What is the EU AI Act?

The EU AI Act is the world's first comprehensive law regulating artificial intelligence. It entered into force on 1 August 2024 and has been switching on in stages since. The general application date arrived on 2 August 2026, bringing the transparency rules into force, while the Digital Omnibus agreement of May 2026 deferred the high risk obligations to 2 December 2027. If your software makes decisions or takes actions with AI, and anyone in the EU uses it or is affected by it, some part of this law probably touches you.

Who the Act applies to

The Act is extraterritorial, like the GDPR before it. It applies to providers who build AI systems and place them on the EU market, and to deployers who use AI systems in the EU, wherever those companies are based. A US or UK company selling software into Europe is in scope. So is a company outside the EU whose AI output is used inside the EU.

The provider and deployer roles carry different duties. Providers carry the heavier load: conformity assessments, registration, technical documentation, quality management. Deployers must use systems as intended, keep the logs the system generates, ensure human oversight, and in some cases run fundamental rights impact assessments before switching a system on.

The four risk tiers

The Act sorts AI systems by the harm they could do, and the obligations scale with the tier.

• Prohibited. Practices banned outright since February 2025: social scoring, manipulative techniques that cause harm, scraping facial images at scale, emotion recognition at work and school, and similar.
• High risk. AI used in areas like hiring, credit, insurance, education, critical infrastructure, medical devices, and law enforcement. This tier carries the full compliance programme: risk management, data governance, technical documentation, record keeping, human oversight, accuracy and robustness requirements, and registration in the EU database.
• Limited risk. Transparency duties. Chatbots must disclose they are AI. Synthetic media must be labelled.
• Minimal risk. Everything else, which is most software. No new obligations, though voluntary codes are encouraged.

General purpose AI models, the foundation models that agents are built on, got their own chapter with obligations that started in August 2025: transparency about training, copyright policies, and extra duties for the largest models.

The timeline so far

• August 2024. The Act entered into force. Nothing enforceable yet.
• February 2025. Prohibited practices banned. AI literacy duties began.
• August 2025. General purpose AI model rules took effect.
• August 2026. The general application date. Article 50 transparency rules became enforceable: chatbots must disclose they are AI, synthetic media must be labelled. The high risk obligations originally due now were deferred by the Digital Omnibus agreement of 7 May 2026.
• December 2027. Deferred deadline for Annex III high risk systems: hiring, credit, insurance, education, essential services, law enforcement.
• August 2028. Deferred deadline for high risk AI embedded in regulated products such as medical devices and machinery.

What it means for AI agents

The Act was drafted before autonomous agents were everywhere, but its rules reach them cleanly. An agent that calls APIs, sends emails, moves money, or touches internal systems is performing actions, and the action layer falls under the Act's logging and cybersecurity expectations. Three articles do most of the work.

• Article 12, record keeping. High risk systems must automatically log events across their lifetime, and deployers must keep those logs, generally for at least six months. For an agent, that means a real record of what it did: which model it called, what it cost, what actions it took, and when.
• Article 14, human oversight. A human must be able to understand what the system is doing, intervene, and stop it. For agents this is concrete: risky actions should wait for a person, and someone must hold a working stop button.
• Article 26, deployer obligations. Use the system as intended, assign oversight to people with the authority and competence to exercise it, keep the logs, and monitor operation.

Chains of agents make this harder, not easier. When one agent spawns another, the compliance boundary follows every agent that performs a high risk function. If you cannot say which agent did what, on whose behalf, at what cost, you cannot meet the record keeping duty.

The penalties

Fines scale to the offence: up to 35 million euros or 7 percent of global annual turnover for prohibited practices, up to 15 million euros or 3 percent for breaching most other obligations, and up to 7.5 million euros or 1 percent for supplying misleading information to authorities. Enforcement sits with national market surveillance authorities and, for the largest models, the EU AI Office.

What to do now

1. Inventory your AI. Every system, every agent, every model call path. You cannot classify what you have not listed.
2. Classify against the risk tiers. Most systems will land in minimal risk. The ones touching hiring, credit, safety, or essential services need attention first.
3. Turn on logging where the work happens. Documentation that describes controls is weaker than infrastructure that is the control. Logs generated automatically in the request path are the evidence an auditor actually wants.
4. Give agents named identities, budgets, and a stop mechanism, and put a human approval step in front of risky actions. That is Articles 12, 14, and 26 in practice.
5. Keep exports ready. When a customer, auditor, or authority asks what your agents did, the answer should be a download, not a project.

Common questions

This guide is general information, not legal advice. For decisions about your own systems, talk to counsel qualified in EU law.