Which AI products face EU Act rules in Northern Ireland? The new test starts with the hardware

Two routes make an AI system closely integrated

The document gives a two-condition test. Condition A is met when the AI system is embedded or pre-installed in the physical product when it is placed on the market. Condition B is met when the AI is downloaded separately but the product was specifically designed to use that system alone for its intended functionality. Intended functionality is judged from the product's design, technical documentation, marketing and the functions customers were promised. Meeting either condition normally brings the system within the closely integrated category.

The examples make the boundary concrete. A smart speaker with a built-in assistant meets Condition A because the assistant ships with the device and forms part of what the buyer expects. A smartwatch can meet Condition B when its promoted health-monitoring feature depends on a manufacturer-supplied AI app and no alternative system performs that function. By contrast, a customer who later downloads an independent chatbot to a general-purpose laptop does not transform the laptop into an in-scope AI product. The fact that software and hardware come from the same company is not sufficient on its own; the system must form part of the product's intended function.[2]

Scope is limited, but the duties can still be substantial

For in-scope products, the applicable rule depends on risk and on the operator's role. The guidance says Article 5 prohibitions apply only when the prohibited system is closely integrated with a physical product placed on the market. It gives examples including a connected toy that manipulates children towards dangerous behaviour, an assistive robot that exploits an older person's vulnerability, and a camera that infers workers' emotions. The Northern Ireland route concerns placing products on the market; it does not extend every EU prohibition on use or deployment. Real-time biometric identification by law enforcement is therefore described as outside this route.

High-risk duties are most extensive where AI is a safety component of a regulated product that requires third-party conformity assessment. The listed sectors include toys, lifts, radio equipment, pressure equipment, personal protective equipment, gas appliances, medical devices and in-vitro diagnostic devices. To qualify, all the relevant conditions must be met: the system must satisfy the Act's AI definition, be a product or component covered by listed legislation, perform a safety function, and belong to a product that undergoes the required external assessment. AI used only for convenience, efficiency or non-safety assistance is not automatically a safety component.

Providers of high-risk systems can face risk-management, data-governance, technical-documentation, logging, transparency, human-oversight, accuracy, robustness and cyber-security requirements. The guidance also lists quality management, document retention, conformity assessment, CE marking, corrective action and incident reporting. These are not immediate duties for every connected product. The principal Annex I high-risk obligations are scheduled from 2 August 2028, and the document notes that proposed EU changes could alter how medical and in-vitro diagnostic devices are treated.[2]

Standalone models are not directly regulated here, yet suppliers may still matter

General-purpose AI model providers do not acquire the EU AI Act's direct model-provider duties merely because people in Northern Ireland can access their model online. The same is generally true for downloadable software, browser tools, apps and APIs. However, the position changes for the downstream business that integrates a model into a physical product. A manufacturer may need technical information about capabilities, limitations, accuracy, robustness, cyber security, testing and content marking from the upstream supplier to show that the finished product meets its own duties.

The guidance uses a useful contrast. A generative chatbot available on the web is outside the Windsor Framework route. If a laptop manufacturer installs that chatbot and sells the laptop with it, the system can become closely integrated. The chatbot is not automatically high-risk, but Article 50 transparency can require the product to tell people they are interacting with AI and to make synthetic content detectable. This creates a practical contracting question even where the model company itself is not directly regulated in Northern Ireland: can the product manufacturer obtain enough documentation and technical support to demonstrate compliance?[2]

What people and organisations should do before 10 November

A sensible first step is an inventory organised around products and market roles rather than a broad list of every AI tool used by staff. For each physical product sold or supplied in Northern Ireland, record whether AI is embedded, whether a separately downloaded system is essential to an advertised function, who developed it, who places the finished product on the market, and whether the AI performs a safety function. Marketing teams, engineers, procurement staff and legal or conformity specialists need the same answer; inconsistent descriptions can make the intended-purpose test harder to apply.

Firms should also separate immediate and later deadlines. The in-scope Article 5 prohibitions begin on 10 November 2026. The newly listed prohibitions on generating non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026. Transparency and high-risk requirements follow their own timetable through 2028. A business should not treat the earliest date as proof that every duty applies at once, but neither should it wait for 2028 to work out whether an existing product contains a prohibited practice. The guidance says an already marketed in-scope product with a prohibited AI system may need to be withdrawn or recalled and the feature disabled where possible.

Deployers have a much narrower role under this specific route, but not no role. A deployer of an in-scope high-risk system must monitor it according to instructions and report risks or serious incidents to the provider, distributor and relevant authority. The document gives possible reporting windows of two days for widespread infringement or critical-infrastructure disruption, ten days for a death and fifteen days otherwise. Those timeframes make incident ownership, logs and contact routes operational questions, not paperwork to design after a failure.[1][2]

Evidence check: what this guidance settles and what remains open

This report is based on a 32-page government document and its publication page, both dated 4 November 2026. The source provides the scope test, operator roles, timelines and worked examples. It does not measure how many products are affected, estimate compliance costs, identify a market-surveillance authority for every product category or show how courts will resolve a contested borderline case. The government explicitly says European Commission material remains the main technical and legal reference for interpreting the Act and its standards.

Confidence in product-level decisions will depend on forthcoming technical standards, Commission guidance, sectoral rules and enforcement practice. The assessment would change if the Joint Committee decision, EU amendments or UK guidance changes the product boundary or timetable. For now, the defensible conclusion is narrower than 'the EU AI Act applies in Northern Ireland': selected provisions apply to AI closely integrated with physical products, while ordinary standalone software and most use-only situations sit outside this specific Windsor Framework route. That is consequential current policy guidance, but it is not an urgent breaking incident and is therefore labelled Latest rather than Breaking.[1][2]