The AI Act and aviation: why the longest deadline hides the highest cost

The EU AI Act's implementation timeline carries two deadlines for so-called "high-risk" systems, exactly one year apart. The first, 2 August 2026, applies to standalone systems listed under Annex III: recruitment, credit scoring, biometrics, education. The second, 2 August 2027, applies to AI systems embedded as safety components in products already covered by EU sectoral legislation — Annex I: aviation, machinery, medical devices. Legal basis: Article 113(c) of the regulation, Chapter III, Sections 1 through 3.

The most common reading of this gap treats it as a courtesy: aviation and medtech, deemed critical sectors, supposedly get an extra year to catch their breath. That reading is incomplete. It ignores the nature of the compliance work the extra year is meant to accommodate — work that is structurally longer, not merely later.

Economist Oliver Williamson formalized, from the late 1970s onward, the concept of governance cost: beyond the direct cost of a transaction, any coordination arrangement between two distinct institutional structures carries its own cost, driven by the need to align specific investments and a priori incompatible procedures. A vendor of a standalone credit-scoring tool facing Annex III obligations deals with a simple governance problem: one administration (the AI notified body), one framework, one self-contained CE mark.

An airframer or equipment maker whose flight computer embeds an AI function faces a problem of a different order. The product is already certified by EASA under Regulation (EU) 2018/1139, with its own notified bodies, its own airworthiness documentation, its own type-certification calendar. The AI Act does not replace that regime — it layers on top of it. The technical documentation required under Article 11, the conformity assessment under Article 43, and the risk management obligations under Article 9 must all be produced in a way that is consistent with an aircraft certification file that is often already years into a multi-year development cycle.

This is exactly what Williamson calls a problem of specific assets and matched investments: the AI Act documentation only has value if it is built to interlock with the EASA documentation, and vice versa — neither can be produced in isolation without risking having to redo it. This interface cost between two certification regimes does not shrink simply by adding time to either regime taken separately; it grows with the number of institutions that must coordinate, which is precisely why the regulator chose to lengthen the calendar rather than relax the obligations.

For compliance and program leadership at aerospace and medtech companies, the practical implication is direct: the countdown that matters is not the one in the headlines (August 2026) but the Annex I one (August 2027), and the work to start now is not a simple compliance checklist but the design of a documentary interface between two administrations that, as of today, have not yet fully harmonized their respective requirements.

Cardan-AI works with aerospace and medtech compliance and program teams to map this regulatory interface before the calendar tightens.