There is no single fairness article in the EU AI Act. Duties against bias and discrimination run through it: data must be examined for bias, risk management must cover fundamental rights, oversight must guard against automation bias, and some deployers must assess rights impacts. For AI agents, fairness has to be tested on actions and outcomes, not only on outputs.
Where do fairness duties appear in the Act?
Fairness surfaces in at least six places, in substance:
- Prohibited practices. Exploiting the vulnerabilities of people due to age, disability or a specific social or economic situation, in ways that materially distort their behaviour and cause significant harm, is banned. So are certain forms of social scoring that lead to unjustified detrimental treatment.
- Risk management (Article 9). Providers of high-risk systems must identify risks to fundamental rights, including non-discrimination, and consider impacts on vulnerable groups.
- Data governance (Article 10). Datasets must be examined for possible biases likely to lead to discrimination, with measures to detect, prevent and reduce them, and may exceptionally use special category data for that purpose.
- Accuracy (Article 15). Systems that keep learning must avoid biased outputs feeding back into future inputs.
- Human oversight (Article 14). Overseers must be able to remain aware of automation bias, the tendency to over-rely on the system's output.
- Fundamental rights impact assessment (Article 27). Public bodies and deployers of credit scoring and life and health insurance pricing systems must assess risks of harm to the groups affected.
The high-risk list itself points to where unfairness does most damage. Annex III includes creditworthiness assessment and credit scoring of individuals, and risk assessment and pricing in life and health insurance. Our EU AI Act risk classification checklist shows how to tell whether an agent falls in.
Who carries the duties?
Providers carry the design-stage duties: data examination, risk management, accuracy. Deployers carry the use-stage duties: oversight, input data relevance, monitoring, and the rights assessment where it applies. Every operator must avoid the prohibited practices.
Being outside the EU does not remove the duty where the output is used in the EU, as EU AI Act for non-EU companies deploying AI agents explains. And equality and anti-discrimination law applies to any business whatever the AI Act says, including to agents used only internally, such as in hiring.
How does an agent create unfair outcomes?
A scoring model discriminates through its features and training data. An agent can do that and more, because it acts in a process:
- Uneven effort. An agent that requests further documents, or escalates for review, more often for some groups than others imposes delay and burden unevenly, even if final decisions look balanced.
- Summaries that drop what matters. An agent summarising income may treat irregular, cash or multiple-source earnings as noise. People with that kind of income are not spread evenly across groups.
- Language and channel. An agent tested on fluent written English may misread messages in other languages, dialects or from assistive technology, then refuse or misroute them.
- Tone and persistence in collections or retention. An agent that negotiates may be more persuasive with people who are more vulnerable, which edges towards the exploitation the Act prohibits.
- Proxy inputs. Postcode, device type or time of contact can stand in for protected characteristics in an agent's reasoning without anyone choosing that.
Each of these is a behaviour of the agent in a process, which is why fairness tests must look at the whole sequence of actions, not just the final recommendation.
How do you test agents for discriminatory outcomes?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Examine data for bias | Test cases drawn from your own operation, covering the groups the agent serves | Test set description with group coverage |
| Fundamental rights risk | Outcome tests by group on each capability: approvals, refusals, escalations, document requests, time to resolution | Results by group with thresholds and actions |
| Avoid exploiting vulnerability | Collections and retention capabilities barred from pressure tactics; vulnerability signals trigger a person | Brief restrictions; records of escalations on vulnerability |
| Counter automation bias | Approvers shown sources and reasons, not only a recommendation; seeded errors to test them | Override rates; detection rates on seeded cases |
| Watch for drift | Monthly outcome review by group from the action record | Monitoring reports and remediation |
| Rights impact assessment | FRIA where required, naming groups more exposed | Signed assessment |
Testing needs care with data. You often do not hold protected characteristics, and collecting them raises its own GDPR questions. Options include testing on constructed cases that vary one attribute at a time, using lawful proxies at aggregate level, and the Act's narrow allowance for providers to process special category data for bias correction with safeguards.
Firms operating in Singapore will find a more prescriptive method in the MAS FEAT fairness assessment for AI agents, and the US approach differs again, as set out in how US AI regulation differs from the EU AI Act.
What will a supervisor or auditor ask?
- Which groups could this agent treat differently, and how did you decide?
- Show outcome tests by group for each capability, not just final decisions.
- How do you detect and handle vulnerable customers?
- What do approvers see, and how often do they disagree with the agent?
- What changed after your last fairness review?
What does the Act not cover on fairness?
It does not define fairness metrics or acceptable disparities. It does not replace equality law, consumer protection law or GDPR's fairness principle, all of which apply in their own right. Its high-risk duties do not reach most agents, so a firm relying only on the Act would leave many agents untested. Our view is that any agent that decides who gets what, or how quickly, deserves outcome testing whatever its tier. For the full set of rules, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is equal approval rates across groups enough to show fairness?
No. Agents can treat groups differently in effort, delay and tone while final outcomes look similar. Test the steps as well as the end result.
Can we use protected characteristics to test for bias?
Sometimes, with care. The Act allows providers of high-risk systems to process special category data for bias detection under strict safeguards, and GDPR still applies. Constructed test cases often avoid the need.
Do fairness duties apply to an internal HR agent?
Uses such as recruitment and decisions on promotion or termination are among those the Act lists as high-risk, and employment law applies regardless. Treat any agent that screens or ranks people as one that needs fairness testing.