The EU AI Act in logistics: what it asks of your warehouse

For most logistics companies the EU AI Act means one obligation that already applies (AI literacy for your people) and heavy rules only for AI that decides about people. A system that puts orders from email into your WMS sits in a different group from a system that decides who gets which pick round tomorrow. What follows explains the law and is not legal advice. Whether your system falls under a rule is for a lawyer who knows exactly what it does to decide.

What does the AI Act mean for logistics?

The AI Act, formally Regulation (EU) 2024/1689, is the European law that sets rules for developing and using AI, grouped by the risk to people. It entered into force on 1 August 2024 and applies in stages.

The law has two roles that matter to you. The provider develops an AI system, or has it developed, and puts it into service under its own name. The deployer uses an AI system under its own authority. If you buy software with AI in it, you are usually the deployer. If you have something built to measure and put it into service under your own name, the provider role may sit with you. Put that question to a lawyer before the build.

The risk groups

• Prohibited are uses with an unacceptable risk. That includes AI that infers people’s emotions at the workplace, except for medical or safety reasons. That ban has applied since 2 February 2025.
• High-risk is AI in the areas listed in Annex III of the law, including employment and workers’ management, and AI in products already covered by European product rules.
• Limited risk covers systems that talk to people or generate content. People have to know they are dealing with AI.
• For minimal risk the law sets no rules of its own, apart from AI literacy. According to the European Commission, most AI in the EU falls into that group.

Is AI for order intake or invoice checks high-risk?

No, as a rule it is not: order intake, freight invoices and agency invoices are not in the list of high-risk areas in Annex III. A system that reads an order from an email or PDF and stages it in your WMS decides nothing about a person. The same goes for a system that sets an invoice against an agreement. How such an order flow works is in orders from email into your WMS.

Checking staffing agency invoices comes closer to people, because you use clock data per person. The purpose is still the agency’s invoice. The system does not assess how someone works and does not allocate work. If you later use the same clock data to rank people, the purpose changes and you look again. More on that check is in checking agency invoices.

Even when a system is not high-risk, your people need to know enough about AI. If you use a chatbot that answers customer questions about shipments, the customer has to be able to tell they are talking to AI. And if a system processes personal data, the GDPR applies, separately from the AI Act. That is the subject of GDPR and AI in logistics.

When does AI in the warehouse become high-risk?

AI in the warehouse becomes high-risk once the system is intended for decisions about the people who work there. Annex III, point 4 lists under employment and workers’ management AI that allocates tasks based on individual behaviour or personal traits, and AI that monitors and evaluates the performance and behaviour of people in a work relationship. The same point covers recruitment and selection, promotion and ending a work relationship.

Task allocation

The tipping point is in the words individual behaviour and personal traits. A system that allocates pick rounds by zone, order volume and the truck’s departure time looks at the work. A system that allocates rounds by the measured speed of each picker looks at the person. The second one fits the wording of Annex III, unless the exception below applies.

Tracking performance

If you measure picks per hour per person and put AI on top that evaluates performance or behaviour per employee, you are in the same point 4. All the more so if the outcome weighs in on who gets an extension or who gets fewer shifts.

The exception in Article 6(3)

Not every system in an Annex III area is automatically high-risk. Under Article 6(3) it is not if it poses no significant risk, for example because it only performs a narrow procedural task or a preparatory task for an assessment by a person. If the system profiles people, it is always high-risk. A provider who considers the exception applies documents that assessment before the system goes into service. Whether that holds for your system is for a lawyer to decide, not the supplier.

What does the AI Act mean for your employees?

If you as an employer use a high-risk AI system at the workplace, you have to inform your employees and their representatives before the system goes into use. That is Article 26(7). The same article also asks you as a deployer to:

• use the system in line with the provider’s instructions for use;
• assign human oversight to people with the competence, training and authority for it;
• make sure the input data is relevant and representative enough, to the extent you control it;
• monitor how it works and inform the provider and the authority of a risk or a serious incident;
• keep the logs the system generates for at least six months, to the extent they are under your control.

Under Article 99, breaching Article 26 can lead to a fine of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.

The works council

If you have a works council, Dutch law adds a rule. A scheme for facilities suited to monitoring the attendance, behaviour or performance of your people needs the works council’s consent (article 27 of the Dutch Works Councils Act, first paragraph under l). An AI system that allocates tasks by behaviour can fall under that. The council has to consent before you take the decision, so while the choices are still open.

What does the AI literacy obligation involve?

AI literacy means you take measures to support the AI knowledge of the people who work with AI on your behalf. The obligation is in Article 4 and has applied since 2 February 2025 to providers and deployers. That includes a warehouse that only runs an order intake with AI. The law does not say which measures. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) gives a multi-year action plan as an example.

Until 27 July 2026, Article 4 asked you to ensure, to your best extent, a sufficient level. Since the amendment you guarantee no particular level per employee. You take into account the knowledge and experience of your people, the context and the people the system is used on.

The person working through the queue of doubtful orders knows why an order is there and that the system can get an item number wrong. The team lead knows what the system never does on its own. Write down who has had which explanation, so you can show later what you did.

When do which AI Act obligations apply?

The AI Act applies in stages, and the high-risk dates moved in 2026. On 27 July 2026 the AI Omnibus entered into force, a European regulation that amends the AI Act. The dates in Article 113 now are:

• 1 August 2024: the AI Act enters into force.
• 2 February 2025: the prohibited practices and the AI literacy obligation apply.
• 2 August 2025: the rules for general-purpose AI models and for supervision apply.
• 2 August 2026: the law applies in general, with the exceptions in this list. The transparency rules for chatbots, for example, fall under this.
• 2 December 2027: the rules for high-risk systems in Annex III apply, including AI in workers’ management.
• 2 August 2028: the rules for high-risk AI in products under Annex I apply.

The risk groups page of the Dutch Data Protection Authority still gives August 2026 for high-risk (as of October 2026). Before the amendment, August 2026 applied to Annex III and August 2027 to Annex I. The European Commission gives 2 December 2027 for Annex III.

How to list your own AI systems

1. Make a list of every system in your company that does something with AI, including the AI built into your WMS or planning software.
2. Note for each system what it decides or prepares, and about whom.
3. Systems that only handle orders, documents and invoices go into your AI literacy work.
4. Systems that allocate work or assess people go to a lawyer well before December 2027. If you have a works council, it comes in before the decision is taken.

What we build is mostly administration around the floor. How we choose the first process is in our way of working and in AI in the warehouse. If you are not sure which group a process falls into, we look in an introductory call at what the system would decide and about whom. Then you know what to put to a lawyer.