Agentic AI and the EU AI Act: What the Rules Actually Say About Autonomous AI Agents

Search the EU AI Act for the phrase "AI agent" and you will not find it. There is no Article on agents, no Annex listing them, no definition in Article 3. Teams building autonomous, tool-using systems have taken this as breathing room.

It is not.

The European Commission's own position is that no new category is needed, because the existing ones already reach agents. Its AI Act Service Desk puts it plainly: the term "AI agent" is not legally defined, agents are not a separate category, and "the definitions of an AI system in Article 3(1) and of a GPAI model in Article 3(63) are sufficient to cover AI agents.^[1]"

So the question is not whether the Act applies to your agent. It is which of the existing mechanisms bite, and when. There are four:

1. Article 50(1) transparency - live since 2 August 2026, with no grace period. This is the one that matters today.
2. Article 25 provider flips - build an agent on someone else's model and you may become the legally responsible provider, with a rewritten allocation rule and a new fine tier since July 2026.
3. High-risk classification of agentic architectures - the Commission's draft guidance treats a coordinated set of agents as one system, which closes the obvious workaround.
4. Systemic-risk designation upstream - autonomy and tool use feed directly into whether the underlying model is designated a model with systemic risk.

This guide walks through each, separates what is binding from what is still draft, and ends with a checklist.

A warning about the source you are most likely to find first

If you search for official guidance on AI agents, the Commission's AI Act Service Desk FAQ is the top result and the most authoritative-looking. Use it carefully.

The page carries no publication date, and it still describes high-risk obligations as applying "from 2 August 2026." That is no longer correct. Regulation (EU) 2026/1744 - the Digital Omnibus on AI, in force since 27 July 2026 - moved those dates to 2 December 2027 and 2 August 2028. The FAQ appears not to have been refreshed.

The substance of the FAQ on definitions and scope is still sound. Its dates are not. The same caution applies to several widely-cited unofficial trackers: check the "last updated" line before you rely on any AI Act timeline published before August 2026.

1. Your agent is already an "AI system"

The threshold question is whether an agent is an AI system under Article 3(1) or merely a model under Article 3(63). It matters enormously, because Article 50 binds systems and not models.

The Commission's answer: "Typically, an AI agent will contain at least a general-purpose AI (GPAI) model, and constitute an AI system as it will usually have some form of interface, which is considered a system component (recital 97).^[1]"

Read that carefully. The interface - the scaffolding, the tool-calling layer, the orchestration harness - is what converts a model into a system. Which means the thing you built on top of the model is the regulated artefact, not the model itself.

This has a consequence teams routinely get wrong. Your model vendor's compliance posture does not transfer to you. The Article 50 Guidelines are explicit that Article 50 does not apply to GPAI models at all; model providers are merely "encouraged" to implement model-level marking to help downstream system providers. The duty sits with whoever ships the agent.

The Commission is candid that its thinking here is early: "Given that developments related to AI agents are recent and fast evolving, the European Commission's regulatory considerations are only preliminary at this stage.^[1]" Preliminary considerations, however, are not the same as absent obligations.

2. Article 50(1): the obligation that is live right now

On 20 July 2026 the Commission adopted the final Guidelines on transparency obligations for providers and deployers of AI systems. They contain the single most important paragraph yet written about agents - paragraph 31:

"AI agents are covered by Article 50(1) if they are capable of interacting with the persons instructing them or with other natural persons in the execution of the tasks (e.g. making bookings, managing correspondence, negotiating or concluding contracts, executing purchases, etc). AI agents must be designed and developed in such a way that they disclose both their artificial nature and the person on whose behalf they are acting, considering the need for transparency of the origin and the delegation of authority and accountability for the consequences of their actions.^[2]"

Two disclosures, not one. Every consumer-facing chatbot guide tells you to disclose that the user is talking to a machine. Paragraph 31 goes further: the agent must also disclose on whose behalf it is acting. If your agent emails a supplier to renegotiate terms, the supplier must be able to tell both that it is an AI and whose AI it is.

Design-time, not runtime

The Guidelines anticipate the obvious engineering objection - that you often cannot know in advance whether a given execution path will surface to a human. Their answer removes the excuse. Where the provider cannot determine this in advance, "the agent should be designed at the architecture level, and instructed, to disclose itself as such in every situation where it is reasonably likely that the agent may interact with a natural person.^[2]"

This is an architectural requirement. A disclosure bolted onto one entry point will not satisfy it if the agent can reach humans through five others.

Disclosure to the person instructing the agent

Separately, the agent must disclose itself to its own principal "at key steps (e.g. at the point of authorisation, reporting, validation..., including when the deployed AI agent receives, processes, or relies upon outputs generated by other AI systems rather than directly by a natural person) and at every new interaction.^[2]"

Note the parenthetical. When your agent acts on another system's output rather than on a human instruction, that is a moment requiring disclosure. In a multi-agent pipeline, most steps are of this kind.

On frequency, paragraph 40 says a single up-front notification usually suffices - but periodic, context-aware reminders are "likely to be necessary... when there is a need to ensure awareness and control over the actions of AI agents,^[2]" and in higher-risk contexts such as financial advice, insurance, legal assistance, health advice and complaints handling, and where users may be vulnerable.

What is genuinely out of scope

The Guidelines draw sensible boundaries, and they are worth knowing precisely because they let you narrow the work:

Agent behaviour	Article 50 treatment
Agent interacts with a natural person	In scope - Art 50(1) disclosure required
Backend agent-to-agent traffic, outputs not intended to reach natural persons	Out of scope (paras 30(iv), 68)
Intermediate reasoning steps, chain of thought	Not synthetic content, no marking required (para 63)
Non-perceptible actions, e.g. a web request or browser action	Not synthetic content, no marking required (para 63)
Agent generates synthetic audio, image, video or text for a person	In scope - Art 50(2) marking required (para 58)

So machine-to-machine orchestration is not a transparency event. The moment an output is intended to reach a person, it is.

The dates

Article 50 was not deferred by the Digital Omnibus. It has applied since 2 August 2026. The only relief is a narrow transitional rule in the new Article 111(4): providers of synthetic-content generators that were already on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) machine-readable marking requirement.

That transition covers marking only. The Guidelines confirm at paragraph 153 that the Article 50(1) interaction-disclosure duty binds from 2 August 2026 with no grace period at all.

Enforcement powers arrived on the same date: the AI Office over GPAI model providers, and national market surveillance authorities with full powers over Article 50. As of this writing no enforcement action has been brought against an agentic system. That is a statement about elapsed time, not about exposure.

3. Who is the provider? Article 25 and the vendor-terms trap

Most agent builders do not train models. They compose them. That composition is exactly what Article 25 governs, and the Digital Omnibus rewrote the allocation rule in a way that cuts both ways.

How you become a provider

The Commission's draft high-risk guidelines set out three triggers. A distributor, importer, deployer or other third party takes on provider obligations under Article 25(1) if it:

• puts its name or trademark on a high-risk AI system already placed on the market;
• makes a substantial modification to a high-risk system that remains high-risk; or
• modifies the intended purpose of a system - including a general-purpose AI system - that was not classified high-risk, such that it becomes high-risk under Article 6.

The third trigger is the one that catches agent builders. Take a general-purpose model that carries no high-risk classification, wire it into a workflow that screens job applicants, and you have modified its intended purpose into a high-risk use. You are the provider.

The Article 50 Guidelines make the same point in the transparency context: whoever offers "a generative or interactive AI application (e.g. a chatbot, image generator, AI agent) on the Union market under its own name or trademark^[2]" is the provider - free or paid, established in the EU or not.

The rewritten Article 25(2)

Here is the commercially significant change. Under the Digital Omnibus, once a third party becomes provider, "the provider that initially placed the AI system on the market shall no longer be considered to be a provider of that specific AI system."

Clean handover of liability - to you. In exchange, the initial provider owes you cooperation: technical documentation sufficient to assess Article 16 compliance, disclosure of "known limitations and failure modes," and "targeted technical access, including for testing and validation."

But read the exception, because it is the whole ballgame: those duties do not apply where the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system.

Practical consequence: go and read your model vendor's terms of service today. If they contain that specification - and many will, because it is now a cheap way to shed downstream obligations - you become the provider and you get no documentation, no failure-mode disclosure, and no technical access. You would be assembling an Annex IV technical file for a system whose internals you cannot inspect.

This belongs in procurement, not just in legal review. Whether a vendor has made that specification is now a hard technical dependency for anyone planning to deploy agents in a high-risk use case.

To sharpen the incentive, the Omnibus also inserted a new Article 99(4)(da): breaches of the Article 25(2) and 25(4) value-chain duties are expressly fineable in the tier of up to €15 million or 3% of worldwide annual turnover.

The Commission has said it is preparing separate Guidelines on responsibilities along the AI value chain under Article 25. No publication date has been announced.

4. When agentic architecture makes you high-risk

The natural engineering response to high-risk classification is decomposition: split the pipeline into components, none of which individually performs the regulated task. The Commission has seen this coming.

Paragraph 75 of the draft Annex III guidance:

"Where several AI systems form part of a more complex AI system, so that their combined intended purpose or joint outputs materially influence an individual decision, the combined configuration is treated as a single AI system for the purpose of high-risk classification. To avoid circumvention... split architectures are assessed as a whole... This principle also extends to complex, interconnected setups like agentic AI systems that coordinate and interact through linked actions as long as these linked actions or components serve in conjunction an intended high-risk purpose.^[3]"

Three further passages close the remaining exits:

The Article 6(3) filter does not survive orchestration. A component that would otherwise qualify for the narrow-task exemption "cannot benefit from that mechanism and will still be classified as high-risk if it forms part of a complex system where its combined intended purpose or joint outputs materially influence an individual decision within a high-risk use case, or where the AI system is part of complex interconnected systems, such as agentic AI systems^[3]" (para 90).

Human oversight is not a downgrade. "The provider cannot exempt and categorise an AI system as 'low risk' simply by adding to it a requirement for human involvement^[3]" (para 71). Oversight is an Article 14 obligation you owe once classified - not a way to avoid classification.

Autonomy is structurally incompatible with the "improve a previous human activity" filter. Under Article 6(3)(d), "the AI system should not replace, nor autonomously perform, the human activity" (para 95). An agent that acts on its own is, by definition, outside this exemption.

Two worked examples

A recruitment agent. Suppose an agent parses applications, ranks them, and hands a shortlist to a recruiter who makes the call. Annex III point 4(a) covers systems intended to evaluate candidates, and the draft guidance reads it broadly: "It suffices that it appreciably influences the decision-making process, for example by laying out shortlists, prioritising certain applicants^[3]" (para 254). Shortlisting is enough. High-risk.

A credit agent. Annex III point 5(b) covers evaluating the creditworthiness of natural persons. The draft guidance confirms that assessing a company's creditworthiness is not high-risk on that basis - including where the company owner backs the loan (paras 73-74, 296). An agent doing B2B credit assessment is in a materially different position from one scoring consumers.

These guidelines are still draft

Published 19 May 2026, with a targeted consultation that ran until 23 July 2026. The Commission has indicated the final versions will be adopted by the end of 2026. Design against them - the direction of travel is unambiguous - but do not quote them as settled law.

5. "Agentic AI" enters binding EU law

One detail from the Digital Omnibus has gone almost unnoticed. Alongside the deadline changes, the Regulation inserts a set of AI-system-type codes that conformity assessment bodies must use when applying for designation under Article 29. One of them is:

AIH 0401 - "AI systems based on other emerging AI technologies not covered by other codes, including Agentic AI.^[4]"

As far as we can establish, this is the first appearance of the words "Agentic AI" in binding EU legislative text. It is a scope code for notified body designation, not a substantive obligation, and it creates no new duties. But it tells you something: the EU expects there to be conformity assessment bodies with declared competence in agentic systems, and it has built the administrative plumbing for that before the obligations arrive.

6. The deadlines that actually apply

Date	What applies
2 August 2026	Article 50 transparency (in force, no grace period for Art 50(1)); AI Office enforcement over GPAI model providers; national market surveillance powers over Article 50
2 December 2026	Article 50(2) machine-readable marking for synthetic-content generators placed on the market before 2 Aug 2026 (Art 111(4)); new Article 5 prohibitions on non-consensual intimate imagery and AI-generated CSAM
2 December 2027	Chapter III Sections 1-3 for Annex III / Article 6(2) high-risk systems
2 August 2028	Chapter III Sections 1-3 for Annex I / Article 6(1) high-risk systems embedded in regulated products

The deferral is the point most often misread. The Digital Omnibus postponed Chapter III - classification, the Article 8-15 requirements, and provider obligations. It did not postpone Article 50. If your agent talks to people, you have an obligation that is live today and a separate set that arrives in December 2027.

7. What is still genuinely unsettled

Being honest about the gaps is more useful than pretending the picture is complete.

• No official guidance on Articles 12 and 14 for agents. Article 12 (record-keeping and logging) and Article 14 (human oversight) were not amended by the Digital Omnibus, and there is no EU guidance on how either applies to a tool-using agent that takes hundreds of actions per task. What counts as an adequate log for an agent? What does "effective oversight" mean when a human cannot review every step? Nobody official has said. Anyone telling you otherwise is extrapolating.
• Article 25 value-chain guidelines are being prepared, with no announced date.
• Final high-risk classification guidelines are expected by end-2026.
• The nearest official signal on agent traceability comes from the Commission's own January 2026 report on agentic AI, which observes that multi-step autonomous actions "blur responsibility across systems and tools, challenging existing compliance frameworks and requiring continuous traceability and meaningful human oversight.^[5]" That is a policy observation, not a specification - but "continuous traceability" and auditable control points are a defensible design target while the guidance catches up.
• Evaluation methodology is being built now. The AI Office's €9 million tender for technical support on GPAI safety, published in July 2025, includes a lot dedicated to "cross-cutting support for conducting agentic evaluations, focusing on models' autonomous behaviour in dynamic or open-ended tasks.^[6]"
• Agent identity may be solved outside the AI Act. Footnote 21 of the Article 50 Guidelines points to electronic attestations of attributes under eIDAS, EU Digital Identity Wallets and the proposed European Business Wallets as means of verifiably establishing an agent's "identity, attributes, and authorisations." If you need to prove on whose behalf an agent acts - and paragraph 31 says you do - that is where the infrastructure is likely to come from.
• Data protection regulators are moving faster than AI regulators. Spain's AEPD published dedicated guidance on agentic AI in February 2026, approaching it through the GDPR. It remains the only national-authority document on agents we can identify, and it is worth reading even outside Spain.

Checklist for shipping agents into the EU

1. Inventory your interaction surfaces. List every path by which your agent's output can reach a natural person - including paths you did not design for. Article 50(1) attaches to reasonable likelihood, not intent.
2. Implement dual disclosure at the architecture level. Artificial nature and the principal on whose behalf the agent acts. Not a banner on one entry point.
3. Add checkpoint disclosures at authorisation, reporting and validation, and at every new interaction - including when the agent is acting on another system's output.
4. Read your model vendor's terms for the Article 25(2) specification. If they have specified that their system is not to be changed into a high-risk system, you inherit provider obligations without the cooperation duties. Escalate that to procurement.
5. Assess your architecture as a whole, not component by component. If the combined outputs materially influence an individual decision in an Annex III area, expect the whole configuration to be treated as one high-risk system.
6. Stop treating human review as a classification argument. Keep it - it is an Article 14 requirement - but do not build your risk assessment on it.
7. Start logging as though Article 12 already applied. No guidance exists for agents, the requirement arrives in December 2027, and retrofitting traceability into a running agent platform is considerably harder than designing it in.
8. Date-stamp every source in your compliance file. A material share of the AI Act guidance now circulating pre-dates the Digital Omnibus and states deadlines that no longer exist.

The AI Act does not have an agent problem. It has agent obligations that are distributed across provisions written before the word was in common use - which is a harder thing to find, and no easier to ignore.