The AI Act and Critical Energy/O&G Infrastructure: The Asymmetric Bet of Waiting for Clarity

On 2 August 2026, the European Commission began enforcing the AI Act through its AI Office and national authorities. On paper, the same date marks the entry into force of the heaviest obligations for Annex III high-risk AI systems. But a month and a half earlier, on 29 June 2026, the Digital Omnibus simplification package had already pushed part of that timeline to 2 December 2027 — a deferral the market broadly read as a sixteen-month holiday for high-risk AI in general.

That is not what the texts say. Official summaries and available legal analyses enumerate the categories covered by the deferral: recruitment and worker management, credit scoring, access to essential services, education, and law enforcement. Five of Annex III's eight categories. Critical infrastructure — Annex III, point 2, covering safety components in electricity, gas, heating and energy services — does not explicitly appear in these public enumerations, nor does biometrics. Asked directly on this point, the Commission's own documentation confirms a deferral 'for certain high-risk use cases' without detailing the full list of covered categories.

That ambiguity is not a legal footnote for the O&G and energy sector — it sits precisely where the sector's most sensitive AI systems are concentrated. Upstream: well control, pressure monitoring, blowout prevention. Midstream: SCADA-integrated systems, leak detection, integrity management. Downstream: refining process control and hazard detection. Power generation: grid management, dispatch tools, fault detection. Per Baker Botts' sector analysis, these use cases become high-risk through two routes: as a safety component of critical infrastructure (Annex III, point 2), or because they are embedded in products already subject to third-party conformity assessment — the Machinery Regulation, the Pressure Equipment Directive, the ATEX Directive (Annex I).

The resulting obligations are not cosmetic: a documented risk management system, human oversight mechanisms, data governance, logging, technical documentation, pre-deployment conformity assessment, and registration in the EU database. The associated penalty regime reaches €15 million or 3% of global annual turnover, whichever is higher — comparable to, and in some cases above, GDPR-level exposure.

This is where an economist's lens matters, because the intuitive read — 'the deferral exists, so use it' — inverts the correct calculation under genuine ambiguity. This is not a classically probabilistic risk: neither the Commission nor the law firms tracking the file have, at this stage, publicly confirmed whether critical infrastructure falls inside or outside the deferral's scope. Facing unprobabilized uncertainty of this kind, the rational move is not to bet on the more favorable outcome but to bound the maximum loss. The maximum loss from wrongly waiting is a €15 million or 3% of turnover penalty, potentially compounded by an operational safety risk — an incident on a non-compliant blowout-prevention system is not just a regulatory fine. The maximum gain from rightly waiting is only the deferral of an already-budgetable compliance spend. The asymmetry of outcomes, not the odds of either one, should govern the decision.

A distributive point follows, consistent with what Cardan-AI observes elsewhere in regulated sectors: operators already running heavy compliance regimes — upstream API standards, the ATEX Directive, SCADA integrity management, an HSE culture — carry a markedly lower marginal cost to extend existing governance to AI than a newcomer to the topic. For them, mapping safety-critical AI systems against Annex III point 2 is not a new undertaking; it is an extension of work they already do for other regimes.

The practical instruction is precise rather than cautiously wait-and-see. Map safety-critical AI systems across upstream, midstream, downstream and power generation without delay; obtain a formal, documented legal opinion on each system's status under the Digital Omnibus deferral rather than presuming an answer; and prioritize compliance work — risk management, human oversight, logging — on systems closest to physical safety, regardless of how the timeline debate resolves. This is the ground on which Cardan-AI works with energy and O&G operators: turning a regulatory grey zone into a documented, defensible roadmap — before an audit, not after one.