For operators, vendors and public or private infrastructure managers using AI where failures can affect safety and access to essential services.
Annex III point 2 focuses on AI systems intended for safety components or management of specific critical infrastructure. The draft guidelines cover critical digital infrastructure, road traffic, water, gas, heating and electricity.
The Commission splits this area into critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity.
Is the AI intended to manage, prioritise or secure infrastructure in a way that can affect safety or availability?
Summary by Praxikon of the draft of 19 May 2026. The draft is not binding; the final guidelines have not yet been published.
Only AI acting as a safety component falls under point 2: a component that fulfils a safety function or whose failure endangers the health or safety of persons or property (Article 3(14)). The draft splits the area into critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity, and reads it alongside the NIS2 Directive and the CER Directive: the AI Act applies in addition, not instead. No FRIA applies to point 2 (Article 27(1)).
Falling outside depends on the intended purpose and on the Article 6(3) exception, which never applies to profiling.
The overview of all eight areas and the dates is on Annex III of the AI Act; the Article 6(3) filter is explained in the Commission guidelines on high-risk AI.
AI for management, monitoring, security or prioritisation within critical digital infrastructure.
AI systems supporting traffic flows, priorities or safety decisions in road traffic.
AI in supply, monitoring, balancing or disruption detection for utilities.
Map the infrastructure function, AI output and impact on safety or availability.
Short answers for classification, evidence and next steps under Annex III.
The Commission splits this area into critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity. The practical starting question is: Is the AI intended to manage, prioritise or secure infrastructure in a way that can affect safety or availability?
This domain page expands the main routes: Critical digital infrastructure, Road traffic and traffic management and Water, gas, heating and electricity. For each system, check the intended purpose, the output and the impact on access, rights or safety.
Document the intended purpose, use context, relevant Annex III route, Article 6(3) assessment, any profiling, provider/deployer roles and the required safeguards.