Machinery with high-risk AI: the presumption of conformity is provisional

Anyone about to sign the EU declaration of conformity for a machine with a vision system that decides on its own when to stop the line has to answer a precise question: what standard is the conformity of that part resting on? If the answer is “the harmonised standards”, the technical file is resting on a gap today — for high-risk artificial intelligence, that row of the Official Journal does not exist yet. What does exist, since 27 July 2026, is an article that says what to do in the meantime. It is worth knowing exactly what it says, because it was written to be removed.

The paragraph that calls things by their name

Regulation (EU) 2023/1230 — the Machinery Regulation, in force from 20 January 2027 (not the 14th, as the uncorrected CELEX text still shows: a corrigendum published in OJ L 169 of 4 July 2023 moved the date, and the consolidated version marks it with correction indicators) — devotes its article 20 to a single mechanism, named already in the heading: «Presunzione di conformità dei prodotti rientranti nell’ambito di applicazione del presente regolamento» — presumption of conformity of products falling within the scope of this Regulation. Paragraph 1 states it for the ordinary case: whoever complies with a harmonised standard published in the Official Journal is deemed to comply with the Annex III requirements that standard covers. We have already seen this applied to the instruction manual, where only one of two competing standards, EN ISO 20607:2019, actually produces that effect.

Regulation (EU) 2026/1744 of 8 July 2026 — the Digital Omnibus on AI, in force since 27 July — adds a paragraph 10 to that same article 20, marked in the consolidated text with the amendment indicator ▼M2: «Fino a quando norme armonizzate o specifiche comuni non saranno menzionate o adottate a norma del presente articolo per quanto riguarda i sistemi di IA ad alto rischio, i sistemi di IA ad alto rischio che rientrano nell’ambito di applicazione del presente regolamento e che sono conformi alle pertinenti norme armonizzate menzionate o alle specifiche comuni adottate a norma, rispettivamente, degli articoli 40 e 41 del regolamento (UE) 2024/1689, sono considerati conformi ai requisiti essenziali di sicurezza e di tutela della salute di cui all’allegato III del presente regolamento per quanto riguarda i sistemi di IA ad alto rischio» — until harmonised standards or common specifications for high-risk AI exist under this article, a high-risk AI system meeting those adopted under Articles 40 and 41 of Regulation (EU) 2024/1689 is presumed to meet Annex III’s essential health and safety requirements for high-risk AI systems. The heading has the right word: it is a presumption of conformity, the same one article 20 already grants, applied for the first time to a foundation that does not belong to the Machinery Regulation at all — the AI Act’s own standards.

The Annex III line that is still missing

The reason a paragraph like this is needed sits one article back. We have already written about this: the same Regulation (EU) 2026/1744 requires the Commission to adopt, by a deadline that runs to 2 August 2028, delegated acts adding to Annex III dedicated requirements for high-risk AI systems under article 6(1) of the AI Act. Until that day, Annex III literally contains no line on AI: no requirement, no cross-reference. Article 20’s paragraph 10 is the bridge between 27 July 2026, when the delegation and the presumption entered into force together, and the moment — unknown today — when that line will actually be written.

A bridge resting on nothing, for now

There is a detail the Regulation itself does not spell out, and it is worth checking before relying on it: paragraph 10 points to the harmonised standards referenced or the common specifications adopted «a norma, rispettivamente, degli articoli 40 e 41» — under, respectively, Articles 40 and 41 — of the AI Act. For high-risk AI, none of those has been published in the Official Journal yet. That is what the Commission’s own page on AI Act standardisation says, last updated on 10 March 2026: “The first harmonised standards are expected to be published by CEN and CENELEC in 2026. After that, the Commission will start the review to assess whether the references to these standards can be published in the Official Journal of the European Union.” The technical work is under way at CEN-CENELEC’s committee JTC 21, but until that reference appears in the Official Journal, paragraph 10 has nothing to attach to: the presumption has existed in law since 27 July without, in practice, a single applicable case.

What to write in the file today

For anyone CE-marking a machine right now, this leaves exactly one usable route for the AI part: arguing conformity directly against Annex III’s general requirements — risk management, robustness, human oversight — without being able to invoke either a machinery-specific harmonised standard (it does not exist) or, for now, the bridge in article 20, paragraph 10 (it has nothing to lean on yet). That demonstration is direct and heavier, and it must be written knowing the footing will shift twice: once when the Commission publishes the first AI Act standard or common specification in the Official Journal, making paragraph 10 operative; again when the delegated act writes Annex III’s own dedicated line, replacing the bridge with a standard native to the Machinery Regulation. Anyone designing a machine today that will still be in production in 2028 is building a file that will have to hold up under three different foundations over time, not one.

How we solve it

This is a traceability problem over time, not just a drafting one. The control we build for this tracks, machine by machine and requirement by requirement, which of the three foundations currently supports the conformity of the AI part — general Annex III today, then the AI Act standard once it lands in the Official Journal, then the dedicated line once the delegated act writes it — and leaves the documentary trail to show a notified body without having to rebuild it by hand every time the footing shifts. That is the comply axis: a control that runs on the engineering department’s real documents, not an opinion that expires the moment it is given.

The other axis is decide. The same system holds together, in one operational model, the technical file, the inventory of machines falling under points 5 and 6 of Annex I to the Machinery Regulation, the monitoring of the Official Journal for AI Act standards, and the correspondence with the notified body — data that today sits in different offices and does not talk to itself. On that model, AI agents run the routine checks with a human operator in command: for manufacturing as much as for defence, government and healthcare, wherever the same pattern repeats — requirements that shift footing before they settle — every time a sector rule meets the AI Act. We deliver it two ways: on-premise, on self-contained machines that need no deep integration into the client’s network, or on our dedicated cloud, with the data centre in Italy and premises we staff ourselves — always with shared management, because the client should not already need someone in-house to run AI models.

Do you know which of the three foundations your machine’s AI file is currently resting on? A check with one of our engineers settles it in an afternoon, before the notified body asks.

Sources

What we do not know

We do not know when the Commission will adopt the delegated acts that will write Annex III’s line on AI: the Regulation sets only the final deadline, 2 August 2028, not an adoption date. We cannot say with certainty whether a first harmonised standard or common specification under Articles 40 or 41 of the AI Act has been published in the Official Journal since 10 March 2026, the last update of the Commission page we consulted: a targeted search found no trace of one, but we have not reviewed every Commission implementing decision issued since. And we do not know how a notified body will actually treat, on the merits, a file that argues AI conformity with neither a harmonised standard nor a common specification of any kind behind it: the Regulation does not say, and it has not happened often enough yet to have a precedent worth citing.