High-risk § 3.2.1

As explained in Section III.2.2. above, the AI Act is based on a product safety-oriented legal framework. Accordingly, the classification of an AI system as a safety component in critical infrastructure must be assessed primarily in the light of the protective function performed by the AI system itself. In the context of critical infrastructure, that assessment must focus on whether the AI system directly protects the physical integrity of the infrastructure by reducing, preventing, controlling, or mitigating risks that, if materialised, would lead to physical harm to people or physical damage to property. In critical infrastructure, the functionality of the safety component is intrinsically linked to the preservation of the physical integrity of that infrastructure.

The requirement that a s afety component performs a s afety function excludes from high-risk classification AI systems which are merely supportive, informational , organisational or optimisation-oriented ( i.e. op timise critical infrastructure ’s performance and operation e.g. efficiency, cost) and which do not themselves perform such a direct protective function.

For example, an AI system intended to be used as a “mere conduit” function—referring to the passive conveyance of traffic or data without any control or decision-making over its content or destination—will not be classified as high-risk.

An AI -enabled traffic flow optimisation system based on real - time data collection . Such a system is a traffic data analytics platform enabling intelligent analysis for flow optimisation functions, but does not directly trigger changes in the traffic management that may impact the safety; it does not directly protect safety or physical integrity. These systems provide insights but do not directly protect physical integrity. Traffic systems can function without it. Such a function does not have a direct and immediate impact on the physical integrity of critical infrastructure. While it may affect the availability of services, it is not inherently responsible for triggering harmful outcomes.

More specifically, an AI system should be classified as a safety component in critical infrastructure only if it performs one of the following safety functions²⁶: a. the AI system is intended to be used as a component in critical infrastructure to monitor and detect situations which may directly lead to physical harm to natural persons or physical damage to property by directly protecting the physical integrity of the critical infrastructure (e.g. an AI system detecting abnormal behaviour in the critical infrastructure operation); b. the AI system is intended to be used as a component in the critical infrastructure to monitor and detect the need to schedule maintenance and inspections, which, if not conducted, may directly lead to a risk to the physical integrity of the critical infrastructure and to physical harm to natural persons or physical damage to property (e.g. an AI system detecting whether physical parts of the critical infrastructure are worn and may need replacement or maintenance); c. the AI system is intended to be used as a component in the critical infrastructure to prevent physical harm to natural persons or physical damage to property by directly protecting the physical integrity of the critical infrastructure (e.g. an AI system preventing critical infrastructure operations to start if abnormal behaviour is detected); d. the AI system is intended to be used as a component in the critical infrastructure which is intended to control or limit possible physical harm to people or physical damage to property by directly protecting the physical integrity of the critical infrastructure (e.g. AI system controlling specific behaviour or function of a critical infrastructure and adjusting its function accordingly); e. AI system is intended to be used as a component in the critical infrastructure to mitigate consequences of possible physical harm to natural persons or physical damage to property by directly protecting the physical integrity of the critical infrastructure (e.g. an AI system that triggers action, such as safe stop, if dangerous condition occurs); f. the AI system is intended to be used as a component in the critical infrastructure to control or supervise another system that performs a safety function (e.g. an AI system that supervises an operation of another system through sensors in real time and acts as a safety component that directly performs the safety function).

Components designed solely to prevent the following types of harm or damage should not be regarded as ‘safety components’: a) non-physical harm or non-physical and immaterial damages (such as moral harm, rights infringement); b) any damages caused by third parties, including those arising through the use of intermediation services.

In practice, when assessing whether an AI system qualifies as a safety component in critical infrastructure, one should take into consideration the availability of a redundant or backup system that directly protects the physical integrity of critical infrastructure and could prevent the harm or damage from materialising.

Recital 55 AI Act makes a clear distinction between a ‘safety component’ and a ‘cybersecurity component’. To fall within the use case listed in point 2 of Annex III, an AI system must not be used solely for cybersecurity purposes. Without a direct safety r ole, an AI system cannot be considered a safety component in a critical infrastructure and therefore cannot be classified as high-risk under Article 6(2) AI Act.

For an AI system to be classified as high-risk pursuant to point (2) of Annex III AI Act, it must be intended to be used in one of the sectors of critical infrastructure listed in that provision. Point (2) of Annex III lists as high-risk AI systems intended to be used as safety components in the management and operation of one of the following critical infrastructure areas: a) digital infrastructure, b) road traffic, or c) in the supply of water, gas, heating or electricity.

To delineate the exact scope of this use case, the AI Act refers in Article 3(62) AI Act to the definition of critical infrastructure in Directive (EU) 2022/2557 on the resilience of critical entities (the ‘Critical Entities Resilience’ or ‘CER’ Directive’)²⁷. Article 5(1) CER Directive empowers the Commission to establish a list of essential services in the sectors and subsectors covered by the Directive. On that basis, the Commission adopted Delegated Regulation (EU) 2023/2450 (the ‘CER Delegated Regulation’), which provides a list of essential services and links each of those services to the corresponding categories of entities in the Annex to the CER Directivethat may be identified as a critical entity under the CER Directive.

The reference in Article 3 (62) AI Act to the CER Directive should be understood in a way that an AI system is classified as a safety component in critical infrastructure (hence as high-risk) only if used by an entity identified as a critical entity by a Member State under the CER Directive.

It should also be noted that this interpretation does not require the disclosure of the status of an identified critical entity to third-party AI system provider. First, third-party providers may choose to develop and place on the market AI systems that comply with requirements for the high-risk AI systems under the AI Act and are intended to be used for high-risk purposes, irrespective of the status of the prospective deployer. Second, an identified critical entity acting as a deployer may require complian ce of the purchased AI system with the AI Act in procurement procedures, contractual documentation or technical specifications without disclosing that it has been identified as a critical entity under the CER Directive. In practice, entities may choose to procure AI systems meeting high-risk requirements for a variety of operational, cybersecurity, corporate governance or liability related reasons , irrespective of whether they have formally be e n identified as critical entities.

Additionally, in reality, procurement and supply arrangements concerning the European critical infrastructure operators already frequently involve confidentiality and security safeguards that limit the disclosure of sensitive operational information to third-parties.