Halconia.
Let’s talk
Back to blog

How to tell whether an industrial process is ready to use AI

An industrial process is ready to use AI when its data, risks, human oversight, quality, cybersecurity and technical documentation have sufficient evidence…

Andrés Naves ·

How to tell whether an industrial process is ready to use AI

An industrial process is ready to use AI when its data, risks, human oversight, quality, cybersecurity and technical documentation have sufficient evidence before commissioning. The AESIA guides serve as a reference checklist for reviewing those areas, although they are not binding. The guides are not binding and neither replace nor develop the applicable regulation.

What do I check in an industrial process before deciding it is ready to use AI?

The AESIA guides are not binding and do not replace or develop the regulation, but they offer practical recommendations aligned with regulatory requirements. The AESIA guides are not binding, neither replace nor develop the applicable regulation, and are structured in three blocks.

The first area is data. You must verify that the data used in training, validation and testing are appropriate, relevant, sufficiently representative, and meet the quality and completeness requirements set by Article 10 of the AI Regulation.

The second is the risk management system, with measures to identify, analyse, evaluate and mitigate the possible risks of an AI system. Risks of the system must be identified, analysed, evaluated and mitigated, as described in the AESIA guide on the risk management system, linked to Article 9.

The third is human oversight. People must be able to make autonomous decisions with full knowledge of the facts, and human oversight must hold a central place in the operation of the system, according to Article 14.

The fourth is quality management, which requires organisational and technical measures under Article 17. The fifth is cybersecurity: the AESIA guide indicates that it must be integrated into a broader cybersecurity scheme, in line with Article 15.

Finally, technical documentation must be drawn up before placing on the market or putting into service, kept up to date, and demonstrate compliance with the requirements. An area without evidence is a gap worth closing before starting.

The AESIA guides are aimed at those who develop or deploy high-risk AI systems, not at any AI use on the plant floor.

AI Act requirements that high-risk systems must meet

Check

Reference

What it covers

Data governance

AI Act Article 10

Training, validation and testing data that are appropriate, relevant, sufficiently representative, and of quality and completeness

Risk management

AI Act Article 9

Measures to identify, analyse, evaluate and mitigate the possible risks of the AI system

Human oversight

AI Act Article 14

People must be able to make decisions with full knowledge of the facts regarding the AI system

Quality management

AI Act Article 17

Organisational and technical measures to meet quality management requirements

Cybersecurity

AI Act Article 15

AI-specific cybersecurity measures, integrated into a broader cybersecurity scheme

What should I have planned for once the system is already running in the process?

Once running, the key point is that the system does not degrade its performance. The AESIA guide on accuracy sets out measures to prevent the system from losing its performance and accuracy specifications after commissioning.

For high-risk systems, the Regulation requires a post-market monitoring plan: activities that providers and deployers carry out to collect and review experience gained and to decide whether action is needed. The AESIA guide on serious incident reporting describes the procedure of Article 73 and the measures to apply it.

The source discusses removing the prescription of a harmonised post-market monitoring plan to give companies greater flexibility. One of the changes mentioned consists of removing the prescription of a harmonised post-market monitoring plan, giving companies greater flexibility. That removal of the prescription of a harmonised post-market monitoring plan appears in the passage as a measure under consideration, together with reducing the registration burden for AI systems used in high-risk areas for tasks not considered high-risk.

Who do these requirements apply to and from when do they apply?

Compliance with the AI Act is directed at the operators subject to it, in particular providers and deployers of AI systems, as well as providers of general-purpose AI models. The AI Office, the European Data Protection Supervisor and the competent national authorities are responsible for supervising and enforcing the rules.

Application is staggered. From 2 August 2026, the provisions on prohibited AI practices, transparency requirements for certain AI systems, and the rules applicable to general-purpose AI models will apply.

The rules for high-risk AI systems in Annex III will apply from 2 December 2027, and those for systems integrated into regulated products from 2 August 2028, so readiness should be adjusted to those dates depending on the type of system.

Application dates of the AI Act

  • 2 de agosto de 2026 Transparency, prohibited practices and general-purpose models — Implementing powers and provisions applicable from this date.
  • 2 de diciembre de 2027 High-risk, Annex III — Application date of the rules for high-risk AI systems in Annex III.
  • 2 de agosto de 2028 High-risk, integrated into regulated products — Application date of the rules for high-risk systems integrated into regulated products.

Sources