The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law on artificial intelligence. It entered into force on 1 August 2024 and sorts AI systems by risk: some practices are prohibited, high-risk systems face strict requirements, some carry transparency duties, and the rest are minimal risk. It applies to AI agents according to what they are used for.
Why does the EU AI Act matter for AI agents?
The Act does not regulate "agents" as a category. It regulates AI systems by their use. An agent that answers delivery questions sits in a very different place from one that assesses whether a person qualifies for credit. Firms that classify their agents once, as "AI", and stop there will either over-engineer harmless uses or miss the ones that carry heavy duties. Whether the EU AI Act applies to AI agents works through that question.
Agents also stretch some of the Act's ideas. Human oversight, record-keeping and accuracy were written with systems that recommend in mind. When the system acts, those duties have to be met at the moment of action. That is the subject of the EU AI Act and agents that act.
How does the Act work in practice?
| Risk tier | What it means | Agent example |
|---|---|---|
| Prohibited | Practices banned outright | Manipulative techniques that cause significant harm |
| High-risk | Strict requirements on providers and deployers | An agent assessing creditworthiness of individuals |
| Transparency | People must be told they are dealing with AI; some generated content must be marked | A customer service agent in chat |
| Minimal | No specific obligations beyond general ones | An internal agent tidying meeting notes |
High-risk requirements include risk management (Article 9), data governance (Article 10), automatic logs (Article 12), information to deployers (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15). Deployers have their own duties under Article 26, and all providers and deployers must address AI literacy under Article 4.
Obligations phase in over several years. Prohibitions applied from 2 February 2025 and general-purpose AI model obligations from 2 August 2025. The dates for high-risk obligations have been subject to proposed changes, so check the current position.
What does an example look like?
An online retailer runs a customer service agent. It is not high-risk, but under Article 50 customers must be told they are interacting with an AI system, which the retailer does at the start of each chat. The same retailer's parent company also runs a consumer finance arm with an agent that drafts credit decisions. That one falls in Annex III as high-risk, bringing the full set of deployer obligations. The EU AI Act for AI agents in customer service covers the first case in detail.
How is the EU AI Act different from GDPR?
GDPR governs personal data: whether you may process it, how, and what rights people have. The AI Act governs AI systems: how they are built, documented, overseen and used, whether or not personal data is involved. Most agents in regulated firms are covered by both. GDPR's Article 22 on automated decisions and the AI Act's Article 14 on human oversight address related concerns from different angles.
How do you start?
List every AI system and agent you use, classify each by use, and record the reasoning. An AI agent register for the EU AI Act gives a format, and the EU AI Act compliance checklist for AI agents lists the follow-on steps. For the wider picture, see our guide to AI agent regulation.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the EU AI Act apply to companies outside the EU?
It can. Providers placing AI systems on the EU market, and providers and deployers outside the EU whose systems' output is used in the EU, may be in scope.
Is every AI agent high-risk?
No. Most agents in customer service and back-office work are not. High-risk status depends on the use, such as credit scoring of individuals or certain insurance pricing, listed in Annex III.