AI in Water Treatment Plants 2027 – High-Risk Classification, Security Testing, and Manual Backup Operations | Word/PDF/Excel

Is a water utility considering introducing AI for safety-critical water monitoring, alarms, or operational support? This specialist package helps Swedish waterworks, water and wastewater authorities, municipal water and wastewater companies, and system integrators document high-risk classification under the EU AI Act, supplier evidence, synthetic safety testing, manual fallback, and decisions to stop or investigate an introduction.

The EU AI Act, Annex III, point 2, covers AI systems intended as safety components in the management and operation of, among other things, water supply. Not all AI in a waterworks is therefore automatically high-risk. An AI-based report generator or standalone forecast for preventive maintenance may fall outside this specific use.

What Is Included in the Document Package?

Excel – Nine Tabs, Eight Tested Control Indicators

System, Classification, Data Protection, Supplier, Safety Test, Manual Fallback, Implementation Decision, Overview, Read Me. The compilation shows registered systems, unclear high-risk classifications, missing supplier evidence, open GDPR and LIVSFS issues, failed synthetic tests, failed manual fallback, and blocked decisions. Status selections and formulas have been checked with separate synthetic cases; the final customer version is cleared of test cases.

Important: Zero risk flags may mean that no data has been registered. It is never a passed risk assessment, CE certification, or a decision to put AI into operation. Only enter de-identified system/evidence IDs in Excel – never OT network maps, logins, PLC codes, security vulnerabilities, or personal data.

Legal Basis – What Actually Applies?

AI Act – Annex III, point 2, and Article 6. The high-risk assessment refers to AI systems that have a safety function in, among other things, water supply. It must be linked to the actual intended use and assessed based on Article 6. The fact that a supplier markets AI as “smart water analysis” does not in itself imply a specific legal classification.

Application of High-Risk Requirements. According to the EU Commission's current timeline, the special rules for Annex III high-risk AI should begin to apply on December 2, 2027. Existing rules on data protection, water quality, and operational safety are not affected by the postponed AI timeline.

Important Exception in Article 27. Article 27.1 expressly exempts Annex III, point 2 high-risk AI from the special obligation to perform FRIA under that article. This does not mean that all impact assessments, operational safety tests, or GDPR requirements are waived.

Article 26 and Human Oversight. When high-risk rules apply, requirements are placed on deployers, including use according to instructions, competent human oversight, monitoring, risk management, and relevant logs. Read Article 26. A named operator without a real possibility of intervening is not sufficient grounds.

Swedish Food Agency Rules Already Apply. LIVSFS 2022:12 regulates drinking water within its scope. Certain new testing requirements, including for raw water and several chemical parameters, came into effect on January 1, 2026. AI forecasts do not replace statutory water control. The Swedish Food Agency has also referred additional changes proposed from 2027; a consultation proposal is not in itself a binding requirement.

GDPR and Cybersecurity. If the system processes personal data, a GDPR assessment must be carried out separately; a DPIA under Article 35 may become relevant. For the water utility's OT and information security, applicable Swedish cybersecurity and continuity regulations must also be assessed in a separate track. This template does not have an automatic approval effect.

How the Package Is Used

1. Inventory the AI system and document the exact function, as well as whether it affects any safety-critical part of the water supply.
2. Assess Article 6 and Annex III, point 2. Also document why standard administrative AI may not be covered.
3. Request the supplier's actual usage instructions, test documentation, and model/version evidence.
4. Assess current drinking water regulations, GDPR/DPIA, and other obligations separately.
5. Perform only competently approved synthetic tests in an isolated environment without connection to the facility's actual control functions.
6. Verify independent safety barriers and human fallback procedures through the utility's experts.
7. Make a STOP, INVESTIGATE, or conditional isolated test decision and register only status/evidence references in Excel.

Frequently Asked Questions

Is all AI used by a waterworks high-risk?

No. Annex III, point 2 applies to special safety components in critical infrastructure. Purely administrative support is not automatically such a safety component.

Must the waterworks perform FRIA under AI Act Article 27?

Article 27.1 expressly exempts Annex III, point 2 from the FRIA obligation under that article. Other risk and impact assessments may still be required.

When do the AI Act's high-risk rules apply?

For relevant standalone AI systems in Annex III, the special high-risk provisions begin to apply on December 2, 2027. Other rules may already be applicable.

Does the package contain ready-made pressure, pump, or dosing settings?

No. The package is intended only for documentation, risk classification, and synthetic checks. It contains no operational control instructions or OT programs.

Can Excel be used to approve an AI system?

No. Excel shows registered statuses and open risks, not technical or legal compliance.

Can the PDF files be filled out digitally?

The PDF files are searchable and printable but are not interactive forms. Word and Excel are editable.

Have the documents been reviewed by an external lawyer or certified water utility expert?

No. The source control is AI-assisted. Actual operational safety, water quality, and implementation approval require special expert review.

Related Specialist Templates

AI Governance – Basic AI Act Work covers general governance. NIS2 – Supplier Cyber Certificates and Deviations applies to supplier security. This product is specifically delimited to AI as a safety component in water supply and its special high-risk rules.

Version, Legal Sources, and Limitation of Liability

Version 1.0 · November 12, 2026 · Sweden/EU. The documents' source control is AI-assisted against Regulation (EU) 2024/1689 in consolidated form, the EU AI Act Service Desk, the EU Commission, GDPR, and the Swedish Food Agency's LIVSFS 2022:12. No external legal review, regulatory assessment, actual water utility/OT testing, safety certification, or production deployment has been performed. The templates should be supplemented with competent water utility, process, OT, legal, and data protection expertise. The product is created as an unpublished DRAFT without customer file linkage in Digital Products.