AI Agents and the EU AI Act: Which Rules Apply

The EU AI Act regulates AI agents, but not as a category of their own. The Act (Regulation (EU) 2024/1689) does not define the term. An agent is regulated as what it is: usually an AI system built on a general-purpose AI model. The same rules therefore apply as for any other AI system: the prohibitions, the transparency duties, the high-risk obligations if the use falls into one of the listed areas, and in every case the AI literacy measures. What changes with agents is not the law but the care needed to comply with it, because an agent acts: it calls tools, changes data and sends messages.

This article is general information, not legal advice. The European Commission calls its own considerations on agents preliminary, and guidance will keep developing. For decisions with legal consequences, read the official text and consult qualified counsel.

What the European Commission says about AI agents

The most direct official answer is in the FAQ of the Commission's AI Act Service Desk, under "How are AI agents addressed within the AI Act?". In summary:

• "AI agent" has no legal definition. The Commission notes that the term is used colloquially and often inconsistently. The common ground is that an agent receives and processes input from its environment and executes actions based on it, for example through function calls.
• Agents are not a separate category. An agent typically contains at least one general-purpose AI model and constitutes an AI system. The definitions of AI system and general-purpose AI model in Article 3 are considered sufficient to cover agents.
• The rules for systems and models apply. The Commission explicitly names the prohibitions on harmful manipulation and on exploiting vulnerabilities, the transparency rules in Article 50 and the Chapter III requirements where an agent is high-risk.
• Autonomy matters for the most capable models. The level of autonomy and tool use can play a role in classifying a general-purpose model as one with systemic risk. That concerns the companies developing the models, not the businesses using them.
• The position is preliminary. The AI Office continues to monitor agents and will consider further measures if needed.

Which rules apply to an agent today

Rule	When it affects an agent	Since or from
AI literacy (Article 4)	Whenever your staff use or oversee agents	2 February 2025
Prohibited practices (Article 5)	If the agent could harmfully manipulate people or exploit their vulnerabilities, among other practices	2 February 2025
Transparency (Article 50)	If the agent interacts with people or generates content	2 August 2026
High-risk, Annex III (Chapter III)	If the agent is used in areas such as employment, education, credit or essential services	2 December 2027
High-risk in regulated products, Annex I	If the agent is a safety component of a regulated product	2 August 2028
GDPR	Whenever the agent processes personal data	In force

The high-risk dates reflect the AI Omnibus, in force since 27 July 2026, as published by the European Commission. They can change again, so check them before you plan. Our guide to the EU AI Act risk categories explains each tier with examples.

Classify the use, not the technology

Calling something an agent says nothing about its risk. The purpose decides:

Agent	Purpose	Likely classification
Internal research assistant	Search and summarise company documentation	Minimal risk
Customer service agent	Answer enquiries and open tickets	Transparency: people must know they are dealing with an AI
Sales agent	Draft and send outreach emails	Transparency depending on the case, plus data protection and marketing rules
Recruiting agent	Rank or reject applications	High-risk (employment)
Credit agent	Assess the creditworthiness of individuals	High-risk (credit)
Purchasing agent	Compare offers and prepare orders for approval	Minimal risk, with internal spending controls

Agents have one trap of their own: their purpose can widen without anyone deciding it. An agent with access to email, the CRM and the HR tool can end up evaluating people because of one vague instruction. That is why it pays to write down what each agent is for and to limit its tools to that purpose. The EU AI Act risk checker gives a first orientation for each use.

Provider or deployer?

The AI Act assigns obligations by role:

• If you use an agent offered by a software vendor, you are the deployer. This is the most common case.
• If you build your own agent on a model's API and put it into service under your name, you can be the provider of that AI system, even though the model comes from someone else.
• If you change the intended purpose of a system so that it becomes high-risk, or substantially modify a high-risk system, you take on the provider's obligations (Article 25).

The third point matters most for agents, because they are easy to reconfigure: adding a tool or changing the instructions can be enough to change the purpose. Our article on EU AI Act deployer obligations covers both roles in detail.

If the agent is high-risk

When the use falls into a high-risk area, the AI Act contains requirements that map directly onto typical agent problems:

• Human oversight. High-risk systems must be designed so that people can oversee them effectively, which includes being able to intervene in or interrupt the system. As a deployer, you must assign that oversight to people with the competence, training and authority to do it.
• Logs. High-risk systems must automatically record relevant events, and deployers must keep the logs under their control for at least six months unless other law provides otherwise.
• Use according to instructions. You must use the system in line with the provider's instructions, which limits the freedom to hand the agent new tasks.
• Informing workers and affected people. Before a high-risk system is used at the workplace, workers' representatives and the affected workers must be informed.

For an agent, human oversight cannot mean reading a summary at the end. You have to decide at which point of its run the agent stops and waits for approval; see human-in-the-loop AI.

Data protection: the other framework that always applies

The AI Act does not replace the GDPR. With agents, three points deserve attention:

• Automated decisions. Article 22 GDPR gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, with narrow exceptions. An agent that rejects an application with nobody involved is squarely in this territory.
• Data minimisation. An agent with broad access to internal systems processes more personal data than the task needs. Limit access to what the task requires.
• Impact assessment. Where processing is likely to result in a high risk for individuals, the GDPR requires a data protection impact assessment. Talk to your data protection officer before connecting an agent to customer or employee data.

Controls worth having even where the law does not require them

Most agents in a business will not be high-risk. Even so, an agent that acts can cause very concrete damage: a duplicate order, an email to the wrong customer, a deleted record. These controls are good practice in any case:

1. A written purpose. One sentence per agent: what it is for and what it is not for.
2. Least privilege. Only the tools and permissions the purpose requires; read-only access wherever it is enough.
3. Human approval before anything irreversible. Payments, messages to customers, changes to master data and any decision about people.
4. Step and budget limits. A maximum number of iterations and of spend per task.
5. An action log. Every tool call and its result, so you can reconstruct what happened.
6. Read content is not a command. An email or a web page can contain instructions aimed at the agent. What the agent reads must not trigger actions without a check.
7. A named owner. Someone who reviews the logs and can switch the agent off.
8. An inventory entry. Each agent, with its purpose and tools, in your AI inventory.

Before you build an agent, ask whether you need one: many processes work better, and with less risk, as a workflow with fixed steps. We compare the two in AI agent vs. AI workflow.

Checklist

• Every agent has a written purpose and an owner.
• You have classified each use: prohibited, high-risk, transparency or minimal risk.
• You know whether you are provider or deployer of each agent.
• People who talk to the agent know it is an AI.
• The agent does not decide about people without human review.
• Its permissions are limited to what the purpose requires.
• Irreversible actions need approval.
• Actions are logged and someone reviews the logs.
• Staff who use or oversee the agent have been trained.
• You review the classification whenever you add a tool or change the instructions.

Sources

• European Commission, AI Act Service Desk: How are AI agents addressed within the AI Act?
• EUR-Lex: Regulation (EU) 2024/1689 (AI Act)
• European Commission: regulatory framework for AI and application timeline
• EUR-Lex: Regulation (EU) 2016/679 (GDPR)