AI Risk Classification Report

Analysis of the AI system against the four risk categories of the regulation, with focus on Annex III for safety components in machinery. Mapping of the declared intended purpose and the reasonably foreseeable misuse — because the AI Act assesses risk on actual use cases, not just declared ones. Verification of the interaction between AI Act classification and classification under the Machinery Regulation. Analysis of the applicable regime for any general-purpose models integrated into the system.

Output: classification memo with a defensible position before the market surveillance authority, map of applicable obligations, and compliance roadmap prioritised for the next 18 months.

CE Marking & Integrated Technical Documentation

Management of technical documentation for multi-regime systems: Machinery Regulation, AI Act, Cyber Resilience Act. Building integrated documentation that satisfies all frameworks without duplication — same documentary evidence, distinct structures where required. Defining the compliance path: self-declaration vs. involvement of a Notified Body for high-risk categories.

A critical issue in building technical documentation is the gap between the obligation to control and the actual power to control. The AI Act imposes human oversight requirements (Art. 14), but an AI system may be designed in a way that makes such oversight difficult or impossible to exercise in practice. A machine processing hundreds of signals per second in industrial environments cannot be "supervised" by a human operator in the traditional sense. The technical documentation must address this explicitly: define what type of supervision is technically exercisable on that specific system, under what operational conditions, and at what frequency. Failing to document this analysis risks not satisfying the regulatory requirement.

FRIA — Fundamental Rights Impact Assessment

Mandatory fundamental rights impact assessment for high-risk AI systems. For industrial machinery: analysis of the rights of persons who interact with or are affected by the machine (operators, workers, third parties in the operational environment). Analysis of systematic biases in training data for safety-critical functions. Document designed to be updated with every significant change to the system.

Product Liability & AI Civil Liability

Documentation strategy to demonstrate due diligence in the design and monitoring of the AI system. Contractual structure along the supply chain: indemnity clauses between the machine manufacturer, AI component supplier, and distributor. Analysis of insurance coverage against the new liability regime for products with software and AI components.

Two structural dynamics make civil liability in AI systems more complex than in traditional products. The first is the many hands problem: the development chain involves dozens of actors — no one has full control, no one has visibility over every component. In the event of an incident, this fragmentation creates a liability vacuum that the contractual structure must address explicitly. The second is the risk of the moral crumple zone: in a system where an operator is nominally responsible for oversight but in practice cannot exercise real control over the AI system's output, that operator absorbs the legal burden in case of an incident. The technical documentation must precisely define the effective perimeter of human control exercisable in the real operational context.

Training Data & Model IP

Analysis of training dataset composition: origin, licences, presence of copyright-protected or trade-secret data. Review of open-source licences for base models and usage restrictions for commercial and high-risk applications. Protection of proprietary model intellectual property: trade secret, IP assignment in contracts with employees and contractors. Compliance with training data transparency obligations for general-purpose models.

CRA Readiness Assessment

Analysis of the product against the Cyber Resilience Act requirements in preparation for the December 2027 deadline: attack surface mapping, security-by-design architecture review, vulnerability disclosure policy analysis, patch release procedure verification. For robot manufacturers: the CRA overlaps with the Machinery Regulation's post-market surveillance obligations and the AI Act's monitoring requirements — an integrated system is more efficient than three separate processes.

Post-Market Monitoring & Incident Reporting

Design of the in-production monitoring system required by the AI Act: performance KPIs, alert thresholds for performance degradation, model update procedure that does not trigger a new conformity assessment. Incident reporting: serious malfunctions must be notified to the national market surveillance authority. Integration with the Machinery Regulation's post-market surveillance obligations and the CRA's vulnerability disclosure requirements.