AI Act: high-risk obligations now enforceable for energy and oil & gas

On August 2, 2026, the AI Act's high-risk obligations became enforceable for AI systems functioning as safety components in the management of critical infrastructure — electricity, gas, heating and essential energy services — according to a note published in March 2026 by law firm Baker Botts for energy sector executives. The rule spans the full value chain, from upstream operations through transmission, distribution and retail.

Explicitly named as high-risk: automated well control and blowout prevention systems, SCADA-integrated pipeline operation systems, refinery process control and safety monitoring, grid management and real-time dispatch tools, and automated fault detection and restoration systems. The one carve-out: AI systems used solely for cybersecurity purposes remain outside the high-risk scope.

The documentation burden is substantial: a risk management system spanning the full AI lifecycle, human oversight with intervention capability, data governance and bias controls, technical documentation and conformity assessment, and registration in the EU database before deployment. Failure to comply exposes providers to fines of up to €15 million or 3% of global annual turnover, whichever is higher.

For energy and oil & gas operators active in the EU, the informal grace period that existed while the deadline remained theoretical is now over. Baker Botts recommends a structured AI inventory across EU operations, documented classification against the regulatory framework, a vendor contract audit, and a database registration timeline — four workstreams that together represent a non-trivial fixed compliance cost, particularly for mid-sized operators.