Deploying AI in CNC Manufacturing in Line with the EU AI Act

Update of 15 October 2026. When I wrote this text, the Digital Omnibus had been adopted but not yet published. It is now binding law: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, in force since 27 July 2026. Two passages below are corrected: the AI literacy duty in Article 4 has read differently since 27 July 2026, and the Council adopted the Omnibus on 29 June 2026, not on 13 May. Text and questions below give the state of 15 October 2026.

Many manufacturers are uneasy: does the EU AI Act turn every use of AI on the shop floor into a high-risk case? The honest answer is no. The vast majority of typical manufacturing AI is not high-risk. But there are clearly delimited exceptions, and you should know them before you invest.

The four risk tiers, briefly explained

• Prohibited: manipulative or certain surveillance practices (in practice largely irrelevant to manufacturing)
• High-risk: only in the areas set out in Annex III, or as a safety component of products under Annex I
• Limited risk: transparency obligations, for example for chatbots or AI-generated content (Art. 50)
• Minimal risk: the default case, e.g. cutting-parameter optimisation, nesting, predictive maintenance

What in CNC machining is usually NOT high-risk

Cutting-parameter and CAM optimisation, tool-life and failure prediction (predictive maintenance), capacity planning, automatic costing from STEP files and the visual quality inspection of components: these applications do not appear in the high-risk catalogue of Annex III. The general obligations do apply, however, first and foremost the AI literacy of your workforce (Art. 4).

Where it can become high-risk after all

• AI as a safety component of a machine: if the AI controls or monitors a safety-relevant function (such as a protective function), it can become a high-risk system via the EU Machinery Regulation as an Annex I product.
• AI in HR: pre-screening of candidates, aptitude assessment or performance monitoring of employees fall expressly under Annex III, so they are high-risk, even in a small workshop.
• Biometric recognition at the factory gate or for time recording can be strictly regulated or outright impermissible, depending on how it is set up.

The machine that inspects a part is rarely the problem. The AI that pre-sorts job candidates is more likely to be, and many firms overlook it.

Obligations that apply almost always

Regardless of the risk class, the AI literacy obligation (Art. 4) has applied since 2 February 2025. Since 27 July 2026 it reads: providers and deployers take measures to support the development of AI literacy among their staff; they do not have to guarantee a specific level for any individual. If you use chatbots or AI-generated text and images, the transparency obligations under Art. 50 apply on top: users must be able to recognise that they are interacting with AI, or that content is AI-generated. These transparency obligations apply from 2 August 2026; for systems already on the market before that date, marking of their content has a grace period until 2 December 2026.

How to proceed

• Inventory your AI applications, including bought-in software features
• Determine the risk class for each application (in particular: machine safety and HR-related AI)
• Set up and document AI literacy training
• Add transparency notices wherever Art. 50 applies
• Cast the whole thing into a lean ISO 42001 system, as evidence both internally and externally