How the EU AI Act applies to agentic AI systems

An AI agent executes a workflow across multiple APIs, makes a lending decision, and logs only the final output. An agent making unsupervised credit decisions without traceable intermediate steps is already a material risk under existing lending regulations. Under the EU AI Act, it is also a violation that can cost up to 15 million euros.

Compliance infrastructure designed for a chatbot does not cover what a procurement agent or a credit-screening agent actually does in production. Traditional AI controls often assume a single prompt and response. Agentic systems break that model because they can retrieve data, invoke tools, and trigger downstream actions within a single workflow.

That technical distinction has direct implications for governance under the EU AI Act. The Act (Regulation (EU) 2024/1689) classifies AI systems based on factors including their intended purpose, risk profile, and use context. The Act does not use the term "AI agent," but the European AI Office considers an AI agent as an AI system under Article 3(1). That means there is no separate category and no exemption for autonomous operation. For example, an agent that screens job candidates carries the same high-risk classification as any other AI system performing that function, whether it runs on a single model or an orchestrated multi-agent pipeline.

For compliance teams, the work breaks into four parts: scope and classification, obligations by risk tier, documentation requirements, and the enforcement timeline through 2027. Optro AI Governance serves as the system of record for each of these, from inventory and classification through ongoing documentation and monitoring.

1. Which agentic systems fall in scope and at what risk tier

The Act uses a risk-based classification system. Every AI system, agents included, falls into one of four tiers based on its intended purpose and the domain in which it operates.

Prohibited (Article 5). Agents that manipulate behavior through subliminal techniques, exploit cognitive or emotional vulnerabilities, or perform social scoring. An agent that nudges users against their interests may trigger Article 5(1)(a) even if the manipulation is an unintended side effect. These prohibitions have been in effect since February 2, 2025.

High-risk (Annex III). Agents operating in domains where their outputs affect individuals' rights or safety. Common enterprise use cases that trigger high-risk classification: HR and recruitment (screening, ranking, or interviewing candidates), credit assessment and financial scoring, access to essential public or private services, education admissions and assessment, and critical infrastructure management. High-risk AI systems face the Act's full set of requirements:

• AI risk assessment protocols that cover the agent's design, deployment, and runtime behavior, including risks introduced by autonomous tool use and chained decision-making
• AI conformity assessment before deployment, human oversight, automatic logging
• AI post-market monitoring to track behavioral drift after deployment

For most standalone high-risk systems, the main Chapter III obligations apply in December 2027. Transparency obligations arrive earlier. Section 4 breaks down the timeline and what teams should prioritize first.

Limited risk (Article 50). Agents that interact directly with people or generate synthetic content. AI transparency obligations apply: the agent must disclose that the interaction is with an AI system (required since August 2026), and generated text, audio, image, or video must be labeled as AI-produced using machine-readable marking (December 2026 for systems already on the market). This covers most customer-facing agentic deployments, even when they do not reach the high-risk tier.

Minimal risk. Agents performing internal-only tasks with no significant impact on individuals' rights. Examples include internal document summarization or internal process automation with no downstream decision authority over people. No mandatory obligations apply, though the Act encourages voluntary codes of conduct.

How classification works differently for agentic systems

Classification is determined by intended purpose, not by the underlying model. That matters in practice: a team that labels every agent built on a general-purpose model as “limited risk” can still misclassify a system that screens candidates, auto-rejects applicants below a threshold, or routes decisions about access to financial services. Article 6 and Annex III define the criteria. The model architecture is not part of that assessment. Optro maps each AI system to the Act’s risk tiers automatically and tracks which obligations apply at each level, so the classification stays current as the agent’s scope changes.

Agentic systems also make classification less static. An agent's risk tier must be reassessed when its purpose, data access, tool permissions, or affected user population changes. A supplier-onboarding agent for a hospital system that begins routing vendor approvals may shift from minimal to high-risk if those approvals affect access to essential healthcare services. A customer-facing chatbot that gains tool-use permissions requires reclassification at the point those permissions change. For agentic AI governance, this makes classification a change-management control, not a one-time legal exercise.

Multi-agent orchestration adds a separate consideration. The AI Office's preliminary position is that an organization that designs and controls a composite orchestration layer may carry provider-level obligations for the overall system, even when it deploys third-party components within that pipeline. Each component agent may also require independent classification. The agentic AI governance program should cover both the orchestration layer and the individual agents within it.

2. What obligations attach at each risk tier

High-risk agentic systems (Chapter III)

Risk management (Article 9). The risk management system must cover the full lifecycle of the agent, including risks introduced by autonomous tool use, chained actions, and actions taken without real-time human instruction. A risk management system designed for a static model will not cover the failure modes of an agent that calls external tools, accesses databases, and chains multiple decisions before returning a result. AI risk assessment for agentic systems should map each tool the agent can call, the data it can access, and the downstream consequences of its autonomous decisions. In practice, teams should be able to show the control owner for each agent, the failure modes they have identified, and the mitigation steps tied to those risks.

Data governance (Article 10). Training, validation, and testing datasets must be relevant, representative, and free of biases. For agents that access live data during operation, governance extends to runtime data access. An agent that queries a customer database or pulls records from a third-party API during execution is using data that was not part of the original training set. The control framework should cover both training data and runtime data access.

Technical documentation (Article 11). Must describe the agent's design, development, intended purpose, capabilities, limitations, and the specific tools, APIs, and data sources the agent can access. Section 3 maps the documentation record to the relevant obligations.

Automatic logging (Article 12). Article 12 requires automatic logging that supports traceability throughout the AI system's lifetime. For agentic systems, that means capturing the full action chain: which tools the agent called, which data it accessed, which intermediate decisions it made, and what output it generated. Logging only the final output does not satisfy the requirement. Multi-agent systems with orchestration layers face the additional burden of attributing actions to the correct component and maintaining an end-to-end audit trail across agent handoffs. Records must be protected from alteration and retained for the duration specified by the deployer or by national law. At a minimum, teams should expect to log timestamps, tool calls, data sources accessed, model or policy version, intermediate decisions where relevant, human overrides, and the final action taken.

Transparency and instructions for use (Article 13). Deployers must receive clear information about what the agent can and cannot do, including its action boundaries and failure modes. For an agentic system, "instructions for use" means documenting not just the model's behavior but the full range of actions the agent can take autonomously.

Human oversight (Article 14). The Act requires mechanisms that allow human operators to intervene in or override the agent's decisions. For agentic systems that take dozens or hundreds of actions per hour, per-action approval is neither workable nor required. What Article 14 does require is that reviewers understand the system’s limitations, can access the relevant logs, and have the authority to override or halt the system. Many teams either overengineer oversight by creating approval bottlenecks that get circumvented in practice, or under-engineer it by standing up a monitoring dashboard that nobody reviews. Effective AI agent oversight means pre-defined action boundaries, logging of all autonomous actions, and the operational ability to halt the agent when those boundaries are exceeded.

Accuracy, robustness, and cybersecurity (Article 15). Agents that take autonomous actions face heightened robustness requirements. This includes credential scoping (limiting what credentials the agent can use), tool-permission boundaries (restricting which tools the agent can call), and adversarial resilience (testing whether the agent can be manipulated into taking unintended actions through prompt injection or input manipulation).

Conformity assessment (Article 43). Required before placing the agent on the market or putting it into service. For certain categories of high-risk AI systems, third-party assessment is required.

Fundamental Rights Impact Assessment (Article 27). Required for high-risk deployers that are public bodies, private entities providing public services, and deployers of credit-scoring and life or health insurance systems. If the agent makes decisions about individuals' access to benefits, employment, credit, or essential services, this assessment must be completed and documented.

Registration (Article 49). High-risk agents must be registered in the EU database before deployment.

Who carries the compliance burden

Building an agentic system on a third-party foundation model does not shift the deployer's obligations to the model provider. The Act creates two separate tracks. Articles 51, 53, and 55 impose obligations on general-purpose AI model providers: technical documentation, training data summaries, copyright policy, and an acceptable use policy. Articles 26 and 27 impose distinct obligations on deployers of high-risk systems, including log retention (minimum six months under Article 26(6)), incident reporting, and Fundamental Rights Impact Assessments.

A risk program lead who relies on the model vendor's compliance documentation to satisfy the organization's deployer obligations will find gaps. The model provider's documentation covers how the model works. The deployer's obligation covers what the agent does with that model in its deployment context: the tools it calls, the data it accesses, the decisions it routes. For a deeper look at how provider and deployer obligations interact, see the Optro EU AI Act Reg Cheat Sheet.

Limited-risk agentic systems (Article 50)

Two obligations apply. First, disclosure: users must be informed they are interacting with an AI system at the start of the first interaction, unless this is already obvious from context. This requirement has applied since August 2, 2026. Second, synthetic content marking: agents generating text, audio, image, or video must label that content as AI-generated, using machine-readable marking where technically feasible. Under the revised timeline, Article 50(2) marking obligations for systems already on the market take effect December 2, 2026. These AI transparency obligations apply under Art. 50(3)-(4) to deployers as well as providers.

3. What documentation the Act expects

The table below maps each obligation to its article citation, the entity to which it applies, its effective date, and a note on how the requirement applies to agentic systems. Dates reflect the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026). Final dates depend on formal adoption.

The table above focuses on obligations with specific deadlines, entity distinctions, or procedural steps that compliance teams need to track independently.

What an agentic system's documentation record should include

For agentic systems, the documentation record should go beyond a model card or vendor summary. A defensible agent file should cover:

• Owner and business purpose. Who built the agent, who deployed it, what business function it serves, and which internal team is accountable for ongoing compliance.
• Model and configuration. Which model or models the agent uses, which version, under what system instructions, and how model updates are validated before promotion to production.
• Data access. Which databases, APIs, and external data sources the agent can query during operation, and which data categories (personal data, financial records, health information) it processes.
• Tools and permissions. Which tools the agent can call, what credentials it uses, what actions it can take autonomously, and where the approval boundary sits for actions that affect individuals' rights or access.
• Affected people. Which individuals or groups are affected by the agent's decisions, and through which specific pathways (hiring decisions, credit determinations, benefit eligibility, service access).
• Action logs. A record of tool requests and results, and the active model and policy versions at each step, protected from alteration. Specify where logs are stored, how long they are retained, and who can access them.
• Credential limits. Evidence that the agent operates on least-privilege principles, and that actions affecting rights, employment, financial status, or service access require human approval before execution.
• Review triggers. The conditions under which the agent's classification, documentation, and oversight mechanisms must be reassessed: new tool access, expanded data permissions, changes to the affected user population, or model version upgrades.

This documentation supports Articles 11 and 12 and gives teams a workable foundation for internal review, audits, and future conformity assessment. Teams that build this record early will have a far easier time when the December 2027 deadline approaches.

4. The 2026-2027 compliance timeline

The enforcement timeline below reflects deadlines as revised by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026). Several dates shifted from the Act’s original schedule.

February 2, 2025 (in effect). Prohibited AI practices under Article 5 and AI literacy requirements under Article 4. Any agents that manipulate behavior, exploit vulnerabilities, or perform social scoring must already be identified and decommissioned. Staff who operate or oversee agentic AI systems must have sufficient understanding of their autonomous capabilities and limitations.

August 2, 2025 (in effect). GPAI model obligations under Articles 51,53, and 55. If the organization provides a general-purpose AI model, transparency and documentation duties are already active. This is a model-provider obligation and does not cover deployer obligations for agents built on those models.

August 2, 2026 (in effect). Article 50(1) AI disclosure obligations took effect. Customer-facing agents must inform users they are interacting with an AI system at the start of the first interaction.

December 2, 2026. Article 50(2) machine-readable content marking takes effect for AI systems already on the market. Generated text, audio, image, and video must carry machine-readable labels identifying the content as AI-produced.

December 2, 2027. Full Chapter III obligations apply to standalone high-risk AI systems defined in Annex III. This is the primary deadline for most enterprise agentic deployments in HR, finance, compliance, and essential services. By this date, conformity assessments, risk management systems, technical documentation, automatic logging, human oversight mechanisms, and post-market monitoring programs must all be operational.

August 2, 2028. Obligations for high-risk AI systems used as safety components of regulated products become applicable.

Penalties for non-compliance

The Act's penalty structure scales with the severity of the violation:

• Prohibited practices (Article 5 violations): up to 35 million euros or 7% of worldwide annual turnover, whichever is higher.
• High-risk and limited-risk violations (documentation, transparency, oversight requirements): up to 15 million euros or 3% of worldwide annual turnover.
• Providing incorrect or misleading information to authorities: up to 7.5 million euros or 1% of worldwide annual turnover.

Fines account for the nature, gravity, and duration of the infringement, the number of affected persons, and the level of damage. Penalties may be adjusted for startups and SMEs, but the compliance requirements are the same.

What to do now

For most teams, the immediate focus is twofold: prepare limited-risk customer-facing systems for the 2026 transparency deadline, and start building the evidence and controls high-risk systems will need by December 2027.

First: build an AI inventory. For each agentic system, capture: owner, business purpose, model and vendor, connected tools, data categories accessed, impacted user populations, and current approval path. Include agents adopted without central procurement. Only 34% of organizations report having an AI model inventory, according to Optro's 2026 risk report. Shadow AI agents adopted by individual teams or departments are a particular gap.

Second: classify each agent by risk tier. Document the classification rationale for each system. Build a review trigger into the change management process so classification is reassessed when the agent gains new tool access, expanded data permissions, or a changed user population.

Third: begin building compliance infrastructure for high-risk agents. Specifically:

• Technical documentation that covers the agent's tool access, API connections, action boundaries, and credential scoping
• Logging infrastructure that captures tool calls, data retrieved, intermediate decisions, policy version at each step, and human overrides
• Human oversight protocols with realistic intervention mechanisms, including defined halt conditions and escalation paths
• Preparation for conformity assessment, including identifying whether the agent's risk category requires third-party assessment

For teams starting from scratch, the Optro EU AI Act readiness playbook walks through the full compliance sequence.

Fourth: confirm Article 50 disclosure is already in place for customer-facing agents already in the market ahead of the December 2026 deadline. Review third-party AI vendor contracts to confirm where compliance obligations fall. Vendor support may help, but it does not remove the deployer’s obligations.

Agentic systems change faster than the controls around them unless teams design governance to move with the system. The main failure point is usually not initial classification; it is failing to revisit classification, logging, and oversight when the agent gets new tools, new data access, or new decision authority.

How Optro handles human oversight for AI agents

Optro’s agents draft and recommend while the team decides. Every run, acceptance, and dismissal is logged. That record satisfies Article 14’s requirement for traceable human oversight without creating the approval bottlenecks the Act does not require.

Go from understanding to action

Get the EU AI Act readiness playbook