Deploying AI agents in the EU: which AI Act obligations actually apply to you

Most companies "starting with AI" are now looking at agents: systems that do not just answer a question but take steps. They triage tickets, send emails, update the CRM, book meetings or run a workflow end to end. A question we hear often is whether the EU AI Act has special rules for them.

It does not. The AI Act has no separate regime for AI agents. An agent is regulated as what it legally is, an AI system, and the obligations depend on two things: what the agent is used for and whether you built it or only use it. That answer is less dramatic than much of what is written about "agentic AI compliance", and more useful.

This is an information service to help you orient, not legal advice. For the obligations tied to your own AI use, see which apply to your company.

An agent is an AI system, and the definition was written with autonomy in mind

Article 3(1) defines an AI system as a machine-based system "designed to operate with varying levels of autonomy" that infers from its input "how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."

An agent that reads an inbox and decides which emails to send is a textbook fit. Autonomy is not a new legal category under the Act; it is part of the baseline definition. If you are unsure whether a simpler automation counts at all, see is my software an AI system?

The word "agentic" appears in the Act's binding text once: in Annex XIV, inserted by the Digital Omnibus in July 2026, which lists the codes used to define what a notified body may assess ("including Agentic AI"). That is a scope label for conformity-assessment bodies. It is not a set of obligations.

Step 1: are you the provider or the deployer of the agent?

Your situation	Your role	Source
You use a vendor's agent product (e.g. an AI support agent, an AI SDR tool) in your business	Deployer	Art. 3(4)
You build an agent on a third-party model API and offer it to customers under your name	Provider of that AI system	Art. 3(3)
You build an agent in-house and use it under your own name, even only internally	Provider (putting into service) and deployer	Art. 3(3), 3(4)
You put your name on a vendor's high-risk system, substantially modify one, or repurpose a non-high-risk agent into a high-risk use	You become the provider of a high-risk system	Art. 25(1)
You train and release the underlying general-purpose model	Provider of a general-purpose AI model (Chapter V)	Art. 3(3), 3(63)

The last row is rarely you. Building on a model API, prompting it, or connecting it to tools does not make you a model provider. For where that line sits when you fine-tune, see fine-tuning and the GPAI provider line.

The fourth row is the one to watch with agents. Article 25(1)(c) makes you the provider of a high-risk system if you modify the intended purpose of an AI system, "including a general-purpose AI system", so that it becomes high-risk. On a plain reading, configuring a general-purpose agent to screen job candidates is that kind of change of purpose.

Step 2: what is the agent used for?

This decides almost everything.

Most business agents: not high-risk

An agent that drafts replies, summarises tickets, schedules meetings, updates records or writes code is not, on those facts, listed in Annex III. For these agents the high-risk regime in Chapter III does not apply. Your obligations are:

Obligation	Who	Applies from	Source
Take measures to support the AI literacy of staff who operate or use the agent	Provider and deployer	2 Feb 2025 (wording softened to an obligation of effort from 27 Jul 2026)	Art. 4
Do not deploy prohibited practices, including purposefully manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm	Provider and deployer	2 Feb 2025 (the two new Omnibus prohibitions in Art. 5(1)(ba)–(bb) apply from 2 Dec 2026)	Art. 5(1)(a)
Design the agent so people know they are interacting with an AI system, unless obvious	Provider	2 Aug 2026	Art. 50(1), 50(5)
Mark synthetic output (text, audio, image, video) in a machine-readable format and make it detectable as artificially generated, subject to the standard-editing exception	Provider	2 Aug 2026; 2 Dec 2026 for systems on the market before 2 Aug 2026	Art. 50(2), 111(4)
Disclose AI-generated text published to inform the public on matters of public interest (unless it has undergone human review or editorial control and a person holds editorial responsibility for its publication), and deepfakes	Deployer	2 Aug 2026	Art. 50(4)

Article 50(1) is the obligation most likely to apply to agent builders. An agent that emails customers, answers the phone or chats with suppliers is "intended to interact directly with natural persons". The provider has to design it so those people are told, "at the latest at the time of the first interaction or exposure" (Art. 50(5)). For the wording, see the Article 50 disclosure template; for the full set of duties, see the Article 50 transparency obligations.

Of the Commission's adopted guidance, the Article 50 guidelines of 20 July 2026 deal with agents most directly. Paragraph 31 says an agent is within Article 50(1) if it can interact with the people instructing it or with other people while carrying out tasks (the examples given are making bookings, managing correspondence, negotiating or concluding contracts and executing purchases); that it must be designed to disclose both that it is an AI system and on whose behalf it is acting; that where the provider cannot know in advance whether the agent will meet a person, it should be built to disclose itself wherever that is reasonably likely; and that it should identify itself to the people instructing it at key steps (such as authorisation, reporting and validation) and at every new interaction. Paragraph 40 adds that a single notice before the first interaction is likely to be enough in most cases, but not always for agents: periodic, context-aware reminders are likely to be necessary where people need to keep awareness and control over what an agent does. Backend calls between AI systems, including agents, whose outputs are not intended to reach a person are outside Article 50(1) (paragraph 30), and intermediate steps such as reasoning or a web request are not "synthetic content" under Article 50(2) (paragraph 63). The guidelines are the Commission's reading, not binding law.

On Article 50(2), note that the marking duty sits with the provider of the AI system, so for an agent that generates text or images through a third-party model API, the duty is yours, not the model provider's. The guidelines (paragraph 74) say you may rely on a marking solution from the upstream model provider or a third party, but you remain responsible for showing that your outputs meet Article 50(2). For what that means in practice, see watermarking AI text when you build on an API.

Agents that act on people in sensitive areas: potentially high-risk

An agent becomes high-risk when it is used for a purpose listed in Annex III (Art. 6(2)). The listed purposes that agents are most likely to drift into are:

Annex III point	Example agent use
4(a) Employment: recruitment and selection	Sourcing agent that filters applications or ranks candidates
4(b) Employment: worker management	Agent that allocates tasks "based on individual behaviour or personal traits or characteristics" or monitors and evaluates performance
5(b) Essential private services	Agent that evaluates the creditworthiness of individuals or establishes their credit score (systems used to detect financial fraud are carved out)
5(c) Insurance	Agent that does risk assessment and pricing for individuals in life and health insurance
3(b) Education	Agent that evaluates learning outcomes in an educational institution

Two rules make this stricter than it looks:

• Profiling is never "not high-risk". Under Article 6(3), an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons." An agent that builds a picture of an individual to make a decision about them cannot use the Article 6(3) derogation. For when that derogation does apply, see the Article 6(3) "not high-risk" derogation.
• Repurposing makes you the provider. In law, the intended purpose is the one the provider sets in its instructions for use, technical documentation and sales materials (Art. 3(12)). If you point a general-purpose agent at hiring decisions, you change that purpose, and Article 25(1)(c) makes you the provider of a high-risk hiring system.

For the full test, see is your AI system high-risk?. For hiring specifically, see the AI Act for HR and recruitment software.

Step 3: if the agent is high-risk, the dates have moved

The Digital Omnibus, Regulation (EU) 2026/1744, deferred the high-risk regime. Under the amended Article 113(c), Chapter III Sections 1–3 apply from:

• 2 December 2027 for Annex III systems; and
• 2 August 2028 for systems that are high-risk under Annex I (safety components of regulated products, or the products themselves, that need third-party conformity assessment).

From those dates, a deployer of a high-risk agent has the Article 26 duties. Agents already on the market or in service before then are a partial exception: under the amended Article 111(2), they are caught only if their design changes significantly from that date, and agents tend to be updated often. The Article 26 duties include following the instructions for use, assigning human oversight to people with "the necessary competence, training and authority", monitoring operation, keeping the logs under its control for a period appropriate to the intended purpose and of at least six months (unless other Union or national law, notably data-protection law, provides otherwise), and informing workers' representatives and the affected workers before putting it into service or using it at the workplace. For the full list, see deployer obligations under Article 26.

Two of those duties are worth designing in now, because they are hard to retrofit into an agent:

• Human oversight (Art. 26(2)). An agent that takes consequential actions with no one able to intervene is difficult to square with the requirement to assign oversight to competent people.
• Logs (Art. 26(6)). Article 26(6) covers the logs the system generates automatically. If your agent framework does not log what the agent did, there is nothing to keep for six months. Logging its reasoning as well is good practice, but the Article does not require it.

Article 26(5) also requires a deployer who identifies a serious incident to "immediately inform first the provider", then the importer or distributor and the market surveillance authorities. Article 73 itself sits in Chapter IX, which the Omnibus did not defer, but it applies to providers of high-risk systems, and high-risk classification only applies from the dates above. On our reading, provider reporting therefore starts then too; the Omnibus gives Article 73 no date of its own. Providers of high-risk systems will have to report serious incidents to the market surveillance authority immediately once they establish a causal link (or its reasonable likelihood), and in any event within 15 days of becoming aware; the outer limit is two days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and 10 days where a person has died (Art. 73(2)–(4)). Article 3(49) defines a serious incident as one that leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental-rights obligations, or serious harm to property or the environment.

Where the 12 October news fits, and where it does not

On 12 October 2026, the Commission reported on a special meeting of the AI Scientific Panel, held on 9 October, about "recent incidents of loss of control" involving AI models. The Commission said the AI Office "has already requested and received serious incident reports and sent requests for information on security practices", and that the Commission will now send requests for information combining the questions of the panel and the AI Office.

This is the clearest statement we have seen on a Commission page that serious incident reports have been received. It is an important enforcement signal, but it concerns the companies that developed the models involved (the Commission's words), not the businesses that deploy agents on them. Serious incident reporting to the AI Office is an obligation of providers of general-purpose AI models with systemic risk (Art. 55(1)(c)), and that duty stays with the model provider. The original Act already let the AI Office supervise AI systems built on a general-purpose model by the same provider. The Omnibus made that competence exclusive (with exceptions, such as systems tied to Annex I products or used in critical infrastructure). It also extended the competence to providers in the same undertaking and to AI systems that are, or are integrated into, a designated very large online platform or search engine. Providers of high-risk systems in that group must report serious incidents to the AI Office instead of the market surveillance authority (Art. 75(1), (1a)). The competence reaches deployers only where they are also the provider or part of its undertaking. A business that builds an agent on someone else's model, or runs a vendor's agent, therefore normally stays with its national authorities, unless the agent is part of a designated very large online platform or search engine.

What does carry over to you is a practical lesson. Your own obligations around oversight, logs and incident escalation are easier to meet if you know what your agent did, and can stop it.

What to do this quarter

1. Inventory your agents by purpose, not by product name. For each one, write down what it decides or does, and for whom. That is what decides the regime.
2. Mark your role for each. Bought (deployer) or built (provider, often also deployer). Note anywhere you have repurposed a general-purpose agent.
3. Check every purpose against Annex III points 3, 4 and 5. Flag anything that profiles individuals.
4. Fix Article 50(1) now for any agent that interacts with people: customers and suppliers and, on the Commission's reading, the staff who instruct it. It has applied since 2 August 2026.
5. Build oversight and logging into your agent framework before you need them. Treat 2 December 2027 as the latest date for anything in Annex III, not the start date for planning.
6. Cover AI literacy for the people who run the agents. See what Article 4 actually requires.

Breaches of Article 26 or Article 50 fall under Article 99(4): fines of up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher. Breaches of Article 5 fall under Article 99(3): up to EUR 35 000 000 or 7%. For SMEs and start-ups, Article 99(6) reverses the test for every tier: whichever of the amount or the percentage is lower. Since the Omnibus, small mid-caps (SMCs) get the same lower-of rule, but only for the Article 99(4) and (5) tiers (Art. 99(6a)). For context, see how much AI Act fines can be.

To see which obligations and dates apply to the agents you run, answer a few questions about your AI use. To be told when guidance on high-risk classification is finalised, or when enforcement moves, join the waitlist.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.