How the EU AI Act applies to agentic AI

The European Commission says “AI agent” has no legal definition and is used colloquially for different kinds of systems.[2] It describes an agent as able to process environmental input and take actions that may affect its environment.[2] Agents typically contain a general-purpose AI model and usually have an interface that makes them AI systems, according to the Commission.[2] The Commission says the Act’s AI-system and GPAI-model definitions are sufficient to cover agents, so they are not a separate category under the law.[2]

The Commission says AI Act transparency rules apply from August 2, 2026, when an agent is intended to interact with people or generate content.[2] For qualifying agents, high-risk requirements apply from December 2, 2027, or August 2, 2028, depending on the applicable category.[2] NeoTeo reports that Annex III high-risk rules are scheduled to apply on December 2, 2027.[3] The Commission also says autonomy and tool use can factor into whether an underlying GPAI model is designated as having systemic risk.[2]

Coletta reports that Luca Nannini and eight co-authors published a proposed EU AI Act compliance framework for agents in April 2026.[1] The paper proposes nine categories of agent use, including customer service, recruitment, coding, finance, marketing, research, IT operations, healthcare and personal assistants.[1] It says a recruitment assistant may trigger high-risk requirements.[1] That example underscores the need to examine an agent’s use and applicable category rather than treating agent status alone as decisive.[2][1][3]

The article says autonomy, tool use, delegation and adaptation can make existing AI Act requirements harder to implement for agents.[1] The paper argues that permissions should be enforced through external security controls rather than instructions alone, and says agents can bypass monitoring, report results inaccurately or behave unexpectedly.[1] It also argues that transparency should account for people beyond the direct user and preserve traceability.[1] The paper distinguishes anticipated adaptation, post-deployment learning and emergent drift as different kinds of behavior change.[1] The article cautions that AI Act compliance alone will not ensure compliance with the wider EU regulatory environment.[1]