AI governance for manufacturing
Manufacturing AI governance is about three things: keeping AI out of safety functions, protecting IP and controlled data, and keeping quality records trustworthy.
EU AI Act
EU Machinery Regulation 2023/1230
IEC 62443 aligned OT security
ITAR and EAR export controls
ISO 9001 and IATF 16949 records
FDA 21 CFR Part 11 (regulated plants)
GDPR and UK GDPR
Self hosted model option
Copilots advise, they do not control. Generative AI reads production data through the same DMZ pattern we use for IIoT and never writes to PLCs or safety systems. The EU Machinery Regulation, which applies from 20 January 2027, brings safety components with self evolving behaviour into stricter conformity assessment, which is one more reason to keep language models out of safety functions.
Your IP stays inside approved boundaries. Drawings, recipes and process parameters go only to models under enterprise terms that exclude training on your data, in a region you approve. ITAR or EAR controlled technical data stays on self hosted open weight models inside your network.
Quality records stay human signed. AI drafts NCRs, CAPAs and work instructions, but an engineer reviews and signs each record, and the system keeps the draft, the edits and the sources. Where FDA 21 CFR Part 11 or EU GMP Annex 11 applies, audit trails and electronic signatures are in scope from the start.