Regulation · By Jordan Hale (pen name) · 22 October 2026

The EU AI Act and AI Agents: Which Obligations Apply, and When

The EU AI Act has no separate category for AI agents, but it still covers them. The Commission's AI Act Service Desk says the definitions of an AI system (Article 3(1)) and a general-purpose AI model (Article 3(63)) "are sufficient to cover AI agents". What applies depends on your role and on what the agent is used for. As of October 2026, the prohibitions, the AI literacy duty, the rules for general-purpose AI models and the Article 50 transparency rules already apply, while the Digital Omnibus on AI moved the high-risk rules to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

This is analysis, not legal advice. Article wording comes from the Commission's AI Act Service Desk, which says its text "is based on the EUR-Lex consolidated version of the AI Act as at 27 July 2026". The binding text is the Official Journal version, linked in the sources.

What changed in 2026: the Digital Omnibus on AI

The AI Act, Regulation (EU) 2024/1689, has been amended. Regulation (EU) 2026/1744 of 8 July 2026, the "Digital Omnibus on AI", was published in the Official Journal on 24 July 2026, according to the Publications Office record. The Commission's AI Act page says the proposal "was adopted on 19 November 2025, a political agreement was reached on 7 May 2026 and entered into force on 27 July 2026." The high-risk delay is adopted law.

According to the Commission's announcement, the Omnibus also simplifies the AI literacy requirement and gives the AI Office "extended oversight of certain AI systems, including those built on general-purpose models and embedded in large online platforms and search engines".

Do not confuse it with the other Digital Omnibus. The Commission's Digital Rulebook page describes a separate proposed regulation covering data, cybersecurity and privacy rules, including "A single-entry point for all cybersecurity incidents and data breaches reports". We have not verified its legislative status, so treat it as a proposal.

What applies to an AI agent, and from when

Dates from Article 113 and Article 111 as amended:

2 February 2025: Chapters I and II, which include the AI literacy duty (Article 4) and the prohibited practices (Article 5).
2 August 2025: Chapter V, the obligations for providers of general-purpose AI models. Article 101 in Chapter XII, the fines for those providers, was excluded from this date and applies from 2 August 2026.
2 August 2026: the general date of application, including the Article 50 transparency obligations. The Commission's transparency guidelines page confirms that these obligations "apply from 2 August 2026".
2 December 2026: the new prohibitions added by the Omnibus in Article 5(1), points (ba) and (bb). The same date is the Article 50(2) deadline for content-generating systems placed on the market before 2 August 2026 (Article 111(4)).
2 August 2027: deadline for general-purpose AI models placed on the market before 2 August 2025 (Article 111(3)).
2 December 2027: Chapter III, Sections 1 to 3, for high-risk systems under Article 6(2) and Annex III.
2 August 2028: the same rules for high-risk systems under Article 6(1) and Annex I.
2 August 2030: deadline for providers and deployers of legacy high-risk systems intended to be used by public authorities (Article 111(2)).

Which role are you? Provider, deployer or downstream provider

The Service Desk's FAQ on AI agents describes the typical structure: an agent "will contain at least a general-purpose AI (GPAI) model", and it is an AI system because it usually has an interface. Article 3 then sets the roles:

Provider (Article 3(3)): develops an AI system or a general-purpose AI model, or has one developed, "and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge".
Deployer (Article 3(4)): uses "an AI system under its authority except where the AI system is used in the course of a personal non-professional activity".
Downstream provider (Article 3(68)): "a provider of an AI system, including a general-purpose AI system, which integrates an AI model". In our assessment, most teams building agents on a third-party model hold this role.

Roles can change. Under Article 25(1)(c), a deployer or other third party becomes the provider of a high-risk system if "they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6." The original provider then "shall no longer be considered to be a provider of that specific AI system" (Article 25(2)). In our assessment, wiring a general-purpose assistant into an Annex III use, such as screening job candidates (employment is one of the Annex III areas the Commission lists), is the first scenario to check.

Under Article 6(3), an Annex III system "shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making." The derogation applies only where one of the Article 6(3) conditions is met, for example where the system is "intended to perform a narrow procedural task". An Annex III system that "performs profiling of natural persons" is always high-risk. A provider relying on the derogation "shall document its assessment before that system is placed on the market or put into service" (Article 6(4)).

What already applies to agents

Prohibitions. The FAQ calls the bans on harmful manipulation and on exploiting vulnerabilities, Article 5(1)(a) and (b), particularly relevant to agents. Breaches can draw fines of up to EUR 35 000 000 or 7 % of worldwide annual turnover, whichever is higher (Article 99(3)).

AI literacy. Article 4, as replaced by the Omnibus, now says "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff", while adding that "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

Transparency. Article 50(1) requires providers to "ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use." Article 50(2) requires that synthetic audio, image, video or text output is "marked in a machine-readable format and detectable as artificially generated or manipulated." In our assessment, an agent that contacts people by voice or email on a business's behalf is the clearest Article 50(1) case. The Commission's Article 50 guidelines of 20 July 2026, which state they are "non-binding", say AI agents that interact with people "must be designed and developed in such a way that they disclose both their artificial nature and the person on whose behalf they are acting" (point 31). They should also disclose themselves to the persons instructing them at key steps. Under point 63, only agent output perceptible to people, such as text, audio, image or video, needs marking; intermediate steps such as reasoning, or actions like a web request, do not.

Frontier models. For the models underneath agents, the FAQ says "factors like the level of autonomy or tool use of the model can be decisive in the designation of the model as a model with systemic risk". Annex XIII, point (e), lists "the tools it has access to" among the criteria. Providers of systemic-risk models must already, under Article 55(1), perform model evaluation "including conducting and documenting adversarial testing", report serious incidents to the AI Office "without undue delay", and "ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model." Article 55(2) lets them rely on codes of practice to demonstrate compliance until a harmonised standard is published. The General-Purpose AI Code of Practice was prepared by independent experts, and the Commission and the AI Board have confirmed it is an adequate voluntary tool.

High-risk requirements read as agent controls

For high-risk agents, the requirements closest to agent security risks apply from 2 December 2027 or 2 August 2028:

Logging. "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." (Article 12(1))
Human oversight and a stop function. Article 14(3) requires oversight "commensurate with the risks, level of autonomy and context of use". Article 14(4)(b) names automation bias, and Article 14(4)(e) requires that overseers can "intervene in the operation of the high-risk AI system or interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state." See human-in-the-loop.
Cybersecurity. Article 15(5) calls for measures against data poisoning, model poisoning, "inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion)", confidentiality attacks and model flaws. Article 15 does not use the term prompt injection; in our assessment the adversarial-input wording is the closest fit.
Deployer duties. Under Article 26, deployers "shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support", must suspend use and inform the provider and authority if they suspect a risk, and must keep the logs under their control "of at least six months, unless provided otherwise" in applicable law.
Serious incidents. Article 73 sets reporting deadlines for providers: no later than 15 days after becoming aware, two days for a widespread infringement or an incident under Article 3(49)(b), and 10 days in the event of a death.

In our assessment, these map closely to the controls in our OWASP Top 10 for Agentic Applications analysis: per-agent logging, approvals that resist automation bias, and a safe stop enforced outside the model.

Enforcement after the 2026 loss-of-control incidents

The Commission's AI Act page says that since 2 August 2026 the AI Office and Member State authorities implement, supervise and enforce the Act, and that "The AI Office holds enforcement powers over GPAI models. It can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance." Fines for general-purpose AI model providers can reach 3 % of worldwide turnover or EUR 15 000 000, whichever is higher (Article 101(1)). Enforcement of the rest of the Act is shared with national competent authorities and the European Data Protection Supervisor; the AI Office also supervises AI systems built on a provider's own general-purpose model and AI systems in very large online platforms and search engines.

On 9 October 2026, a special meeting of the AI Scientific Panel discussed recent loss-of-control incidents. In its report on the meeting, published on 12 October, the Commission says: "The AI Office has already requested and received serious incident reports and sent requests for information on security practices." Further requests for information are planned. The panel recommends to "ensure governance of the risk posed by internal models during development activities and deployment for testing". That is a recommendation, not law. The Commission does not name the companies involved. Separately, for one first-party account of agents exceeding their remit, see our report on Anthropic's unintended model actions.

What is still open

The FAQ says the Commission's regulatory considerations on agents "are only preliminary at this stage".
How the Act should reach models and agents used only internally, before market placement, is not settled; the panel's recommendation is the only official signal we found.
The separate Digital Omnibus on data, cybersecurity and privacy remains, on the Commission's own description, a proposal.

Governance and configuration checklist (our assessment)

Record your role per deployment. One organization can be a deployer of a vendor's agent and a downstream provider of its own.
Inventory agents by intended purpose. Check each against the Annex III areas, watch for Article 25 role switches when you repurpose a general-purpose agent, and document any Article 6(3) assessment.
Disclose and mark now. Agents that talk to people need the Article 50(1) disclosure today; content-generating systems need Article 50(2) marking, with 2 December 2026 the deadline for systems already on the market before 2 August 2026.
Log tool calls and actions per agent. Build toward Article 12 and plan six-month minimum retention where a deployment may be high-risk.
Build a real stop path. Article 14(4)(e) describes a halt "in a safe state"; test that revoking an agent's credentials and network access actually stops it. See runtime protection.
Assign named overseers with authority. Article 26(2) asks for competence, training and authority, not just a reviewer queue.
Test against adversarial inputs. Read Article 15(5) as a reason to test for poisoning and manipulated inputs, and use least privilege to limit what a manipulated agent can reach.
Write the incident runbook to Article 73's clocks. The deadlines are short when an incident spans several vendors.

See also our agentic AI security landscape.

This is not legal advice. Status as checked on 20 October 2026 against the Commission's AI Act Service Desk text, which is based on the consolidated version as at 27 July 2026. The binding texts are the Official Journal versions of Regulations (EU) 2024/1689 and (EU) 2026/1744, linked in the sources.

Frequently asked questions

Does the EU AI Act regulate AI agents?

Yes, through its existing categories. The Commission's AI Act Service Desk says AI agents are not a separate category of AI under the Act, but that the definitions of an AI system in Article 3(1) and a general-purpose AI model in Article 3(63) are sufficient to cover them, so the rules for AI systems and general-purpose AI models also apply to agents. The Commission's non-binding Article 50 transparency guidelines (C(2026) 5054) add agent-specific points, such as disclosing both the agent's artificial nature and the person it acts for.

When do the EU AI Act high-risk rules apply to AI agents?

After the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, Article 113 sets 2 December 2027 for high-risk systems under Annex III, such as certain employment or education uses, and 2 August 2028 for high-risk systems under Annex I, which covers AI in regulated products.

Do I have to tell people they are talking to an AI agent?

Since 2 August 2026, Article 50(1) requires providers to design AI systems that interact directly with people so that those people are told they are dealing with an AI system, unless a reasonably well-informed, observant and circumspect person would find that obvious in the circumstances. Article 50(2) separately requires machine-readable marking of synthetic audio, image, video or text output. The Commission's non-binding guidelines add that an agent should also say on whose behalf it is acting.

Was the EU AI Act delayed?

Partly. The Digital Omnibus on AI moved the high-risk dates to 2 December 2027 and 2 August 2028. The prohibitions and AI literacy duty (from February 2025), the general-purpose AI model rules (from August 2025) and the Article 50 transparency rules (from 2 August 2026) were not postponed. Systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty.

Is the EU AI Office acting on the 2026 loss-of-control incidents?

In its report on a special AI Scientific Panel meeting held on 9 October 2026, the Commission says the AI Office has already requested and received serious incident reports and sent requests for information on security practices, and that further requests for information will follow. The Commission did not name the companies involved.

Sources

This article is analysis. Bylines on AIAgentThreats are disclosed pen names of our editorial team. Spotted an error? Email info@aiagentthreats.com. See our Editorial Standards.