Agentic AI sits squarely inside the EU AI Act's definition of an AI system, but it strains rules written mainly for outputs a person then uses. Classification must happen per capability, intended purpose drifts more easily, human oversight moves from reviewing outputs to bounding actions, logs must capture steps, and cybersecurity must cover manipulation of what the agent reads.
What does the EU AI Act require, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. It sorts AI systems by risk: prohibited practices, high-risk systems, systems with transparency obligations, and minimal risk. High-risk systems, such as those used for credit scoring of individuals or life and health insurance pricing, carry duties for providers on risk management (Article 9), data governance (Article 10), logging (Article 12), transparency to deployers (Article 13), human oversight (Article 14) and accuracy, robustness and cybersecurity (Article 15). Deployers carry duties under Article 26 and, in some cases, Article 27. Article 50 sets transparency duties for all tiers, and Article 4 requires AI literacy.
The Act's definition of an AI system covers machine-based systems that operate with some autonomy and infer from inputs how to generate outputs, such as predictions, content, recommendations or decisions, that can influence physical or virtual environments. An agent fits that comfortably. What counts is covered in what counts as an AI system when you deploy an agent.
Who does it apply to?
Providers that place AI systems on the EU market or put them into service, deployers using them in the EU, and providers and deployers outside the EU whose systems' output is used in the EU. Obligations for general-purpose AI models, applying from 2 August 2025, fall on the model's provider, not on the business that builds an agent on top of it. The deployer's general duties are summarised in what the EU AI Act requires deployers of AI agents to do.
What changes when the system acts rather than answers?
Classification moves to the capability. A model built for credit scoring has one use. An agent may answer balance queries, draft complaint letters and assess affordability. Only the last may be high-risk. Classifying the whole agent by its most benign use misses the risk; classifying it by its riskiest use over-burdens the rest. Classify each capability. Whether an agent is high-risk is covered in is an AI agent a high-risk AI system.
Intended purpose drifts. Agents are general and staff find new uses for them. A deployer that starts using an agent for a high-risk purpose the provider did not intend can take on provider duties. Capability boundaries enforced by the system are the practical defence.
Oversight shifts from outputs to actions. Article 14 assumes people can monitor, interpret and override output. With an agent that sends, books or pays, oversight has to happen before the action: deciding which actions are held for a person, and keeping the ability to stop the agent safely mid-task.
Logs must capture steps. Article 12 logs that record only a final output cannot show what the agent read, which tools it called or whether it was allowed to act.
Cybersecurity widens. Article 15's cybersecurity duty now covers attacks through content the agent reads, such as instructions hidden in an emailed document, and through excessive permissions.
Transparency covers outbound contact. Agents start conversations. Article 50's disclosure duty applies to the person on the other end.
How do you meet the Act when the system acts?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Risk classification | Each capability classified by its use; high-risk capabilities flagged | Capability register with classification |
| Intended purpose respected | Capabilities enforced by the system; out-of-scope requests refused | Refusal records naming scope |
| Risk management (Article 9) | Risks per capability, including actions that are hard to undo | Risk register per capability |
| Logging (Article 12) | Every step and verdict recorded in an append-only record | Action record per case |
| Human oversight (Article 14) | High-impact actions held for a named person; tested stop | Held-action records and stop tests |
| Cybersecurity (Article 15) | Injection testing; least-privilege access; external content cannot authorise actions | Test results and access reviews |
| Transparency (Article 50) | Disclosure at first contact, including outbound | Conversation records |
| Inventory | Register of agents and capabilities for the Act | Register entries |
The inventory row underpins the rest; see the AI agent register for the EU AI Act.
What will a market surveillance authority ask?
- Which capabilities of this agent are high-risk, and how did you decide?
- How do you stop the agent being used for purposes outside its intended use?
- Which actions does the agent take without a person, and why is that acceptable?
- Show us the record of a decision, including every step.
- How do you protect the agent against instructions hidden in what it reads?
What does the Act not settle for agents?
It does not define "agent" or set autonomy levels. It does not resolve every question about multi-agent systems, such as which agent is the AI system when several work together; treat the orchestrated system and each capability as units of analysis. It does not replace sector rules such as DORA or GDPR. Our longer argument is in the EU AI Act and agents that act, and the cross-regime map is in AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme certifies each agent to a depth and checks the depth each action needs, which matches how the Act's classification works for agents. Actions that are hard to undo sit at depth 4 and are held unless certified, external content cannot authorise a payment, and every step is filed with the bound that decided it.
Questions people ask
Is an AI agent a general-purpose AI model under the Act?
The model underneath may be. The agent built on it is an AI system, classified by its use. The model provider carries the general-purpose model duties.
Does giving an agent more autonomy make it high-risk?
Not by itself. High-risk status comes from the use, such as credit scoring. Autonomy changes how hard the oversight, logging and security duties are to meet.
Can one agent be partly high-risk?
Formally, the Act classifies systems by use, so an agent used for a high-risk purpose is a high-risk system for that use. In practice, classify each capability, apply the high-risk controls wherever a capability serves a high-risk use, and document why the others do not.