AI Act: what changes for AI agents

The AI Act sets obligations for AI agents in the European market based on their use and your role: the system’s provider or the business deploying it. As of October 24, 2026, transparency rules already apply, while the main obligations for high-risk systems have been postponed until December 2027 or August 2028. An agent’s ability to act independently does not automatically make it high-risk.

The timeline has changed since the original text

The postponement does not cover the entire regulation. The AI Act still has several application dates, so a business may already be subject to some provisions while preparing for others that take effect later.

The Commission confirms that the AI Omnibus entered into force on July 27, 2026. It changes the timeline for high-risk systems and simplifies certain obligations, so it is no longer just a proposal to monitor. The following deadlines are relevant to agents, based on the official overview of the amendment and the regulation’s transitional provisions.

Provision	Deadline	What it means for your project
Initial prohibited practices and AI literacy	Since February 2, 2025, with subsequent amendments	Review use cases and support the people operating the systems
Transparency when interacting with AI	Since August 2, 2026	Check what people are told when they interact with the system
Technical marking of content for systems placed on the market before August 2, 2026	December 2, 2026	Check the provider’s compliance schedule
High-risk systems covered by Annex III	December 2, 2027	Prepare the classification assessment and associated obligations
High-risk systems associated with regulated products under Annex I	August 2, 2028	Also review the applicable sector-specific regulations

The extra time does not suspend other applicable rules, including those governing personal data. The AI Act compliance checklist complements this article by helping you organize the work around each deadline.

Your role matters as much as the agent’s capabilities

A business that uses a system under its authority is generally a deployer. An organization that develops a system, or has one developed, and then places it on the market or puts it into service under its own name may be a provider. These definitions appear in Article 3 of the regulation, consulted in its consolidated version as of October 24, 2026.

Putting a system into service can include using it internally. Having an internal agent built therefore does not guarantee that your organization is only a user. Conversely, connecting existing software to your email does not automatically make you its provider: you need to examine what you have built, its intended purpose, and the responsibilities you exercise.

A project often involves several parties: the model provider, the application vendor, an integrator, and the business using the system. The obligations of a general-purpose AI model provider do not replace those that apply to the final system.

To document this chain of responsibility, ask:

• Who defines the intended purpose and permitted uses?
• Under whose name is the system put into service?
• Who supplies the instructions, limitations, and updates?
• Who receives alerts and can suspend operation?

These questions also help when comparing contracts for AI tools for business functions. A general compliance claim in a brochure explains neither your role nor how you actually use the system.

High-risk classification depends on the system’s purpose

An agent that drafts sales material and an agent that ranks job applications may use a similar architecture. Their legal classifications can still differ because the regulation considers their uses and consequences.

The criteria in Article 6, in the consolidated text consulted in October 2026, distinguish between systems associated with certain regulated products and sensitive uses listed in Annex III. Those uses include situations involving employment, education, and access to certain essential services.

Having a human involved is not enough to rule out a high-risk classification. A tool that recommends which candidates to interview can influence the decision even if a recruiter signs off on the outcome. Conversely, a narrowly defined preparatory task may qualify for an exception if the specified conditions are actually met.

That exception requires an assessment of the task, its influence on the decision, and the risk to individuals. For systems covered by Annex III, profiling natural persons rules out this exemption. A provider that considers its system exempt must document its assessment.

Describe the business function before the technology. “HR assistant” is too vague; “scores applications and proposes a ranking” provides a basis for assessing the classification. AI agent or chatbot: what’s the difference? helps you describe the actions involved, but does not determine the system’s regulatory status on its own.

Transparency already applies to direct interactions

Since August 2, 2026, providers must design systems intended to interact directly with people so that those people know they are interacting with AI, unless this is obvious from the context. The information must be clear from the first interaction. The official transparency FAQ, consulted on October 24, 2026, explains these obligations.

For a customer service agent, check the welcome screen, the start of the call, or the first message. A human first name paired with a disclosure buried in the terms and conditions may leave people unsure who they are dealing with. The business using the system needs to coordinate this presentation with the provider.

An agent that operates entirely in the background, without interacting directly with a person, is not subject to this particular disclosure obligation. Other provisions may still apply.

Transparency also includes separate rules for synthetic content. Machine-readable marking, which is the responsibility of the providers concerned, is separate from visible disclosures intended for the public. The December 2, 2026 deadline applies only to the marking and detection requirements for systems placed on the market before August 2, 2026.

For text published on matters of public interest, an exception to the disclosure obligation applies in particular when the content undergoes editorial control or human review and a person takes editorial responsibility. Simply correcting spelling does not establish that such a review has taken place.

Some uses are prohibited, even with human approval

Before preparing compliance documentation, check whether the intended use is permitted. The prohibited practices include certain forms of manipulation that cause or are likely to cause significant harm, exploitation of vulnerabilities, and certain forms of social scoring. The exact conditions matter: commercial personalization is not automatically prohibited manipulation.

Emotion recognition in the workplace is also prohibited, subject to the specified exceptions for medical or safety reasons. Adding this feature to an agent conducting interviews does not become acceptable simply because an employee reviews the results.

The consolidated version of Article 5 also introduces new prohibitions applying from December 2, 2026, including those concerning the generation of nonconsensual intimate content and child sexual abuse material. As of October 24, this deadline needs to be distinguished from prohibitions that already apply.

Human approval does not make a prohibited practice lawful. For permitted uses, however, it can help limit errors. Defining who reviews a proposal, what information they receive, and whether they can reject it is a governance recommendation, rather than a general guarantee of compliance.

What to prepare for a high-risk agent

The postponement gives organizations time to prepare their technical and organizational arrangements. It does not turn the deployer’s future obligations into optional recommendations: once the relevant deadline arrives, those obligations must be met whenever the system falls within their scope.

Article 26, consulted in its consolidated version in October 2026, includes requirements to use systems according to their instructions, assign human oversight to competent people with the necessary authority, and monitor operation. It also sets out notification and response requirements in the event of a risk or serious incident.

Automatically generated logs under the deployer’s control must be retained for an appropriate period of at least six months, unless another applicable provision specifies otherwise. This rule does not require indiscriminate retention of every conversation from every agent.

To prepare your arrangements, you can:

• Identify the people authorized to stop the system.
• Check which records make it possible to understand its actions.
• Organize reporting and suspension procedures when a risk arises.
• Plan how to inform affected workers when the system is used in the workplace.

This work may reveal contractual or technical limitations: inaccessible logs, no alert procedure, or no way for a person to take over a task. The agent security assessment helps identify operational weaknesses; it does not constitute a legal assessment.

Train your teams and assess GDPR separately

The AI literacy obligation has been amended. The current text asks providers and deployers to take measures to support its development, taking account of people’s knowledge and the context of use. It specifies that no particular level of individual proficiency must be guaranteed: see amended Article 4.

For an agent connected to business software, useful training covers permitted actions, possible errors, accessible data, and how to take back control. Retaining training materials and organizational decisions helps explain the measures taken. A uniform program unrelated to people’s tasks says little about how well prepared users actually are.

The GDPR requires a separate assessment. In particular, its rules on solely automated decisions that produce legal effects or similarly significantly affect a person may already apply, regardless of the timeline for high-risk systems.

The CNIL explains the conditions and safeguards for these decisions. You need to examine the permitted exceptions and the associated rights. Someone who routinely rubber-stamps a recommendation does not necessarily provide meaningful human intervention.

AI agents and GDPR: what data leaves, and where does it go? explores this assessment further. Mapping the information sent to the model remains useful even when the agent runs inside an internal application.

Your decision record before deployment

For a small or medium-sized business, a useful first deliverable is a record for each use case. It describes the objective, the people affected, the data accessed, the actions the agent can take, the responsible parties, and the applicable deadlines.

Then distinguish the legal requirements you have identified from the precautions you choose to adopt. For example, restricting write permissions or requiring approval before a refund may make sense without being a universal AI Act obligation. This distinction avoids presenting every technical safeguard as a regulatory requirement.

Your decision to put the system into service can draw on the following checks:

• The agent’s purpose and actions are precisely described.
• The provider and deployer roles have been examined.
• Prohibited practices and high-risk classification have been assessed.
• Disclosures to people interacting with the agent have been checked in practice.
• Responsibility for training, oversight, and incident handling has been assigned.
• Personal data issues have undergone a separate review.

Revisit this record whenever the agent’s task, audience, or authority to act changes. Moving from preparing a file to selecting people may change the assessment, even if the interface stays the same.

Frequently asked questions

Does the AI Act apply to freelancers who use AI agents?

Yes. Using AI professionally can make a freelancer a deployer, even without employees. The obligations then depend on the use and the system. The exclusion for personal, nonprofessional activities does not automatically cover a tool installed on a personal computer.

Does every AI agent need AI Act certification?

The regulation does not introduce a universal certification required for every agent. Conformity assessment procedures depend in particular on whether the system is classified as high-risk. A commercial compliance badge cannot replace that assessment.

Is a locally installed agent exempt from the AI Act?

Where a system runs does not, on its own, determine whether the regulation applies. Professional use of a local agent may still fall within its scope. Local hosting can reduce some data transfers, but it does not by itself change the system’s intended purpose.

Is a human approval button enough to ensure compliance?

No. You need to examine what the person can actually check and change. Routinely approving results without reviewing them does not necessarily provide effective oversight. Access permissions, available information, and the authority to stop processing also matter.