EU AI Act scope for defense and aviation: what is in, what is out, and the new dates

Defense and aerospace suppliers often assume the AI Act either does not apply to them or applies in full. The text sits between the two.

Dates first: they moved

Regulation (EU) 2026/1744 amends the AI Act’s dates of application. High-risk obligations in Chapter III, Sections 1, 2 and 3 now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. The regulation itself says the reason is the delayed availability of standards, common specifications and guidance, and the delayed establishment of national competent authorities. If your planning documents say August 2026 or August 2027, they predate the amendment.

The military, defense and national security exclusion

Article 2(3) provides that the Regulation does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity. The word “exclusively” matters.

Recital 24 explains the logic and the limits. A system developed for these purposes that is used for civilian, humanitarian, law enforcement or public security purposes falls within the scope, and a system placed on the market for both an excluded and a non-excluded purpose falls within the scope. The recital also covers the reverse case: a system placed on the market for civilian purposes and used with or without modification for military, defence or national security purposes should not fall within the scope.

Analysis, not sourced fact: a commercial AI component sold to both civil and defense customers should be assessed for the civil placing on the market, because the exclusion is determined by purpose of use, not by the supplier’s industry. Take legal advice on dual-use products.

Civil aviation

The only entry for the EASA Basic Regulation in the AI Act’s Annex I is in Section B, and it is limited to unmanned aircraft. It lists Regulation (EU) 2018/1139 on civil aviation, in so far as it concerns the design, production and placing on the market of unmanned aircraft and their engines, propellers, parts and equipment to control them remotely. For high-risk systems related to Section B legislation, only Article 6(1), Article 60a and Articles 102 to 112 apply - so the AI Act’s full Chapter III obligations do not apply directly.

Instead, Article 108 amends the EASA Basic Regulation so that when implementing and delegated acts are adopted for AI systems that are safety components, the requirements in Chapter III, Section 2 of the AI Act shall be taken into account. That makes EASA’s rulemaking the place where aviation AI rules will be set. EASA’s current guidance is the AI Concept Paper Issue 02.

The Service Desk’s Annex I page, based on the EUR-Lex consolidated version as at 27 July 2026, now marks Section A item 1 as DELETED / not present after the amendment by the Digital Omnibus on AI. Civil-aviation Regulation (EU) 2018/1139 remains Section B item 20 and is still limited to unmanned aircraft. Article 2(13) (NEW) would let the Commission limit some Chapter III obligations for Article 6(1) systems where Section A legislation already provides equivalent protection; that clause does not change the Section B treatment of aviation. Re-verified 14 October 2026.

What still applies in an exclusion scenario

The exclusion removes the AI Act, not other law. Export controls, defense procurement rules and, for US contracts, CMMC and NIST SP 800-171 and DoD Responsible AI are separate regimes, which this article does not analyze.

Logging and documentation if you are in scope

For high-risk systems that are in scope, Article 11 requires technical documentation drawn up before placing on the market and kept up to date, and Article 12 requires automatic recording of events (logs). See the audit evidence checklist.

This is general information, not legal advice. Read the consolidated text for your own analysis. For post-market incident clocks, see AI incident reporting: EU AI Act Article 73 vs DoD guidance. For the US contractor regimes named above, see CMMC Level 2 vs Level 3 for AI systems and NIST AI 600-1 for defense contractors.