EU AI Act and AI agents

Regulation (EU) 2024/1689 · AI Act

Definition

The EU AI Act, Regulation (EU) 2024/1689, sets rules by risk level for AI systems placed on the market or used in the European Union. Its 2024 text never mentions AI agents, but its definition of an AI system covers them, so an agent is subject to the obligations of the use it serves.

An agent is an AI system in the sense of the Act

Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy, which infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions. An agent fits without difficulty. What determines the obligations is the use: an agent that shortlists job applications falls under the high-risk regime for employment, while an agent that tidies an internal knowledge base probably does not.

The articles to read first

ArticleWhat it requiresWhat it means for an agent
Art. 4Measures to support the AI literacy of staff (wording softened in 2026 by the Omnibus)Those who work with the agent need to understand what it can and cannot do
Art. 12Automatic recording of events over the lifetime of a high-risk systemThe basis of an audit trail
Art. 14Human oversight, proportionate to risk and to the level of autonomyA person able to override it and to stop it, including by a "stop" button or similar procedure
Art. 26Duties of deployers: competent overseers, logs kept at least 6 monthsApplies to you even when the agent was bought from a supplier
Art. 50Informing people that they are interacting with an AIAn agent that talks to customers announces itself

The calendar after the Digital Omnibus

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and moved the high-risk deadlines. Dates as they stand on the date of this page:

  • Since 2 February 2025: prohibited practices and the AI literacy article, which the Omnibus has since reworded as a duty to take measures supporting literacy.
  • Since 2 August 2025: governance rules and obligations on general-purpose AI models.
  • Since 2 August 2026: general application and the transparency rules of Article 50, with a grace period until 2 December 2026 for machine-readable marking of synthetic content by systems already on the market.
  • 2 December 2027: high-risk systems in sensitive areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control.
  • 2 August 2028: high-risk systems embedded in regulated products.

The postponement does not suspend everything

The GDPR continues to apply in full. Its Article 22 gives people the right not to be subject to a decision based solely on automated processing when it produces legal or similarly significant effects, which covers many agents today regardless of the AI Act calendar. Contract law and consumer law also apply: in Moffatt v. Air Canada, a Canadian tribunal held the airline responsible for what its chatbot had told a customer.

ACF does not replace the Act and offers no guarantee of compliance. It carries part of the Act's requirements down to the delegated decision, and the free AI Act checker helps you see which obligations concern you. For legal questions, consult counsel.

Frequently asked questions

Are AI agents high-risk under the EU AI Act?

Not automatically. The classification depends on the use. An agent used for hiring, credit scoring or access to essential services is likely to be high-risk, whereas an agent reconciling internal data usually is not. Check each use against Annex III.

Does the AI Act apply if the agent comes from an American vendor?

Yes. The Act distinguishes the provider from the deployer, meaning whoever uses the system under its authority. If you use an agent in the EU, your deployer obligations stand regardless of where the vendor is based.

How long must AI agent logs be kept?

For high-risk systems, deployers keep the logs under their control for a period appropriate to the intended purpose and at least 6 months, unless other Union or national law provides otherwise (Article 26(6)). Sector rules can require longer.

Where does your organization stand?

ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.

Take the ACF ScoreAI Act checkerACF Control

Related terms

Human oversight of AIThe ability of competent people to monitor an AI system, understand it, overrule it and stop it, as required for high-risk systems by Article 14 of the AI Act.AI audit trailThe preserved, verifiable record of the decisions an AI system or agent has taken, showing what was decided, by whom and under which rule.AI inventoryThe maintained list of the AI systems and agents an organization uses, with their purpose, data, owner and level of risk.AI governanceThe rules, roles and controls that decide how an organization builds, buys and uses AI, and who answers for the results.

See all 25 terms in the glossary

Primary sources

Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .