Compliance
AI Act / EU AI Regulation: AI Compliance in Vending
Term from the vending glossary
The EU AI Regulation (Regulation (EU) 2024/1689, in force since 1 August 2024) classifies AI systems according to risk levels and establishes corresponding compliance obligations. For vending operators, it determines whether a device with camera-based AI, biometrics, or dynamic pricing logic requires a conformity assessment, technical documentation, and EU database registration.
Which vending machine AI falls under the regulation?
Classification follows four risk levels. For day-to-day vending operations, three are practically relevant:
Prohibited from 2 February 2025 (Art. 5): real-time biometric identification of individuals in public spaces outside a narrow law enforcement framework. Camera modules that categorise passersby by demographics without consent fall into this grey area, regardless of whether the machine uses the results for dynamic pricing or product recommendations.
High-risk class (Annex III, Category 1): AI-assisted biometrics for age verification is classified as high-risk. Obligations include: conformity assessment before deployment, technical documentation under Art. 11, registration in the EU AI database under Art. 49, and ongoing incident reporting. The advisory effort for initial conformity documentation is not publicly quantified; legal specialists cite project scopes of several tens of thousands of euros, depending on system scope.
Minimal risk: standard recommendation algorithms, inventory optimisation without personal data processing, and basic telemetry analysis are not subject to specific obligations under the AI Act.
Timeline
| Date | Effect |
|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) take effect |
| 2 August 2025 | GPAI model obligations (Art. 51–56) |
| 2 August 2026 | High-risk systems Annex III fully applicable |
| 2 August 2027 | Entire regulation including Annex I |
Distinction from GDPR
The AI Act and GDPR overlap in personal data-processing camera AI without being congruent. GDPR regulates data protection and lawfulness of processing. The AI Act additionally assesses system risk and requires independent technical documentation. Operators with camera AI must comply with both regulatory frameworks in parallel.
Penalties
Violations of prohibited practices: up to EUR 35 million or 7 per cent of global annual turnover (Art. 99(3)). Failures in high-risk systems: up to EUR 15 million or 3 per cent of annual turnover (Art. 99(4)).