- Home
- EU AI Act
The EU AI Act for AI agents: what it asks, and how we answer it.
An honest map: what the Act requires, when, and from whom; what our method and platform do about each article; and what stays your job. We read every article cited here on 9 November 2026. This is an engineer’s reading for your counsel to confirm, not legal advice.
Two questions decide almost everything.
1. Which risk class is the use case? The Act bans a short list of practices (Art. 5). It calls a system high-risk if it is a safety part of a regulated product (Annex I) or used in an area listed in Annex III, such as credit scoring, life and health insurance pricing, recruitment, education, essential public services, law enforcement or justice. Systems that talk to people have transparency duties (Art. 50). Everything else is minimal risk.
2. Who are you for this system? The provider develops it and places it on the market under their name. The deployer uses it under their authority. When we build an agent for you, the contract says who is which. Usually you are the deployer, and for a system built to your specification you may be the provider. Each role has different duties.
The dates, after the Digital Omnibus
- The Act enters into force
- Definitions, AI literacy and prohibited practices (Chapters I and II)
- General-purpose AI models, governance, penalties
- The Act applies generally, including Art. 50 transparency
- Transparency applies; high-risk rules are a year away
- Marking of AI-generated content, for systems on the market before 2 August 2026
- High-risk obligations for Annex III systems
- High-risk obligations for Annex I systems (AI in regulated products)
The Digital Omnibus on AI replaced the original 2 August 2026 and 2027 high-risk dates with these fixed dates. Per the European Parliament’s research service, the trilogue agreed it on 7 May 2026 and Parliament’s plenary approved it on 16 June 2026. It also softened the AI literacy duty in Art. 4. Your counsel should confirm the amending act’s Official Journal reference.
The map: what it asks, what we do, what stays yours
Articles 9 to 15 are the high-risk requirements, mostly for providers. We build every agent to them where they help, even when the agent is not high-risk, because they are a good engineering standard.
| Article | What it asks | Our method | The platform keeps | Stays yours |
|---|---|---|---|---|
| Art. 6 · Annex III | Classify the system; document a “not high-risk” decision | Classification with reasons in the brief, reviewed with your counsel | The brief and its versions | Confirming the classification |
| Art. 9 | A risk management system run “throughout the entire lifecycle” | A risk list per agent, updated at each version and incident | Versions, test results, incidents | Accepting residual risk |
| Art. 10 | Data governance; test data relevant, representative, as error-free as possible | Test sets built with your process owner, with their source and coverage written down | Your test cases and their history | Supplying representative cases |
| Art. 11 · Annex IV | Technical documentation before going live, kept up to date | A documentation pack per agent, renewed with each release | The spec, test reports, releases | Keeping it with your records |
| Art. 12 | Automatic logging of events over the system’s lifetime | Logging on by default | A record of every run | Deciding retention (see Art. 26) |
| Art. 13 | Transparent enough for deployers to interpret and use output; instructions for use | Instructions for use: purpose, limits, accuracy on your cases, oversight | Sources and tools used in each run | Following the instructions |
| Art. 14 | Effective human oversight: understand, notice automation bias, override, stop | Oversight design per agent; reviewer training | Approval cards for releases; held risky actions; a stop control | Naming competent reviewers |
| Art. 15 | Appropriate accuracy, robustness and cybersecurity; declared accuracy | A signed pass bar; safety cases incl. attempts to break the rules | Score per version; safety pack results | Setting the bar |
| Art. 26 | Deployers: use per instructions, competent oversight, monitoring, logs kept at least six months, inform affected people | Monthly report; incident handling; log retention by contract | Conversations, runs, costs | Oversight staff, informing people and workers |
| Art. 27 | Fundamental rights impact assessment for public bodies and for credit and life/health insurance deployers | Inputs for the assessment | Test results and the data path | The assessment itself |
| Art. 50 | Tell people they are interacting with an AI, at the latest at the first interaction | An AI notice in every customer-facing agent’s first message | The notice is part of the spec | Your wording, if you prefer it |
| Art. 4 | AI literacy (softened by the Omnibus) | A briefing for the people who oversee the agent | – | Your staff’s training |
The AI Act sits on top of GDPR, not instead of it.
Most agents process personal data, so GDPR applies from the first day, whatever the AI Act risk class. The two meet in a few places that matter for agents:
- Automated decisions (GDPR Art. 22): people may not be subject to decisions based solely on automated processing with legal or similarly significant effects, except under conditions that include the right to human intervention. Our agents prepare; people decide.
- Impact assessments: a DPIA under GDPR Art. 35 where processing is likely high-risk; the AI Act’s FRIA can build on it (Art. 27(4)), and deployers use the provider’s Art. 13 information for it (Art. 26(9)).
- Logs and retention: the AI Act asks for logs, GDPR asks you not to keep personal data longer than necessary. We set retention per agent to meet both.
What we read, on 9 November 2026
- The AI Act, consolidatedRegulation (EU) 2024/1689 as amended, via the AI Act Explorer: artificialintelligenceact.eu. Articles 4, 6, 9 to 15, 26, 27, 50, 113 and Annex III.
- The Digital Omnibus on AIEuropean Parliamentary Research Service briefing PE 782.651: europarl.europa.eu.
- GDPRRegulation (EU) 2016/679, Articles 5, 17, 22, 25, 28, 32, 35 and 44: gdpr-info.eu. Official text on EUR-Lex.
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.