EU AI Act and Product Data Software: Dates and Duties

Short answer

The EU AI Act, Regulation (EU) 2024/1689, sets risk-based rules for AI systems placed on or used in the EU market. Most AI features in PLM, PIM and product data software fall into minimal or limited risk, with AI literacy and transparency duties. The Digital Omnibus on AI moved high-risk deadlines to December 2027 and August 2028.

Key takeaways

Prohibitions and AI literacy have applied since 2 February 2025, and GPAI model obligations since 2 August 2025.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and postponed high-risk obligations.
Typical product data AI features are minimal or limited risk, but AI used as a safety component of a regulated product can be high-risk.
Buyers act as deployers and need an AI inventory, staff training, vendor documentation and human oversight.

The AI Act in brief

Regulation (EU) 2024/1689 entered into force on 1 August 2024. It classifies AI systems by risk: prohibited practices, high-risk systems, systems with transparency obligations, and minimal-risk systems with no specific duties. Separate rules apply to providers of general-purpose AI (GPAI) models, the large language models underlying most assistants in enterprise software.

The Act distinguishes roles. A provider develops an AI system and places it on the market, for example a PLM vendor shipping an AI assistant. A deployer uses the system under its own authority, for example a manufacturer using that assistant. A company that substantially modifies a system or changes its intended purpose can become a provider.

Application dates after the Digital Omnibus

In November 2025 the Commission proposed a Digital Omnibus on AI to simplify implementation. Parliament and Council reached political agreement on 6 May 2026, and Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026, entering into force on 27 July 2026.

Date	What applies
2 February 2025	Prohibited practices and AI literacy (Article 4)
2 August 2025	GPAI model obligations and governance
2 August 2026	General application, including Article 50 transparency
2 December 2026	Watermarking deadline for generative systems placed on the market before 2 August 2026; new prohibition on non-consensual intimate imagery
2 December 2027	High-risk systems listed in Annex III (previously 2 August 2026)
2 August 2028	High-risk AI in products under Annex I harmonisation law (previously 2 August 2027)

The Omnibus also softened the AI literacy duty: providers and deployers must now take measures that support staff AI literacy, with no defined competence level required. The GPAI Code of Practice, published on 10 July 2025 with chapters on transparency, copyright and safety, gives model providers a voluntary route to show compliance.

Where PLM, PIM and product data AI fits

Most AI features in product data software do not fall into the high-risk categories:

Document question answering, search and summaries in PLM: minimal risk.
Generated product descriptions and images: limited risk, with Article 50 marking obligations for the provider of the generating system.
Chat assistants interacting with people: limited risk, users must know they are interacting with AI unless obvious.
Attribute extraction and classification suggestions: minimal risk.

High-risk status becomes relevant in two situations. First, Annex III covers areas such as employment and access to essential services, so AI used for screening job applicants inside an HR module would be high-risk. Second, under Article 6(1), AI that is a safety component of a product covered by Annex I legislation, such as machinery or medical devices, and requires third-party conformity assessment, is high-risk. Manufacturers embedding AI in their products should treat this separately from AI in their engineering tools. The Omnibus also amended the Machinery Regulation (EU) 2023/1230, which matters for machine builders. Teams that track these obligations often manage them alongside other product rules in product compliance software.

What deployers of product data software should do

Build an inventory of AI features in use across PLM, PIM, DAM and compliance tools.
Classify each by risk and confirm the role (deployer or provider).
Run AI literacy measures for users, with emphasis on verifying outputs.
Request vendor documentation: model used, hosting location, data usage, logging, and Article 50 marking approach.
Keep human oversight for decisions with legal or safety effect, such as compliance screening.
Add AI clauses to contracts and to the PLM requirements and RFP.

Most of these steps take a few weeks when started early. The inventory is usually the hardest part, because AI features arrive through routine vendor updates and are often switched on by default.

How vendors are responding

Vendors including PTC, Siemens and Aras emphasise that their assistants respect existing access rights, cite sources and log interactions, which supports deployer oversight. Many rely on third-party GPAI models, so model provider commitments under the Code of Practice also matter. Ask vendors for an AI Act statement per feature and confirm how they will handle future guidance from the AI Office. Related governance practices for generative features are covered in generative AI for product content.

Frequently asked questions

Is an AI assistant in PLM software high-risk under the AI Act?

Usually not. Assistants that search, summarise or answer questions from engineering documents are generally minimal risk. They become high-risk only if used for an Annex III purpose, such as evaluating employees, or if they act as a safety component of a regulated product. The deployer still needs AI literacy measures and sensible human oversight.

When do high-risk AI obligations apply after the Digital Omnibus?

Regulation (EU) 2026/1744 moved the dates. Obligations for high-risk systems listed in Annex III apply from 2 December 2027. Obligations for AI in products covered by Annex I harmonisation legislation apply from 2 August 2028. Prohibitions, AI literacy and GPAI obligations already apply, and transparency obligations apply from 2 August 2026.

Does the AI Act apply to companies outside the EU?

Yes, when they place AI systems on the EU market or when the output of their AI systems is used in the EU. Non-EU software vendors selling to European manufacturers are therefore in scope as providers, and some must appoint an authorised representative in the EU. European customers using the software are deployers.

Sources

Reviewed 16 October 2026 by the PLM Vendors editorial team. Regulatory dates and vendor details change; check the sources for the latest position.