EU AI Act

The regulation applies directly in all EU member states and covers anyone who provides or deploys AI systems in the EU — including providers from outside. It sorts AI systems into risk classes with graduated obligations, and adds separate rules for general-purpose AI (the large foundation models). Violations can draw fines of up to €35 million or 7% of global annual turnover. The obligations take effect in stages — the key dates are in the timeline below.

Four tiers. Prohibited practices (Art. 5): e.g. social scoring or manipulative systems — banned in the EU. The Digital Omnibus added AI systems that generate non-consensual intimate imagery or child sexual abuse material; that prohibition applies from 2 December 2026. High-risk (Annex I & III): AI in areas like hiring, credit decisions, critical infrastructure or regulated products — allowed, but with strict duties around risk management, data quality, oversight and documentation. Transparency-obliged (Art. 50): systems that interact with people or generate content — people must be able to tell. Minimal risk: the large remainder, with no special requirements. Most back-office agents sit in the lower two tiers — until their decisions directly affect people.

The foundation models agents are built on — since 2 August 2025, their providers face dedicated obligations: technical documentation, information for downstream providers, a summary of training data, a copyright policy; for the most capable models, additional safety evaluations. For deploying companies this means, practically: model choice is also a compliance decision — and the provider's documentation belongs in your own AI system file.

The obligation with the biggest day-to-day impact on agents, applicable since 2 August 2026: providers design AI systems that interact directly with people so that those people are informed — unless it is obvious — and mark synthetic content in machine-readable form; standard editing assistance is exempt. Deployers disclose, among other things, deepfakes and AI-generated text published without editorial control to inform the public on matters of public interest. For providers of systems placed on the market before 2 August 2026, the deadline for machine-readable marking runs until 2 December 2026. The Commission published guidelines on 20 July 2026; a voluntary code of practice is recognised as an adequate way to demonstrate compliance. Concretely: the agent answering supplier queries identifies itself as a system; the documents it produces carry a marking. Built properly, this is a platform feature, not per-case housekeeping.

High-risk systems must — from 2 December 2027 and 2 August 2028 respectively — be designed so humans can effectively oversee them: understand their limits, interpret outputs correctly, intervene or switch them off. For agentic systems this is the regulatory version of what is operationally wise anyway — exception queues, four-eyes approvals, a stop switch per agent, and operations staff who understand the systems. Oversight built in as a function corresponds in substance to what Art. 14 requires of providers and Art. 26(2) of deployers; whether the obligations are met in a specific case must be assessed separately.

The AI Act assigns obligations by role. The provider develops an AI system and places it on the market; the deployer uses it under their own responsibility. Practically important: substantially modifying a system, or deploying it under your own name, can shift you into the provider role — with its obligations. In agent projects, the role question therefore belongs in the contract: who documents, who monitors, who reports incidents, who is liable for what.

The obligations arrive in stages: 2 Feb 2025 — prohibitions and AI-literacy duty · 2 Aug 2025 — GPAI obligations · 2 Aug 2026 — Article 50 transparency obligations; fines against GPAI providers possible · 2 Dec 2026 — machine-readable marking deadline for existing systems and the new prohibition on AI-generated intimate imagery · 2 Aug 2027 — deadline for GPAI models placed on the market before August 2025 · 2 Dec 2027 — high-risk obligations under Annex III · 2 Aug 2028 — high-risk AI in regulated products (Annex I). This reflects the Digital Omnibus, in force since 27 July 2026, which pushed the original high-risk dates back. The sensible order inside a company: inventory and classification first, then marking, then the high-risk files.

The most overlooked obligation — applicable since 2 February 2025: whoever provides or deploys AI systems must support the development of AI literacy among their people — appropriate to their role and the systems in use. The Digital Omnibus softened it: providers and deployers take measures to support the AI literacy of their staff and of others acting on their behalf, but no longer have to guarantee a particular level; the Commission and the member states support them in this. For agent operators little changes: the business team working the exception queue must understand what the agent can do, where it errs and when to stop it. That is exactly why this glossary exists.

The fine ranges are modelled on the GDPR and exceed it: up to €35 million or 7% of global turnover for prohibited practices, up to €15 million or 3% for most other violations; for SMEs the lower amount applies, and since the Digital Omnibus the same holds for small mid-caps regarding the other obligations. Enforcement is national: under the AI Market Surveillance Act of July 2026, Germany's Federal Network Agency is responsible; in Austria, no market surveillance authority has been designated so far — RTR's AI service desk informs and advises (as of September 2026). EU-wide, the AI Office supervises providers of GPAI models. Realistically, enforcement starts not with raids but with questions — and the best answer is a well-kept file: inventory, classification, audit trail.