Legal uncertainty is one of the most common reasons why companies are hesitant to adopt artificial intelligence. In Germany, for instance, 62% of companies that do not use AI cite uncertainty regarding the legal consequences as an obstacle – more often than data protection concerns (60%) or costs (32%). This is according to the 2025 ICT Survey by the German Federal Statistical Office.
As a result, many forwarders and shippers are unsure of their applications’ risk level and the resulting obligations. This article outlines the deadlines, risk levels, and responsibilities related to land freight.
What does the EU AI Act cover, and to whom does it apply?
The EU AI Act – officially, Regulation (EU) 2024/1689 on harmonized rules on artificial intelligence – is the world’s first comprehensive AI law. The Act takes a risk-based approach, determining obligations not by the technology itself, but by the specific intended use of a system. For example, an algorithm that forecasts shipment volumes would be treated completely differently from the same algorithm used to presort job applications.
Two roles are crucial for logistics companies:
- Providers develop or market an AI system under their own name. Providers are subject to the full scope of obligations.
- Deployers operate an AI system under their own responsibility but did not develop it. Obligations are significantly less extensive and are governed by Article 26.
Forwarders, shippers, and logistics service providers are almost always deployers. They purchase transport management, telematics, and scheduling systems rather than developing them in-house. However, anyone who significantly modifies or resells a purchased system under their own name may legally be considered a provider.
The regulation follows the market location principle (lex loci solutionis). It also covers entities based outside the EU whose AI solutions are used within the EU, which is a relevant consideration for international transport networks.
Which deadlines apply under the Digital Omnibus?
The Digital Omnibus on AI – Regulation (EU) 2026/1744 – took effect on July 27, 2026. It altered the original timeline in several respects. Yet many online guides still refer to the old schedule. The current status is as follows:
| Date | What it applies to |
| February 2, 2025 | Prohibited AI practices (Article 5), AI literacy (Art. 4) |
| August 2, 2025 | Obligations for Providers of General-Purpose AI Models (GPAI) |
| August 2, 2026 | Transparency obligations according to Art. 50, start of regulatory enforcement |
| December 2, 2026 | Labeling requirements for systems placed on the market before August 2, 2026; two additional bans |
| December 2, 2027 | Requirements for stand-alone high-risk systems under Annex III |
| August 2, 2028 | Requirements for high-risk AI embedded in regulated products (Annex I) |
It is important to understand that this postponement exclusively affects the part of the AI Act that requires the most effort to implement. Prohibitions, GPAI rules, and transparency requirements remain unchanged. Anyone who interprets the postponement as a green light is confusing two very different categories of obligations.
What are the four risk levels defined by the AI Act?
The regulation classifies AI systems into four levels. Each level has a specific set of obligations.
| Risk level | Implication for use | Example from logistics |
| Unacceptable | prohibited | analysis of employees’ morale at the service center |
| High | strict rules | AI-assisted applicant screening for the vehicle fleet |
| Limited | transparency obligations | chatbot used in the shipment status service |
| Minimal | no particular obligations | forecast of shipping volume |
This classification is not a one-time administrative act. If the intended use of a system changes, its risk level may also be subject to change.
Which AI applications in logistics are considered high risk?
Two categories from Annex III are relevant to land freight.
Critical infrastructure (Annex III,2): This covers AI systems used as safety components in management and operation of critical infrastructure, including road traffic. However, the Digital Omnibus defines the term “safety component” more restrictively. Systems that merely assist humans and do not intervene in a safety-relevant manner are excluded now.
Employment and workers’ management (Annex III,4): This is the more important concern for forwarders. AI systems are considered high risk if they are involved in decisions regarding hiring, promotion, or termination; assign tasks based on individual behavior or personal characteristics; or monitor and evaluate employee performance and behavior.
This is precisely where the industry’s biggest unresolved question lies. Take, for example, AI-powered scheduling systems that assign routes based on individual driver performance. It has not yet been clarified by guidelines or court rulings whether these systems fall under Annex III,4. Those operating such systems should document and monitor their classification.
Which AI applications are not critical?
For most day-to-day freight forwarding applications, there is no cause for alarm. Article 6, paragraph 3 explicitly excludes systems from the high-risk level if they perform strictly defined and process-related tasks, enhance human preparatory work, or prepare decision-making patterns without replacing them.
In practice, this means for typical applications:
- Route and tour optimization: no high risk if there is no personalized performance evaluation
- Demand and volume forecast: procedural task unrelated to fundamental rights
- Predictive maintenance: technical condition assessment of vehicles and facilities
- Document recognition (OCR) for shipping documents: traditional automation without decision-making capabilities
- Shipment tracking and ETA calculation: forecast, not a personal assessment
However, these exceptions do not apply automatically. Anyone who invokes them must document their assessment, which is where the real effort lies.
What is expressly prohibited in logistics?
The restrictions under Article 5 have been in effect since February 2, 2025, and have been fully enforceable since August 2026. One aspect in particular is vital for land freight: the use of AI systems that infer employees’ emotions in the workplace based on biometric data is prohibited. This applies to both the driver’s cab and customer service.
The key factor here is who is having their emotions analyzed. If a speech analysis system in a service center analyzes employees’ voices to determine their stress levels, friendliness, or motivation, then the ban applies. But if the same system analyzes callers’ moods, it is not prohibited. According to Annex III, however, it is classified as a high-risk system and the affected individuals must be informed.
What is being analyzed is equally crucial. Emotion recognition relies on biometric data, such as voice, facial expressions or images of the face. Text-based analyses of emails or chat logs do not fall under this category. Furthermore, physical conditions are excluded. The regulation explicitly cites systems that identify fatigue based on blink rate or head posture as examples of systems that do not constitute emotion recognition. Nonetheless, these systems are not exempt from data protection and employee participation laws.
Anyone using telematics in the driver’s cab or speech analysis in customer service should answer three questions: What characteristics does the system evaluate? Whose data does it process? And how are the results used? The penalties for prohibited practices are the most severe in the entire regulation.
What obligations are already in place?
Virtually every logistics company that uses AI has two obligations, regardless of risk level or the postponement.
AI literacy (Article 4): Companies must ensure that their employees operating AI systems have sufficient knowledge of how these systems work, their limitations, and the risks involved. Although the Digital Omnibus has softened the wording of this requirement, the core principle remains: anyone who uses AI must empower their staff. In concrete terms, this means documented training instead of informal instruction for scheduling, customer service, and administration.
Transparency (Article 50): As of August 2, 2026, people must be able to recognize when they are interacting with an AI system. Chatbots that provide shipment status updates must identify themselves as such. AI-generated image, audio, or video content must include a machine-readable label. A transition period applies to systems already in use before the effective date until December 2, 2026. In July 2026, the European Commission published detailed guidelines on this matter.
Who monitors compliance, and what is the penalty for a violation?
In Germany, responsibilities have been clarified since summer 2026. On July 29, 2026, the Act on the Market Surveillance and Support of Innovation of Artificial Intelligence (KI-MIG) took effect. Since then, the Federal Network Agency (Bundesnetzagentur) has assumed the roles of central market surveillance authority, point of contact, and complaints office. The agency also operates an AI service desk and AI real-world labs where companies can test applications. In other member states, similar authorities have likewise been designated to carry out monitoring.
The range of fines is derived primarily from the EU regulation itself:
| Violation | Range |
| Prohibited practices (Art. 5) | up to €35 million or 7% of global annual revenue |
| Violations of high-risk and operator obligations | up to €15 million or 3% of global annual revenue |
| Providing false or incomplete information to government agencies | up to €7,5 million or 1% of global annual revenue |
In each case, the higher amount will apply.
What steps can logistics companies take to prepare?
The postponement of high-risk deadlines allows for structured preparation. These steps can be taken regardless of how the legal situation develops.
- Creating an AI inventory: This includes all systems in use, including features in standard software that no one perceives as AI.
- Clarifying the role: Determine for each system whether the company is an operator or, in exceptional cases, a provider.
- Classifying and documenting the risk level: For this purpose, the European Commission has provided an online compliance checker.
- Setting up training courses: Article 4 is already in effect; supporting evidence is crucial.
- Checking supplier contracts: What assurances do software providers offer regarding compliance? Who is responsible for which risks?
- Incorporating co-determination: In many member states including Germany, systems for monitoring performance or behavior are subject to co-determination.
- Factoring in data protection: Automated individual decision-making is also subject to Article 22 of the GDPR.
- Designating responsibility: This requires a person or role to maintain an overview and track deadlines.
The EU AI Act is not intended to stifle innovation; rather, it is meant to provide guidance. Those who use AI responsibly will gain not only efficiency, but also trust. Both are crucial to successfully shaping the logistics of the future.
Jasmin Schierding
SVP Accelerated Digitalization & IT DHL Freight
How do we handle this issue at DHL Freight?
At DHL Freight, we use data-driven systems throughout the entire transport chain, from capacity planning to shipment tracking to document processing. The vast majority of these applications are classified as “non-critical” under the EU AI Act. They assist people with procedural tasks rather than making decisions about or affecting people.
Our approach to this is not tied to any deadlines. Each application is reviewed for its intended use before going live. Human oversight remains the standard, not the exception. In cases where classification is unclear, we err on the side of caution.
For our customers, this is, above all, a matter of reliability. Those purchasing transportation services must be able to trust that the systems used are legally sound.
Conclusion: what should logistics companies do now?
The EU AI Act will not affect the logistics industry as severely as many fear, but it will impact the industry sooner than headlines about the deadline extension suggest. Route optimization, forecasting, and document recognition generally fall outside the high-risk category. However, the situation becomes critical when AI is used to evaluate people, such as in personnel selection, performance monitoring, and analyzing behavior in the driver’s cab.
Much of this already matters today; it is not some distant prospect. Bans are strict, transparency requirements are in effect, and mandatory training is required from early 2025. National authorities are also ready to act. The time gained until December 2027 exclusively applies to the most resource-intensive part, which is needed to ensure a thorough AI inventory.
A pragmatic approach consists of three steps: record, classify, document. Those who lay this foundation will be prepared for any future developments. Contact us if you’d like to learn how we plan and manage transportation.
This article provides an overview of the current status at the time of publication and does not constitute legal advice in individual cases.
FAQs on the EU AI Act in logistics
What is the EU AI Act?
The EU AI Act, or European Regulation (EU) 2024/1689, regulates artificial intelligence. The Act classifies AI systems into four levels based on their potential risk, assigning different obligations to each level. The intended use of a system, rather than the technology employed, is the determining factor.
When do the high-risk obligations under the EU AI Act take effect?
The requirements for standalone high-risk systems, as defined in Annex III, take effect on December 2, 2027. For AI embedded as a safety component in regulated products, the effective date is August 2, 2028. The Digital Omnibus Act of July 2026 postponed the previously earlier deadlines. Bans, transparency requirements, and the requirement for AI literacy remain in effect today and are not affected by this change.
Is AI-assisted tour planning a high-risk system?
Generally, no. Route and trip optimization fulfills a precisely defined, process-related task, so it falls under the exception in Article 6, Paragraph 3. The situation is different, though, if the system assigns trips based on individual performance data or evaluates drivers’ behavior. In that case, Annex III,4 may apply.
What must deployers of AI systems do?
Deployers must use the systems according to the provider’s instructions, ensure human oversight, and train their staff to work with AI. Additional monitoring and reporting requirements apply to high-risk systems. Regardless of the risk level, maintaining a documented inventory of all systems in use is recommended.
What is the difference between a provider and a deployer?
Providers develop and market an AI system under their own name and bear the full scope of obligations. Deployers use existing systems at their own risk and have significantly fewer obligations under Article 26. Forwarders and shippers are almost always deployers unless they substantially modify or resell a purchased system under their own name.
