article 3(4) reasoning | Module A | No |
| Self-evolving control, varying autonomy, no safety function | Either | Not Part A, but Annex III 1.2.1 binds | Module A | No |
Module B plus C, module H, module G: what each hands a third party
The three routes differ in what they expose and what expires.
Module B examines the Annex IV Part A documentation plus a production specimen, and Annex VII 4(a) lets it ignore points (h) and (l). Point (g), the results of tests, inspections and examinations, is where a learned policy is hardest to evidence, because acceptance is statistical and the trial count decides what it can claim. Annex VII 6.1 caps the certificate at five years, and 7.4 wants the renewal application at the earliest 12 months and at the latest 6 months before expiry.
Module H puts the quality system itself in front of the body, with an assessment visit to your premises and unexpected visits under Annex IX 4.4; module G verifies one unit at a time. Annex VII point 3, Annex IX 3.1(d) and Annex X 2(iii) each require a declaration that the application is not lodged elsewhere: no shopping round.
| Module | What the notified body sees | What a model change costs |
|---|---|---|
| B plus C, Annexes VII and VIII | Annex IV Part A, (h) and (l) not assessed, plus a production specimen | An Annex VII 7.2 addition per modification to the approved type |
| H, Annex IX | The quality system, plus Annex IV Part A (a) to (g), (i) to (k) and (m) to (o), so source code (m) and the sensor-fed description (n) are included | Annex IX 3.5 notice of any intended change |
| G, Annex X | One unit, plus Annex IV Part A (a) to (g) and quality system documentation | Priced per unit, not per type |
Annex III 1.2.1: the clauses that constrain the model, not the paperwork
This is the part that catches machines which never go near a notified body. The second block of Annex III 1.2.1 has a different trigger from Annex I Part A: control systems with self-evolving behaviour or logic designed to operate with varying levels of autonomy, with no "ensuring safety functions" qualifier. Escape Part A and you still owe its three points.
Annex III, 1.2.1, second block, chapeau:
Control systems of machinery or related products with fully or partially
self-evolving behaviour or logic that are designed to operate with varying
levels of autonomy shall be designed and constructed in such a way that:
(a) they shall not cause the machinery or related product to perform actions
beyond its defined task and movement space;
(b) [recording of data on the safety-related decision-making process ...] is
enabled and that such data is retained for one year after its collection;
(c) it shall be possible at all times to correct the machinery or related
product in order to maintain its inherent safety.
Annex III, 1.2.1(f): the tracing log of the data generated in relation to an
intervention and of the versions of safety software uploaded after placing on
the market "is enabled for five years after such upload".
# Regulation (EU) 2023/1230, Annex III. OJ L 165.Point (a) is a hard bound, not a reward shaping term, and it belongs below the policy: a monitored envelope in the safety controller, not a penalty in the loss function. Point (c) aims the same demand at the operator, so an autonomy mode that cannot be corrected fails on the text.
Annex III 1.2.1(d) is the clause misquoted as a ban on field learning. It allows no modifications to the settings or rules generated by the machinery or by operators, including during the learning phase, where such modifications could lead to hazardous situations, and repeats that qualifier in the "Particular attention" list. Adaptation is not prohibited; adaptation that can reach a hazardous state is. Annex III Part B, general principle 1 adds the other half: the risk assessment must cover hazards foreseeable as an intended evolution of that behaviour.
Three retention clocks, and why the evidence sits inside the plant
Three durations run in parallel and get collapsed into one. Six entries carry them, one of which is not a retention duty, and the first two are owed to a national authority on a reasoned request.
Every duty above is discharged by the manufacturer, and under Article 3(18)(b) that is the plant when it builds its own cell. None is dischargeable by a model vendor. Annex IV Part A point (n) makes the point concrete: for sensor-fed or autonomous machinery whose safety related operations are controlled by sensor data, the file holds a description of the system's capabilities and limitations and of the data, development, testing and validation processes used. If the weights and the pipeline sit in a supplier's tenancy, the manufacturer has contracted for evidence it cannot produce, the argument in data sovereignty versus residency.
Under module B the approved type is fixed, and Annex VII 7.2 requires an addition for every modification to it, so a vendor-controlled over-the-air pipeline can change the approved type without the manufacturer's knowledge, and Annex VII 7.7 then stops your placing on the market. Owning the update path is how you keep the certificate.
The layout that satisfies all three clocks is local: the paths are yours, the clauses are not.
/srv/cell-07/evidence/
├── safety-decisions/ # Annex III 1.2.1 second block (b)
│ └── <yyyy>/<mm>/<dd>/ # retention: 1 year from collection
├── tracing-log/ # Annex III 1.2.1(f)
│ ├── uploads/ # retention: 5 years from each upload
│ │ └── <software-version>/upload.json
│ └── interventions/
└── technical-file/ # Article 10(3)
├── annex-iv-part-a/ # retention: 10 years from placing
└── declaration-of-conformity/Write one record per upload under tracing-log/uploads/, in a schema you define, since the Regulation prescribes none: the version string the machine itself reports under Annex III 1.1.9, a hash of the artefact, the timestamp, who intervened, and the Annex VII 7.2 certificate addition that authorised the change. A version the machine reports but the log lacks is an unrecorded intervention. Keeping inference and weights inside the cell makes that check possible: the runtime side is running vLLM air-gapped, the cost side cloud versus on-premise AI.
| Clock | Clause | What is retained | Runs from |
|---|---|---|---|
| 1 year | Annex III 1.2.1 second block (b) | Data on the safety-related decision-making process | Collection |
| 5 years | Annex III 1.2.1(f) | Tracing log of interventions and of uploaded safety software versions | The upload |
| 5 years | Annex VII 6.1 | Validity of the type-examination certificate, not a retention duty | Issue or renewal |
| 10 years | Article 10(3) | Technical documentation and declaration; source code on request | Placing on the market |
| 10 years | Article 10(7)(c), 10(8) | Digital instructions and declaration, kept online | Placing on the market |
| 10 years | Article 19(2) | Who supplied you, and whom you supplied | The supply |
What the Digital Omnibus changed on 27 July 2026
Regulation (EU) 2026/1744, published on 24 July 2026, entered into force on the third day following. Recital 42 gives the reasoning: the specific nature of the machinery sector makes a sectoral approach appropriate.
AI Act Annex I Section A point 1, which was Directive 2006/42/EC, is deleted, and Regulation (EU) 2023/1230 is added as Section B point 21. The replacement Article 2(2) says that for high-risk AI systems under Article 6(1) related to Section B products, only Article 6(1), Article 60a and Articles 102 to 112 apply, with Articles 57 to 59 applying only so far as those requirements have been integrated into the sectoral act. Amended Article 113 dates the Article 6(1) obligations from 2 August 2028.
Article 3 of the Omnibus reaches exactly three articles of the machinery instrument: Article 8, Article 20 and Article 47 on delegated act powers. Article 8 brings AI Act Chapter III Section 2 and Articles 17, 19, 72 and 73 into Annex III by delegated act, applying by 2 August 2028; Article 20(10) covers the interval with AI Act harmonised standards under Articles 40 and 41.
Article 25, Annex I, Annex III and the application date are untouched. Nobody delayed the Machinery Regulation, and any 2026 plan routing an AI-enabled machine through AI Act Annex I Section A, or dating its obligations from 2 August 2027, describes law that no longer exists. The role question is does fine-tuning make you a provider; what the Omnibus did not defer is in Article 50 AI content marking.
The dates, the transition, and three clauses for the purchase contract
The corrigendum in OJ L 169 changed 14 numbered dates. These are the four that decide a plan.
The nearest is 20 October 2026, and designation has been legally possible since 20 January 2024, over two and a half years. The one real lever is Article 52: Member States shall not impede the making available of products placed on the market in conformity with Directive 2006/42/EC before 20 January 2027, and Article 52(2) keeps EC type-examination certificates issued under its Article 12 valid until expiry.
Do not plan around a standard arriving in time. The only machinery harmonised standards act in force, Commission Implementing Decision (EU) 2023/1586 consolidated to 15 May 2026, supports Directive 2006/42/EC and still cites EN ISO 10218-1:2011 for industrial robots. Searching it for machine learning, artificial intelligence, neural and self-evolving returns zero matches.
If you are buying rather than building, three clauses do most of the work.
(i) For each item, the supplier shall state which Annex I Part A entry of
Regulation (EU) 2023/1230 it claims or disclaims, and which Article 25
procedure was applied.
(ii) The EU declaration of conformity shall name, in the notified body field
of Annex V, Part A, the body and its identification number, the module
applied, and the reference and expiry date of the type-examination
certificate. Any addition to it under Annex VII 7.2 shall be notified to
the buyer before the corresponding software version reaches a unit.
(iii) The data required by Annex III 1.2.1(f) and by 1.2.1 second block point
(b) shall be written to storage controlled by the buyer, and the supplier
shall make the source code or programming logic of the safety related
software available on a reasoned request from a national authority, per
Article 10(3).Clause (iii) is the one to expect pushback on, and the pushback is informative: a supplier that cannot write your logs to your storage is one whose update pipeline you do not control.
Start this week with the risk assessment for one cell. Mark every function whose failure could increase a risk, then mark which of those a learned model touches. That intersection is your Annex I Part A scope question, and it takes an afternoon. Everything else here, and in the AI for business pillar, is downstream of it.
| Date | Provision | What happens |
|---|---|---|
| 20 January 2024 | Article 54(a), as corrected | Articles 26 to 42 apply, so notified bodies can be designated |
| 20 October 2026 | Article 54(b) and 50(2), as corrected | Article 50(1) applies, and Member States notify their penalty rules |
| 20 January 2027 | Article 54 second paragraph, as corrected | The Regulation applies, Directive 2006/42/EC is repealed, the Article 52 window closes |
| 2 August 2028 | Article 8, as amended | The AI-derived Annex III delegated acts apply by then |
FAQ
Quick answers to the questions this post tends to raise.
