Not as agents, in most places. No major market runs a general register of AI agents. But some regimes reach them indirectly: the EU AI Act requires registration of certain high-risk systems, DORA requires a register of ICT arrangements, and model risk rules expect an inventory. Keep your own register regardless.
What do the rules require, in plain words?
EU AI Act. Providers of high-risk AI systems listed in the Act's annex of high-risk uses must register those systems in an EU database before placing them on the market or putting them into service. Certain deployers, notably public authorities, must also register their use. An agent that is part of a high-risk system, such as one used for credit scoring of individuals, may fall in scope through that system. The details are in the AI agent register for the EU AI Act.
DORA. EU financial entities must keep a register of information on all contractual arrangements for ICT services, and make it available to their competent authority. Agent platforms and model providers belong in it. See the DORA register of information and AI agent providers.
Model risk rules. Banking supervisors expect firms to keep an inventory of the models they use. The PRA's SS1/23 principles in the UK, the US interagency guidance SR 11-7 and OSFI's Guideline E-23 in Canada all expect firms to know what models they run and how they are governed. An agent that relies on models, or is one, belongs in that inventory.
Outsourcing and notification rules. Many supervisors expect notice of material outsourcing or significant changes to how critical services are delivered. An agent platform supporting an important function may trigger these.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
| Regime | Who registers or records | What |
|---|---|---|
| EU AI Act | Providers of listed high-risk systems; some public-sector deployers | The system, in an EU database |
| DORA | EU financial entities | Arrangements with ICT providers, including agent vendors |
| Model risk rules | Banks and similar firms in markets that apply them | Internal model inventory, available to supervisors |
| Outsourcing rules | Regulated firms, depending on market | Notice of material arrangements |
| Your own governance | Every deployer | An internal agent register |
What changes when the system is an agent?
Agents change faster than most systems. Capabilities are added, depth widens, models are swapped. A register entry made at launch can describe an agent that no longer exists six months later. Whatever you register externally, the internal register must track each agent's capabilities, depth, model, sources, owner and certificate dates, and flag when a change might affect an external registration.
Agents can also help answer the information requests that registers generate, as long as a person checks and sends the response; see whether an AI agent can answer regulator information requests.
How do you meet it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know what you run | Internal register of every agent | Register, using an AI agent inventory register template |
| Classify each agent | Risk category under the EU AI Act; function criticality under DORA | Classification per agent |
| External registration where needed | Register high-risk systems; record ICT arrangements | Registration references |
| Keep it current | Changes to capabilities, depth or provider trigger a register review | Change log |
| Respond to requests | Named owner for each register | Responses on file |
What does that look like in practice?
Say a bank in Ireland runs eight agents. Its internal register lists all of them. Two support consumer credit decisions and are part of a high-risk system; the vendor, as provider, registers that system in the EU database, and the bank checks the reference. All eight run on one platform with one model provider, both recorded in the bank's DORA register of information. The model risk team holds the agents in its model inventory with their certification results. When the bank adds a model provider for one agent, the change log triggers updates to the DORA register and the model inventory the same week.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Do we need to tell our regulator before deploying an agent?
There is rarely a general duty to do so, but outsourcing, change-notification or supervisory expectations may apply depending on the function and market. Many firms brief their supervisor informally on significant deployments.
Is an internal register required by law?
Not in all markets as such, but several regimes assume you have one, and you cannot meet DORA, model risk or AI Act duties without knowing what you run.
Who should own the register?
A central function, such as operational risk or the AI governance lead, with each agent's owner responsible for keeping their entry accurate.