Hardware & Electronics - Overview
AI PCs are a category-defining trend. IoT deployments are doubling. 52% activity, 30% governance -- a 22-point gap. When a product ships with embedded AI, the governance problem moves from the manufacturer's office to the customer's hands.
AI PCs are redefining the hardware category. IoT deployments are doubling year over year. Activity sits at 52%, governance at 30% -- a 22-point gap. The governance problem in hardware is structurally different from software: when a product ships with embedded AI, the governance problem moves from the office to the customer's hands. FCC Part 15, UL safety certifications, RoHS/REACH, and product liability doctrine all apply to AI-augmented devices. ITAR and EAR add export control exposure for dual-use components. The EU Cyber Resilience Act will require ongoing security governance for connected products. When a firmware update changes a device's AI behavior in the field, the manufacturer needs to prove what changed, when, and that it was tested. That is a chain of custody problem at product scale.
This industry includes 2 segments in the Ontic governance matrix, spanning risk categories from Category 2 — Regulated Decision-Making through Category 2 — Regulated Decision-Making. AI adoption index: 7/5.
Hardware & Electronics - Regulatory Landscape
The hardware & electronics sector is subject to 12 regulatory frameworks and standards across its segments:
- CE marking (EU)
- EU Cyber Resilience Act
- FCC Part 15
- FDA (if medical)
- ITAR/EAR (dual-use)
- NHTSA (if automotive)
- NIST cybersecurity frameworks
- Product liability (Restatement Third)
- RoHS/REACH
- State IoT security laws (CA SB-327 / OR HB 2395)
- State e-waste laws
- UL/safety certifications
The specific frameworks that apply depend on the segment and scale of deployment. Cross-industry frameworks (GDPR, ISO 27001, EU AI Act) may apply in addition to sector-specific regulation.
Hardware & Electronics - Hardware / Electronics -- OEM or Component
Risk Category: Category 2 — Regulated Decision-Making Scale: Mid-Market-Enterprise Applicable Frameworks: FCC Part 15, UL/safety certifications, RoHS/REACH, ITAR/EAR (dual-use), Product liability (Restatement Third), CE marking (EU), State e-waste laws
When the product ships with AI inside, product liability follows the output into the customer's hands.
The Governance Challenge
Hardware OEMs and component manufacturers deploy AI for engineering spec drafting, component documentation, test report summarization, customer-facing product documentation, safety and compliance labeling, and warranty communications. Product liability doctrine (Restatement Third) applies to AI-augmented devices. FCC Part 15 certification applies to AI-enhanced wireless products. ITAR/EAR export controls apply to dual-use AI components. When an AI-generated product specification contains an error that contributes to a safety incident, the manufacturer carries the liability under strict product liability — regardless of the AI vendor's terms of service.
Regulatory Application
FCC Part 15 certification applies to AI-enhanced wireless products. UL and safety certifications require documentation traceability for AI-assisted design decisions. RoHS/REACH compliance documentation applies to AI-generated material declarations. ITAR/EAR export controls apply to dual-use AI components and documentation. Product liability (Restatement Third) applies strict liability to AI-augmented products. CE marking requirements add EU compliance. State e-waste laws apply to AI-enhanced electronics.
AI Deployment Environments
- Studio: Engineering spec drafting | Component documentation | Test report summarization
- Refinery: Customer-facing product documentation | Safety and compliance labeling governance | Warranty and recall communication
- Clean Room: Product liability evidence bundles | Regulatory certification packages | Supply chain compliance documentation
Typical deployment path: Refinery → Refinery → Clean Room
Evidence
- AI PCs are redefining the hardware category — every major OEM has an AI product line
- Product liability claims for AI-augmented devices are emerging case law
- ITAR/EAR export control enforcement for AI components increasing
- EU Cyber Resilience Act will require ongoing AI governance for connected products
Hardware & Electronics - IoT / Connected Devices
Risk Category: Category 2 — Regulated Decision-Making Scale: Mid-Market-Enterprise Applicable Frameworks: FCC Part 15, State IoT security laws (CA SB-327 / OR HB 2395), NIST cybersecurity frameworks, EU Cyber Resilience Act, FDA (if medical), NHTSA (if automotive)
A firmware update that changes AI behavior in the field is a governance event, not just a release.
The Governance Challenge
IoT and connected device companies deploy AI for firmware documentation, security update communication, device onboarding content, customer-facing security disclosures, and privacy policy enforcement. State IoT security laws (CA SB-327, OR HB 2395) impose specific security requirements. The EU Cyber Resilience Act will require ongoing security governance for connected products. When a firmware update changes AI behavior on a device already in the customer's hands, the governance problem is not just what changed — it is whether the manufacturer can prove what changed, when, and that the change was tested before deployment.
Regulatory Application
State IoT security laws (CA SB-327, OR HB 2395) impose device security requirements. NIST cybersecurity frameworks apply to connected device governance. EU Cyber Resilience Act will require ongoing post-market security governance. FCC Part 15 applies to wireless connected devices. FDA regulations apply to medical IoT. NHTSA regulations apply to automotive IoT. Each vertical adds sector-specific requirements on top of baseline IoT governance.
AI Deployment Environments
- Studio: Firmware documentation | Security update notes | Device onboarding content
- Refinery: Customer-facing security disclosures | Update and patch communication governance | Privacy policy enforcement
- Clean Room: Vulnerability disclosure evidence | Incident response documentation | Regulatory investigation bundles
Typical deployment path: Refinery → Refinery → Clean Room
Evidence
- IoT deployments doubling year over year
- EU Cyber Resilience Act compliance deadline approaching
- State IoT security law enforcement increasing
- Vulnerability disclosure requirements expanding across jurisdictions