Compliance requirements for the manufacturing sector.
Sector Profile
| Attribute | Value |
|---|
| AI Act impact | MEDIUM |
| NIS2 category | Important (Annex II) or Out of scope |
| GDPR impact | MEDIUM |
| Other regulations | Machinery Directive, Product Safety |
AI Act for Manufacturing
Typical AI Systems
| System | Classification | Obligations |
|---|
| Predictive maintenance | LOW | Minimal |
| Quality control (visual) | LOW | Minimal |
| Production optimization | LOW | Minimal |
| Safety systems (AI) | MEDIUM | Documentation |
| Worker monitoring | MEDIUM | Transparency |
| Robotics (collaborative) | MEDIUM | Safety assessment |
Safety-critical AI
Embedded AI in Products
If your product contains AI:
- You must classify the AI component
- Documentation for downstream users
- Product safety implications
NIS2 for Manufacturing
Scope Determination
| Criterion | Essential | Important | Out of scope |
|---|
| Medical device manufacturing | Yes | | |
| Computer/electronics manufacturing | | Yes | |
| Machinery manufacturing | | Yes | |
| Chemical manufacturing | | Yes | |
| Food production | | Yes | |
| Other manufacturing | | | Yes (usually) |
Condition: >50 employees OR >EUR 10M revenue
OT Security (Operational Technology)
Specific Requirements
| Area | Requirement | Priority |
|---|
| IT/OT segmentation | Network separation | Critical |
| OT monitoring | IDS for industrial protocols | High |
| Legacy protection | Compensating controls | High |
| Backup/recovery | OT system backups | Critical |
| Vendor management | Remote access controls | High |
GDPR for Manufacturing
Typical Data
| Category | Examples | Legal basis |
|---|
| Employee data | Attendance, performance, safety | Contract + Legal |
| Supplier data | Contacts, contracts | Contract |
| Customer data | Orders, contacts | Contract |
| CCTV | Security cameras | Legitimate interest |
| Access logs | Facility entry | Legal + Legitimate |
Employee Monitoring
Machinery Directive + AI
AI in Machinery
If AI affects machine safety:
| Aspect | Requirement |
|---|
| Risk assessment | Machine + AI combined |
| CE marking | Entire system |
| Documentation | AI as component |
| Validation | AI behavior testing |
| Updates | Change management for AI updates |
CE Marking with AI
Checklist for Manufacturing
Short-term (Months 1-3)
Medium-term (Months 3-6)
Long-term (Months 6-12)
Typical Costs
| Item | Estimate |
|---|
| IT/OT security assessment | EUR 15-30k |
| Network segmentation | EUR 30-60k |
| OT monitoring | EUR 20-50k |
| GDPR employee data audit | EUR 10-20k |
| Product AI compliance | EUR 15-30k/product |
| Total Y1 | EUR 90-190k |
Resources