← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for energy and water utilities

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 2 covers AI used as a safety component in the management and operation of the supply of water, gas, heating or electricity. The general picture across sectors is on the critical infrastructure page; this one is about utility operations.

Examples that deserve a close look: chemical dosing recommendations in water treatment, gas network pressure management, district-heating flow control, grid balancing and automatic load shedding. Examples that usually do not qualify: demand forecasting that only feeds trading, asset-maintenance summaries, and meter-reading OCR, because their failure does not directly endanger people or property.

The customer side is different. Disconnection and debt-collection decisions by a utility are not listed in Annex III. A creditworthiness check before a supply contract may fall under point 5(b), and a social-tariff eligibility check done on behalf of a public authority may fall under point 5(a). Customer chatbots need Article 50 disclosure from 2 August 2026.

The logging duties that follow

• Art. 12 (providers): automatic recording of events, so that situations where the system may present a risk can be identified and post-market monitoring carried out.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers), the utility: use per instructions, competent human oversight in the control room (Art. 26(2)), monitoring and serious-incident reporting (Art. 26(5)), logs kept for at least six months (Art. 26(6)). Point 2 systems are registered at national level (Art. 49(5)) and are exempt from the Article 27 impact assessment.

A contamination event or a gas incident is investigated by several authorities at once. See serious incident reporting.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

The investigation will ask what the system measured, what it recommended, what was actuated and who approved it.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.result","data":{"name":"read_sensors","output":{"plant":"WTP-North","turbidity_ntu":3.8,"free_cl_mg_l":0.21}}}
{"seq":2,"type":"tool.result","data":{"name":"dosing_advisor","output":{"cl_setpoint_mg_l":0.45,"coagulant_change_pct":12}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"warn","hits":[{"rule":"setpoint-change-over-50pct-needs-operator"}]}}
{"seq":4,"type":"tool.call","data":{"name":"apply_setpoint","input":{"operator":"shift_b_04","cl_setpoint_mg_l":0.40}}}

The operator's adjusted setpoint is recorded next to the recommendation, in a chain that shows no step was dropped.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign every run that changes a setpoint, and keep the attestation with the plant logbook entry for the retention period your regulator expects.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the control decision was safe. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. WORM storage, vs. OpenTelemetry alone.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.