AI standards and guidelines: a practical guide to choosing and running visual inspection AI
Edge AI in manufacturing: what the EU AI Act and ISO 42001 mean for visual inspection
Visual inspection in manufacturing is moving quickly from manual checks and rule-based image processing to AI built on deep learning. Demand for edge AI, which avoids both latency and security exposure, is particularly strong.
What cannot be stepped around is the worldwide wave of AI regulation and standardisation. The EU AI Act, new standards from ISO/IEC, Japan’s QA4AI guidelines: these are not merely technical specifications. They are becoming the permit for market entry and the proof of quality.
This article sets out what to watch when choosing and running AI, and what to check in the report a vendor hands you.
What this article covers
- Where the international standards and guidelines stand, for anyone managing and running visual inspection AI.
- What to watch, when choosing and running a system, to avoid legal risk and quality trouble.
- A concrete process for judging whether a vendor’s report deserves to be believed.
How the standards and guidelines relate to each other
The standards and laws around AI do not stand alone. They complement each other in a pyramid.
| Level | Standard or regulation | What it does |
|---|---|---|
| Top (legally binding) | EU AI Act / Machinery Regulation | A condition of entering the European market. Penalties for breach. |
| Governance (organisation) | ISO/IEC 42001 | The vessel — a management system — for managing AI properly. |
| Foundation (language, structure) | ISO/IEC 22989 & 23053 | The common language: terms and system structure. |
| Product quality (criteria) | ISO/IEC 25059 | Quality measures particular to AI, such as robustness. |
| Implementation (method) | QA4AI guidelines | Concrete test techniques; a practical manual in the Japanese idiom. |
Conform to the ISO standards that underlie the European ones and you gain a presumption of conformity with the EU AI Act, which reduces legal exposure considerably.
Strict rules exist only in Europe at present, but some customers are beginning to ask for conformity, and if past patterns hold, Japan may well produce JIS versions following IEC. Understanding these laws and guidelines from the moment you start using AI is well worth doing.
What to watch when choosing a system
Understanding the law and the guidelines is one thing; the volume of documentation is enormous. Two points matter most: where your product falls in the EU AI Act’s risk classes, and whether the vendor’s report follows the guidelines.
Where your product falls in the EU AI Act’s risk classes
What is required changes dramatically with the intended use.
The EU AI Act sorts systems into four classes by intended use.
| Risk class | What it covers | Examples | Obligations |
|---|---|---|---|
| 1. Unacceptable risk | Seriously threatens safety or fundamental rights. | Real-time biometric identification in public spaces (identifying individuals by surveillance camera), social scoring. | Prohibited in principle |
| 2. High risk | Affects life, physical safety or fundamental rights. | Weld strength in vehicles, contaminants in medical devices, inspection of critical safety parts. | Strict conformity obligations: risk management, a QMS (equivalent to ISO 42001), technical documentation. |
| 3. Limited risk | Requires transparency — that it is AI must be made clear. | Chatbots, deepfakes. Inspection of cosmetic scratches that do not affect function. | Transparency: tell the user the judgement was made by AI, and similar light obligations. |
| 4. Minimal risk | Little risk. | AI in video games, spam filters. | Nothing in particular. Voluntary codes of conduct are encouraged. |
A general visual inspection system usually falls into high risk or limited risk. A high-risk system has to conform to ISO 42001, the quality management system for AI, much as ISO 9001 works elsewhere. (More on ISO 42001 below.)
Whether the vendor’s report follows the guidelines
Following QA4AI and ISO/IEC 25059, check that the validation below has been carried out and written up.
| Item | What is validated | What you should look for |
|---|---|---|
| Integrity of the data | How ground truth was defined, and how accurately it was labelled. | Are the training images and the validation images clearly separated? |
| Robustness of the model | Stability of the judgement under changes of lighting, positional shift and camera noise. | Does a small change on the floor overturn the judgement? |
| System quality | Inference latency on the edge device, and stability in service. | Does the actual device hold the target takt time? |
| Agility of the process | How quickly it can be retrained when a new defect appears, and how easily the model is updated. | Is there a mechanism for updating quickly when the environment changes? |
| Match with expectations | The trade-off between overkill and leakage. | Is the leakage rate — which drives your operating cost — stated? |
On integrity of the data in particular, you do sometimes see a report that confirms the inspection result using only the data the model was trained on. There are real cases where training and test data cannot be separated, because defects or defect images cannot be collected in quantity. At the very least, the report should state which data was used for training, and whether the result images were among it.
What to watch once the system is running
After the purchase, what is asked of you is governance: managing AI properly as an organisation. This is where ISO/IEC 42001 matters.
What ISO/IEC 42001 asks you to manage
Unlike conventional quality management (ISO 9001), it manages the uncertainty particular to AI. The main items:
| Item | What is required | Why it matters for edge AI |
|---|---|---|
| Risk management system | Identifying, assessing and mitigating known and foreseeable risks. | Continuously assessing whether a missed defect could lead to a physical accident. |
| Data governance | Assuring the quality of training, validation and test data (representativeness, correctness). | Collecting and managing data on unknown defects that occur on the floor. |
| Human oversight | Designing in a way for people to monitor the AI’s output and to intervene or stop it. | Setting a rule by which an inspector can override the AI’s judgement. |
| Keeping records | Logging the system’s behaviour automatically, so it can be traced. | Keeping a log of when, which model, judged which image NG. |
For edge AI in particular, continuous learning that proceeds on its own on the floor is treated as a risk, and a loop-back arrangement — retraining and approval under control — is recommended.
In closing
Meeting laws and guidelines mostly means more management overhead, and not every company has to comply in full. Used as a dictionary of what good looks like, though, these standards are a powerful tool for finding the gaps in your own quality management.
Why not start by checking whether the report your AI vendor handed you separates what was trained on from what was tested on, and whether the explanation has been arranged to suit?
If you are uneasy about adopting edge AI visual inspection, or about meeting the standards, do talk to us. We will think through what fits your floor as it actually is.
