Transport AI is assessed by route. AI systems used as safety components in the management and operation of road traffic are listed in Annex III point 2, while AI systems that are safety components of vehicles, machinery and other regulated products follow the Annex I route, with conformity through the sector legislation. A traffic management system, a vehicle safety component and a logistics optimisation tool are therefore assessed differently, even where they use similar technology. The Annex III rules apply from 2 December 2027 and the Annex I rules from 2 August 2028, as amended by Regulation (EU) 2026/1744. This guide does not decide any transport system and does not give transport safety advice.
Which road traffic functions are listed?
Annex III point 2 lists AI systems intended to be used as safety components in the management and operation of road traffic. That covers systems that manage traffic flow, signal control, incident detection and response, and other operational functions where the system fulfils a safety function for road users. A system that only provides travel information, only forecasts congestion for planning, or only handles tolling administration, without a safety function in traffic management or operation, is assessed differently, and the distinction must be recorded from the system's function and failure modes. The record should describe the road network, the safety function, the management or operation role, and the consequence if the system fails, including the effect on road users, emergency access and other traffic. A system that begins as an information tool and later gains a control function has changed its function, and its classification must be reassessed before the change goes live.
How does the Annex I route work for vehicles and machinery?
AI systems that are safety components of vehicles, machinery and other products covered by the Union harmonisation legislation in Annex I follow the Annex I route, where third-party conformity assessment is required under that legislation. For vehicles, the relevant legislation includes the type approval framework, and for machinery, Regulation (EU) 2023/1230 on machinery is listed in Annex I, following the amendment made by Regulation (EU) 2026/1744. The Chapter III requirements are taken into account in the conformity assessment carried out under the sector legislation, by the body designated for that legislation. A manufacturer should therefore confirm the sector legislation, the conformity route and the body's designation, and should plan a single conformity file that addresses both the sector and the AI Act requirements. A vehicle or machinery supplier that treats the AI Act as a separate, later exercise will find gaps in risk management, data governance and oversight design that are harder to fix after the product design is frozen.
For the broader regulatory framework, see finance, insurance and critical infrastructure.
How should transport safety and AI Act work be coordinated?
Transport safety work and AI Act work should be coordinated in a single file per product or system version, carrying the safety function, the hazard analysis, the risk management, the data governance, the technical documentation, the testing and validation evidence, the oversight and fallback design, and the incident and post-market records. Transport safety regulation imposes its own requirements on design, testing, approval and operation, and the AI Act's requirements on accuracy, robustness, cybersecurity, human oversight and logging should be addressed within that safety framework, not as a parallel file that describes the system differently. Changes to the system, its operational design domain, its data or its safety function should trigger a joint review, since a change that is minor under one regime can be significant under the other. The file should be available to the market surveillance authority, the sector approval authority and the notified body where applicable, in the form each requires.
What oversight and fallback design is needed?
Transport systems with a safety function need oversight and fallback design that reflect the speed and consequence of failure. For a traffic management system, oversight means an operator who can understand the system's state, intervene, and fall back to a safe mode when the system fails or produces an unexpected output. For a vehicle safety component, oversight and fallback are designed into the product, including driver or operator warnings, degraded modes and the handover to human control where the system requires it. The design should address the time available for human intervention, the information the operator or driver receives, and the behaviour of the system when data are degraded or communication is lost. The deployer or operator should test the fallback in realistic conditions, record the results, and train the people who will operate the fallback. A fallback that exists in the design but has never been tested, or that cannot be exercised in the time available, is not an effective safeguard.
What evidence should a transport deployment keep?
The deployment file should record the system and version, the route and classification, the sector legislation and conformity route, the safety and hazard analysis, the testing and validation evidence for the operational design domain, the oversight and fallback design, the incident and post-market monitoring records, and the change and update history. Testing evidence should be specific to the road, vehicle or machinery context concerned, including the environment, the users, the traffic conditions and the failure modes tested. Monitoring should include performance in operation, near misses, overrides and incidents, fed back to the provider through post-market monitoring. A file that contains only laboratory test results, without deployment-specific evidence and fallback testing, does not support a decision to put a transport safety system into service. The file should be reviewed when the operating environment, the vehicle fleet or the traffic network changes, and the review should be recorded.
Continue with critical infrastructure safety components.
What does this guide not decide?
This guide does not decide whether any transport system is a safety component, is high-risk, or follows the Annex I or Annex III route, and it does not give transport safety or type approval advice. Those questions require the system's function, the sector legislation, the conformity requirements and the safety analysis to be applied to the specific product or system, with sector expertise and qualified advice. The guide also gives no dates for transport sector law, which must be verified in the sector instrument itself. Where a transport system with a safety function is to be deployed, confirm the route, conformity and sector safety position with the competent authorities before the system is put into service.
Frequently asked questions
Is a traffic information app high-risk?
It depends on its function. An app that only provides information is assessed differently from a system used as a safety component in managing or operating road traffic, which is listed in Annex III point 2. The function and failure modes must be tested.
Do vehicle AI systems follow the Annex I route?
Where an AI system is a safety component of a vehicle or is itself a product covered by Annex I legislation requiring third-party conformity assessment, the Annex I route applies, with conformity through the sector legislation and the Chapter III requirements taken into account.
What is a fallback design?
The designed behaviour of a system when it fails, degrades or produces an unexpected output, including warnings, degraded modes and handover to human control. It must be tested in realistic conditions and the results recorded.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗