"AI governance is not about controlling a model's performance — it is about deciding who is accountable for the model's outcomes." — Gartner, 2025 AI Governance Survey
On August 2, 2026, the EU AI Act's high-risk AI system provisions begin to apply. According to McKinsey's State of AI 2025, 88% of all companies use AI in at least one business function, but only 1% say their AI strategy has reached maturity. In other words, most manufacturers are heading into the new regulation in a state of "AI in operation, but no governance."
This article looks at what the EU AI Act actually requires on the factory floor, which systems are classified as high-risk, and how global standards such as ISO 42001 and the NIST AI RMF simplify the compliance workload. Finally, it outlines how the KOPENS PlantPulse platform turns these governance requirements into something that can be built in from day one.
Governance is not a separate phase — it must be embedded in every layer of AI operations.
1. The EU AI Act Timeline — What Starts When
The prohibited-AI provisions and AI literacy obligations have been in force since February 2, 2025. On August 2 of the same year, the governance infrastructure (notified bodies, the conformity assessment framework) and the general-purpose AI model obligations took effect. The critical inflection point is August 2, 2026 — the high-risk AI system rules listed in Annex III begin to apply in earnest, and enforcement starts at both national and EU level simultaneously.
Law firms Kennedys Law and Holland & Knight are tracking one important development. On November 19, 2025, the European Commission announced the Digital Omnibus on AI, and the provisional agreement includes postponing the high-risk compliance deadline to December 2, 2027. Final adoption, however, is still pending. Manufacturers should build their preparation schedules around both scenarios.
Fines for non-compliance run up to EUR 35 million or 7% of global revenue — higher than under GDPR.
2. Why Manufacturing AI Falls into the "High-Risk" Category
Annex III enumerates a range of high-risk use cases, but the provision that most often catches manufacturing is the "safety component" clause. If an AI system makes decisions directly tied to product safety, it is automatically classified as high-risk.
Typical manufacturing scenarios include:
- Predictive maintenance AI for safety equipment such as power generation assets and pressure vessels
- Vision inspection AI that judges product defects and decides whether products ship
- Collision-avoidance and worker-safety algorithms for industrial robots
- Real-time control models for chemical and reaction processes
- Safety interlocks that assess worker exposure in cyber-physical systems
Regulatory consultancy Unorma concludes that "a predictive maintenance system targeting power plant equipment falls clearly within the scope of Annex III." Even a model that looks like a simple operational-efficiency tool becomes subject to compliance the moment it is integrated into operating decisions.
3. The Seven Governance Obligations — From Documentation to Human Oversight
Articles 16-17 of the EU AI Act impose the following obligations on providers of high-risk AI:
- Technical documentation — detailed documents covering data sources, training methods, validation results, and known limitations. This is the foundation of conformity assessment.
- Quality management system (QMS) — similar to ISO 9001 but AI-specific. It spans design, development, testing, risk management, data handling, and post-market monitoring.
- Data governance — managing the representativeness, bias, and integrity of training, validation, and test data.
- Logging — automatic, traceable recording of system behavior and decisions. Post-incident investigation must be possible.
- Human oversight — interfaces and procedures that allow humans to intervene in automated decisions.
- Accuracy, robustness, and cybersecurity — quantitative evidence of appropriate levels.
- CE marking and EU database registration — conformity assessment and official registration before market placement.
Logging and human oversight in particular directly reshape the architecture of operational systems. An AI that does not capture its operational data is effectively non-compliant.
Logging, audit trails, and data lineage are the most expensive debts in AI governance. The later you build them, the more they cost.
4. ISO 42001 and the NIST AI RMF — The Role of Standard Frameworks
ISO/IEC 42001:2023 is the first international standard for an AI Management System (AIMS). It comprises 38 controls and serves as the de facto implementation guide for the QMS the EU AI Act requires. Both KPMG and BSI assess that "ISO 42001 certification can serve as direct evidence of EU AI Act compliance."
NIST AI RMF 1.0 is a US standard but is being widely adopted across global industry. It is organized around four functions — Govern, Map, Measure, Manage — and focuses on risk management across the full lifecycle. For a manufacturer, adopting the two standards together delivers:
- A single governance framework that addresses the EU and US markets at the same time
- Consistent documentation formats for conformity assessment
- The same expectations applied across the entire supply chain (component suppliers, OT vendors, cloud providers)
- Integrated operation of internal audits and external certification
According to Gartner's 2025 survey of roughly 1,800 executives, 55% of organizations have an AI board or governance committee, but only 28% have the CEO directly accountable for governance. A committee without standards adoption has clear limits.
5. How to Build Governance into the MLOps Pipeline
When governance ends up as after-the-fact audit work, costs explode. Mature organizations embed governance gates into the MLOps pipeline itself.
- Data gate — automatically run provenance, licensing, bias metrics, and PII scans when training data enters. Datasets that fail cannot be used for training.
- Model gate — measure accuracy, adversarial robustness, and fairness metrics at the validation stage. Auto-generate model cards.
- Deployment gate — depending on the risk level, mandate human approval, canary deployment, and a human-oversight interface.
- Operations gate — log input, output, confidence, and operator ID for every inference call. Automatic alerts and rollback when drift is detected.
- Retirement gate — apply data retention, user notification, and retraining policies when a model is retired.
Schellman's ISO 42001 guide stresses that "when fairness monitoring is built into the MLOps pipeline, governance becomes daily operations rather than a one-off check." This matters even more in manufacturing — the moment a model touches running equipment, a governance gap becomes a safety incident.
Case Study — External Sources
Nexastack's 2025 report analyzes the problems a global automotive parts manufacturer faced while operating some 30 predictive maintenance models. The models themselves worked well, but there was no way to track "which model is used in which decisions," "when it was last retrained," or "how often operators overrode the model's recommendations." An EU AI Act pre-assessment classified 18 of the 30 models as high-risk, and 11 of those were not ready for conformity assessment.
After switching to an MLOps pipeline with built-in governance gates, the company cut average compliance-preparation time per model from six weeks to nine days. The key was "automatic capture during operation," not "collection after the fact."
How PlantPulse Answers
KOPENS PlantPulse started out as an Industrial DataOps platform, but the biggest axis of its 2025-2026 roadmap is "AI operations with governance built in." PlantPulse collects field data through some 200 industrial protocols and maps the operational context of AI models onto an ISA-95 asset model. Every AI inference call is automatically logged across six axes — asset, time, operator, input, output, and confidence — which satisfies the requirements of EU AI Act Article 12 as written.
PlantPulse also converts the 38 controls of ISO 42001 into operational metrics and exposes them on dashboards. Model cards, data lineage, drift alerts, and human-oversight interfaces are provided as standard platform features, so manufacturers can auto-generate conformity assessment documentation without running a separate GRC (Governance, Risk, Compliance) tool.
Closing
The EU AI Act is not just an issue for companies entering the European market. Most Korean manufacturers doing business with global OEMs will indirectly take on the same obligations through supply-chain governance requirements. The time remaining until August 2026 (or December 2027) should be framed not as "how do we make our existing AI compliant" but as "how do we embed governance into our operating architecture."
The most expensive technical debt is governance debt. Reconstructing data lineage backwards after a model is already in production costs tens of times more than capturing it from the start. The questions to ask right now are simple — how many of our AI models fall under Annex III high-risk, and can we prove every inference call those models made over the past year? (Related sources: EU Commission "Navigating the AI Act" 2026; Kennedys Law "EU AI Act Implementation Timeline" 2026; Holland & Knight "U.S. Companies Face EU AI Act's August 2026 Compliance Deadline" 2026; McKinsey "State of AI 2025"; Gartner "AI Governance Survey 2025"; Unorma "Annex III High-Risk AI Examples"; Schellman "AI Governance & ISO 42001 FAQs 2026"; Nexastack "AI Governance in Manufacturing"; NIST "AI RMF 1.0".)
© KOPENS — Industrial DataOps & PlantPulse Platform