If there's one sector where the AI Act's anti-alarmist message holds up cleanly, it's logistics. The operations that define a transport operator — route optimisation, warehouse management, picking robotics, supply-chain visibility, ETA calculation, demand forecasting — are, in the Regulation's terms, low risk: none of it falls under any high-risk annex. Anyone telling a logistics company that "your AI is one of the dangerous ones" for optimising routes is inflating the risk to sell the fix. That said, the sector has two real, precise boundaries, and both run through the same place: the driver.
The core: order, not alarm
Day-to-day systems — routing and order assignment, WMS, forecasting, visibility towers, ETA — ask for what everyone else has to provide: appearing in the inventory, AI literacy measures for the people who use them (Article 4), and documentary verification of suppliers who, in this sector, are frequently based outside the EU and provide product documentation in English written for operations, not for the AI Act. Housekeeping work, not high risk. This far, the sector can breathe easy.
Boundary 1: when telematics stops being safety and becomes workforce management
Fleet telematics — systems like Geotab or Samsara that analyse braking, acceleration, speed and generate dangerous-driving alerts — is, in its operational safety use, not a high-risk system: it processes the driver's personal data (location, driving behaviour), which triggers the GDPR as normal, but it doesn't decide about the person.
The boundary is crossed when that same data feeds employment decisions: evaluating the driver's performance, dynamically assigning routes or loads with an effect on their conditions, or penalising them. That use is a candidate for Annex III high risk: it fits the scenario in point 4(b), which covers systems intended "to monitor and evaluate the performance and behaviour of persons in such relationships" — the same cross-cutting employment gateway we already saw in staff selection. The system is the same; what changes is the purpose, and with it the analysis. And in parallel, without waiting for the AI Act: the data protection impact assessment of Article 35 GDPR, required in particular where a systematic and extensive evaluation of personal aspects, based on automated processing, grounds decisions with legal or similarly significant effects; the duty to inform before geolocating, under Article 90 of Spain's LOPDGDD; the works council's right to know the parameters of the algorithms that affect working conditions (Article 64.4(d) of Spain's Workers' Statute); and whatever additional safeguards the applicable collective agreement may set (Article 91 LOPDGDD).
The practical consequence is a governance decision, not a technology one: decide and write down what the telematics is used for. "Safety and optimisation: yes; individual driver evaluation: not without a prior re-assessment" is a policy line that keeps the system in its calm classification — and one you need to be able to show.
Boundary 2: the fatigue camera, with surgical precision
The sector's most delicate case deserves precision, because it gets told wrong in both directions. Driver fatigue and distraction detection systems (DMS) — the camera that infers drowsiness or loss of attention — are not a prohibited practice. The Article 5(1)(f) prohibition covers AI systems to infer the emotions of a natural person in the workplace, except for medical or safety reasons, and recital 18 makes clear that emotion recognition does not include "physical states, such as pain or fatigue", with an express example: "systems used in detecting the state of fatigue of professional pilots or drivers for the purpose of preventing accidents". Fatigue is not an emotion; anyone telling you your DMS is unlawful is getting the article wrong.
Now the matching nuance: how the DMS is classified depends on who puts it in the cab and what for, and the two cases do not mix.
If the camera is built into the vehicle and covered by its type-approval, the vehicle is a product under the acts listed in Annex I, Section B — Regulations (EU) 2018/858 and 2019/2144 are on that list — and Article 2(2), as amended by Regulation (EU) 2026/1744, provides that for high-risk AI systems under Article 6(1) related to those products "only Article 6(1), Article 60a and Articles 102 to 112 shall apply", and Articles 57, 58 and 59 only in so far as the high-risk requirements have been integrated in that legislation. Article 26 never reaches it, and neither does the Annex I date set by Regulation (EU) 2026/1744, 2 August 2028: that is the date for the Chapter III obligations, which do not apply to Section B.
If it is telematics fitted by the fleet operator, outside the type-approval, there is no Annex I product to frame it, and what counts is the purpose. If its data are used to evaluate the driver's behaviour, the system is a candidate for Annex III through point 4(b), which describes AI systems intended "to make decisions affecting terms of work-related relationships" or "to monitor and evaluate the performance and behaviour of persons in such relationships": boundary 1 with a different camera. As long as it only warns of fatigue to prevent accidents, that scenario does not arise. If it fits, the timeline is Annex III's. Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
Precision, timeline and the correct file: all three depend on getting the route right.
The sector's plan, in short
- A complete inventory, covering the sector's typical spread (routes, WMS, telematics, HR) under a single register.
- A telematics use policy that fixes the purpose and draws the employment boundary in writing.
- Rigorous HR: the ATS for drivers and warehouse staff is the same cross-cutting high risk as ever — with the data protection impact assessment under Article 35 GDPR where the processing is likely to result in a high risk, without waiting for any date, and with the FRIA under Article 27, for those it reaches, from 2 December 2027.
- A well-classified DMS, by route: built into the vehicle and covered by its type-approval, Annex I, Section B, no Article 26; fitted by the operator and used to evaluate the driver, a candidate for Annex III, point 4 — and in no case prohibited for detecting fatigue.
- An informed workforce: geolocation and cameras explained before they are used, as Articles 89 and 90 LOPDGDD require, with the collective agreement on the table — avoiding the labour dispute is worth more than dodging any fine.
Minimal risk profile with two clear boundaries: few sector descriptions under the AI Act are this manageable. The condition, as always, is not to manage it by ear.
Content in accordance with Articles 2, 4, 5, 26 and 27 and Annexes I and III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; Article 35 of Regulation (EU) 2016/679; Articles 89 to 91 of Spain's Organic Law 3/2018; and Article 64.4(d) of Spain's Workers' Statute.
Mentions of products are descriptive of the market and do not imply any commercial relationship. This article is for informational purposes only and does not constitute legal advice.