EU AI Act Overview: Implications for Automotive Product Development | Part 2
The second article in our EU AI Act series builds on Part 1: Risk Levels and Structure, which introduces the Act’s risk-based approach and provides a practical guide to navigating and understanding the regulation. Part 2 explores the implications for automotive product development, with a focus on AI used in safety-relevant vehicle functions. It examines how automotive safety standards can support regulatory compliance, introduces regulatory sandboxes, and maps key AI Act requirements to existing automotive engineering processes.
Looking to go deeper? Explore our ISO/IEC 42001 and EU AI Act Responsible AI Training, which helps organizations build practical AI governance, risk-management, and AI management system capabilities. Need more than training? Explore our Responsible AI consulting services supporting AI governance, ISO/IEC 42001 implementation, and preparation for EU AI Act obligations.
Introduction
Article 6(1) of the EU AI Act classifies an AI system as high-risk when it is a product covered by EU harmonisation legislation, or serves as a safety component of such a product, and the applicable legislation requires third-party conformity assessment.
Other high-risk AI systems are listed in Annex III. For automotive applications, the only additional relevant category is paragraph 2: “safety components in the management and operation of […] road traffic,” which would include systems such as fleet management.
AI systems used in automotive products, such as ADAS (Advanced Driver Assistance Systems) and ADS (Automated Driving Systems), fall into the high-risk AI system category under Article 6(1). For such systems, the AI Act introduces requirements that can significantly affect product development, including risk management, data governance, technical documentation, verification and validation, and post-market monitoring.
The information provided in this blog reflects our best understanding of the EU AI Act, based on its legal text and relevant information from official sources. While this blog focuses on automotive applications, many of the principles discussed also apply to other high-risk AI systems, including applications in robotics.
We begin by examining automotive safety standards and addressing a key question: Does compliance with automotive safety standards automatically ensure compliance with the EU AI Act?
Next, we explore regulatory sandboxes, which enable AI developers to work with regulators during product development rather than waiting until the product is complete to seek regulatory guidance.
After a brief overview of the sections in Chapter III, which addresses high-risk AI systems, we turn to the central topic of this part: mapping the requirements of the EU AI Act to relevant automotive standards.
Automotive Safety Standards and EU AI Act Compliance: How Do They Align?
Does compliance with state-of-the-art automotive safety standards such as ISO 26262, ISO 21448, and ISO/PAS 8800 automatically mean compliance with the EU AI Act?
No. However, compliance with these standards can provide important evidence and established processes that can be leveraged to demonstrate compliance with relevant AI Act requirements.
The EU AI Act can be viewed primarily as establishing regulatory obligations at the organizational level, while the automotive standards provide established engineering processes for product development. In practice, this allows an organization to address AI Act requirements through its existing product-development processes.
In simplified terms, an organization might express this approach as follows:
Our organization meets the applicable EU AI Act requirements. For our automotive products, we address these requirements through internal development processes based on state-of-the-art automotive standards.
Regulatory Sandboxes
Regulatory sandboxes help providers develop compliance with the EU AI Act by enabling them to work alongside regulators during AI product development, rather than developing the product independently and facing regulatory scrutiny only after deployment. This approach is addressed in Article 57 of the EU AI Act, which establishes AI regulatory sandboxes as controlled environments for the development, training, testing, and validation of AI systems under regulatory guidance and supervision.
Chapter III structure
Chapter III of the EU AI act addresses High-risk AI system which is applicable for automotive.
At the time of writing, this is the version of the EU AI Act incorporating the digital Omnibus changes:
Consolidated AI Act – current version, 27 July 2026 — This version incorporates the amendments introduced by the Digital Omnibus. EUR-Lex identifies it as 02024R1689-20260727 and lists Regulation (EU) 2026/1744 as amendment M1.
The following table provides an overview of Chapter III, High-Risk AI Systems.
| Chapter III | High-Risk AI Systems | Major regulatory subject |
|---|---|---|
| Section 1 | Classification of AI systems as high-risk | Determines which AI systems fall into the high-risk regime |
| Section 2 | Requirements for high-risk AI systems | Defines the technical/system requirements |
| Section 3 | Obligations of providers and deployers of high-risk AI systems and other parties | Defines who must do what |
| Section 4 | Notifying authorities and notified bodies | Establishes the conformity-assessment infrastructure |
| Section 5 | Standards, conformity assessment, certificates, registration | Deals with demonstrating compliance and market access |
EU AI Act areas and Automotive Safety Standards – A mapping
The following table correlates typical automotive standards to the EU AI act as well as provides a guide for the automotive professional on the most relevant section in the EU AI Act
| Area | EU AI Act references | Existing automotive processes / standards |
|---|---|---|
| AI risk management | Article 9 – Risk management system | This refers to risk management systems such as ISO 42001, i.e. risk reduction at organizational level. Product risk reduction through ISO 26262, ISO 21448 (SOTIF), and ISO/PAS 8800 is a way to support the risk reduction at organization level. Article 9(5): “The risk management measures […] shall be such that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems is judged to be acceptable.” |
| AI data governance | Article 10 – Data and data governance | Dataset management and ML development processes, closely related to ISO/PAS 8800, clause 11 Data-related considerations |
| AI verification & validation | Aligned regarding dataset aspects. Related: Articles 9, 15, 17, 60 | This topic aligns with ISO/PAS 8800, Clause 12, “Verification and validation of the AI system.” The EU AI Act addresses the use of suitable datasets for AI training, validation, and testing, which is also an important element of the verification and validation activities described in ISO/PAS 8800. However, there are notable differences in terminology and application as well. For example, terms such as test case and safety requirements are not used as concepts in the EU AI Act. The following provisions are relevant: Article 17(1)(d): Requires the quality management system to document examination, testing, and validation procedures to be carried out before, during, and after development. Article 17(1)(b): Requires procedures to be in place for the design, design control and design verification Article 9: Requires high-risk AI systems to be subject to a risk management system, including relevant testing activities. Article 15(1): Requires high-risk AI systems to be designed and developed to achieve appropriate levels of accuracy, robustness, and cybersecurity. Article 60: Addresses testing of high-risk AI systems in real-world conditions under the conditions specified in the Article. |
| AI technical documentation | Article 11 (including Annex IV), 18 | This maps well to the technical documentation and safety-case evidence generated through automotive development in general. Article 11 specifies documentation to demonstrate the compliance of the high-risk AI system with the EU AI Act with reference to Annex IV containing an explicit list. |
| AI change management | Articles 17, 43 | Automotive change and configuration management, including ISO 9001 / IATF 16949 and ISO 26262 supporting processes Article 17 explicitly requires procedures for management of modifications, design control, development, quality control and assurance. Article 43 establishes the applicable conformity-assessment procedures. |
| In Operation | Article 12(1) | Automatic event logging over the lifetime of the high-risk AI system is required |
Conclusion
Compliance with state-of-the-art automotive standards can provide significant benefits when addressing the requirements of the EU AI Act. Established processes for risk management, data governance, verification and validation, technical documentation, and change management can be leveraged to support regulatory compliance and reduce the need to establish entirely separate processes.
However, compliance with automotive safety standards does not automatically establish compliance with the EU AI Act. The Act defines its own regulatory obligations, which must be assessed against the specific AI system, its risk classification, and the applicable conformity-assessment requirements.
Although there is no direct, one-to-one mapping between the requirements of the EU AI Act and standards such as ISO 26262, ISO 21448, and ISO/PAS 8800, these standards provide a valuable basis for demonstrating how an automotive organization addresses relevant regulatory requirements through its established product-development processes.
The practical approach is therefore to map applicable EU AI Act obligations to existing organizational processes, automotive engineering practices, and documented evidence, identify any gaps, and address additional requirements where necessary. This enables organizations to build on their existing expertise in automotive safety while establishing a structured approach to EU AI Act compliance.
Have insights or questions? Send us an email at info@sres.ai or leave a comment below. We welcome thoughtful discussion from our technical community.
Interested in learning more about our approach? Explore why teams choose SRES training and how we support organizations with Automotive consulting and Physical AI consulting.
