It depends on use, not on being an agent. An AI agent is high-risk under the EU AI Act if one of its uses falls in an Annex III area, such as credit scoring of individuals or life and health insurance pricing, or if it is a safety component of a regulated product. A support agent usually is not.
What does the EU AI Act require for classification?
The Act sorts AI systems by risk. In substance, a system is high-risk by one of two routes:
- Product route. It is a safety component of, or itself, a product covered by EU product safety legislation that requires third-party conformity assessment, such as certain medical devices or machinery.
- Use route. It is used in one of the areas listed in Annex III. For businesses, the most relevant include creditworthiness assessment and credit scoring of natural persons, risk assessment and pricing for life and health insurance, recruitment and decisions about workers, access to education, and access to certain essential public services.
The Act includes a filter for Annex III uses. A system in a listed area is not high-risk if it does not pose a significant risk of harm, for example because it performs a narrow procedural task, improves the result of an activity a person has already completed, detects patterns without replacing human assessment, or performs a preparatory task. The filter does not apply where the system profiles individuals, which remains high-risk. A provider relying on the filter must document its assessment.
High-risk systems carry the duties in Articles 9 to 15 for providers and Article 26 for deployers. Our explainer on what a high-risk AI system is covers those duties.
Who does it apply to?
Providers that place AI systems on the EU market or put them into service, and deployers using them in the EU. A firm that builds an agent for its own use is both provider and deployer. A firm that takes a vendor's agent and puts it to a high-risk use, or substantially modifies it, can become its provider.
What does classification mean when the system is an agent?
Agents complicate classification in three ways.
One agent, several uses. An agent at a lender might answer product questions, collect application details and draft credit recommendations. The first two are not Annex III uses. The third is. Classification follows the use, so this agent is high-risk for its credit capability.
Uses change without code changes. An agent's purpose is set by its brief. Add one sentence asking it to "suggest a credit limit", and it now performs creditworthiness assessment. The legal category can change through an edit by a business user.
The filter is easy to misapply. It is tempting to say an agent only performs a "preparatory task" because a person signs off. But if the person relies on the agent's assessment and rarely departs from it, the agent is shaping the outcome. And any agent that profiles individuals in an Annex III area stays high-risk.
Two common cases are covered in our sister pieces: whether a customer support chatbot is high-risk (usually not) and whether a credit scoring agent is high-risk (usually yes).
How do you classify and control it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Classify by use | Each agent capability assessed against Annex III and the product route | Classification record per capability |
| Apply the filter correctly | Filter reasoning documented, with a check that no profiling is involved | Signed filter assessment |
| Catch changes in use | Any change to an agent's brief re-runs classification | Change records with classification sign-off |
| Separate capabilities | High-risk capabilities isolated so duties apply where needed without burdening the rest | Capability register; access rules |
| Meet high-risk duties | Risk management, data governance, logs, oversight, accuracy for high-risk capabilities | Article 9 to 15 evidence |
| Deployer duties | Use per instructions, oversight, monitoring, logs, informing affected people where required | Article 26 evidence |
| Role clarity | Provider and deployer roles recorded per agent | Role register |
The risk management system is where classification turns into work; see EU AI Act Article 9 risk management for AI agents.
What will a supervisor or auditor ask?
- Which of your agents perform any Annex III use, even as one capability among many?
- How did you decide the filter applies, and does any of those agents profile individuals?
- What stops a business user changing an agent's brief into a high-risk use?
- Are you provider, deployer or both for each agent?
- For high-risk capabilities, where is the evidence for each required duty?
What does classification not cover?
It does not settle other duties. Article 50 transparency applies to systems that interact with people whatever their risk class, and Article 4 AI literacy applies broadly. GDPR applies to all personal data processing. Prohibited practices are a separate test. Application dates for high-risk obligations have been subject to proposed changes, so confirm the timetable. A full screening sequence is in the EU AI Act risk classification checklist, and the wider map in AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, authority is granted per capability, so a high-risk capability, such as drafting a credit recommendation, has its own role scope, sources and certificate. A change to the agent's brief that adds a capability creates a new candidate, which must be certified by Attest before it can act. That makes a silent change in use visible.
Questions people ask
Is an agent built on a general-purpose model automatically high-risk?
No. The general-purpose model has its own duties, borne by its provider. The agent's classification depends on its use.
Does a human sign-off take a credit agent out of high-risk?
Not by itself. If the agent assesses creditworthiness of individuals, it is in Annex III. The filter might apply to a purely preparatory task, but where the agent profiles applicants it remains high-risk.
Can an agent be high-risk for some customers and not others?
Classification follows the intended purpose. If an agent's credit capability is used only for business customers, it is outside the Annex III item on natural persons, though sole traders may count as individuals.