If there's one sector where the AI Act's anti-alarmist message holds up cleanly, it's logistics. The operations that define a transport operator — route optimisation, warehouse management, picking robotics, supply-chain visibility, ETA calculation, demand forecasting — are, in the Regulation's terms, low risk: none of it falls under any high-risk annex. Anyone telling a logistics company that "your AI is one of the dangerous ones" for optimising routes is inflating the risk to sell the fix. That said, the sector has two real, precise boundaries, and both run through the same place: the driver.
The core: order, not alarm
Day-to-day systems — routing and order assignment, WMS, forecasting, visibility towers, ETA — ask for what everyone else has to provide: appearing in the inventory, staff trained in their use (Article 4, already in force), and documentary verification of suppliers who, in this sector, are frequently based outside the EU and provide product documentation in English written for operations, not for the AI Act. Housekeeping work, not high risk. This far, the sector can breathe easy.
Boundary 1: when telematics stops being safety and becomes workforce management
Fleet telematics — systems like Geotab or Samsara that analyse braking, acceleration, speed and generate dangerous-driving alerts — is, in its operational safety use, a limited-risk system: it processes the driver's personal data (location, driving behaviour), which triggers the GDPR as normal, but it doesn't decide about the person.
The boundary is crossed when that same data feeds employment decisions: evaluating the driver's performance, dynamically assigning routes or loads with an effect on their conditions, or penalising them. That use falls under Annex III high risk through the worker management route — the same cross-cutting employment gateway we already saw in staff selection. The system is the same; the purpose reclassifies it. And in parallel, already fully in force today: the data protection impact assessment when there's driver profiling with significant effects, and Spanish employment transparency rules — the transport sector's collective bargaining agreement also contains specific clauses on geolocation that no serious deployment can ignore.
The practical consequence is a governance decision, not a technology one: decide and write down what the telematics is used for. "Safety and optimisation: yes; individual driver evaluation: not without a prior re-assessment" is a policy line that keeps the system in its calm classification — and one you need to be able to show.
Boundary 2: the fatigue camera, with surgical precision
The sector's most delicate case deserves precision, because it gets told wrong in both directions. Driver fatigue and distraction detection systems (DMS) — the camera that infers drowsiness or loss of attention — are not a prohibited practice. The emotion recognition the AI Act bans in the workplace refers to inferring emotions or intentions from biometric data, and the Regulation itself expressly excludes physical states such as tiredness — citing, in fact, driver fatigue detection to prevent accidents as a legitimate case. Fatigue is not an emotion; anyone telling you your DMS is unlawful is getting the article wrong.
Now the matching nuance: the DMS is high risk, but through a different route than usually assumed — not Annex III, but the safety component of a regulated product route (the Annex I route, the same logic we saw with the dental medical device). The route matters because it carries its own timeline — Annex I's, the latest of the dates set by Regulation (EU) 2026/1744: 2 August 2028 — and because the Annex III instruments don't apply to it under this classification. Precision, timeline and the correct file: all three depend on getting the route right.
The sector's plan, in short
- A complete inventory, covering the sector's typical spread (routes, WMS, telematics, HR) under a single register.
- A telematics use policy that fixes the purpose and draws the employment boundary in writing.
- Rigorous HR: the ATS for drivers and warehouse staff is the same cross-cutting high risk as ever — with the data protection impact assessment under Article 35 GDPR required today, and with the FRIA under Article 27, for those it reaches, from 2 December 2027.
- A well-classified DMS, on its own route and with its own timeline — neither prohibited nor Annex III.
- An informed workforce: geolocation and monitoring explained, with the collective agreement on the table — avoiding the labour dispute is worth more than dodging any fine.
Minimal risk profile with two clear boundaries: few sector descriptions under the AI Act are this manageable. The condition, as always, is not to manage it by ear.
Mentions of products are descriptive of the market and do not imply any commercial relationship. This article is for informational purposes only and does not constitute legal advice.