AI Act: what changes for companies using AI agents

Since August 2, 2026, the AI Act, the European regulation on artificial intelligence, has applied in most of its provisions. A few days earlier, however, an amendment postponed the most demanding part: high-risk rules move to December 2, 2027, and to August 2, 2028 for systems embedded in products.

Companies that use AI agents for data, documents, reports or support are almost always deployers, not providers. Here is what the regulation asks of them today.

01If you use an AI agent, you are a deployer

The AI Act distinguishes between roles (Article 3). The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system under its authority, in a professional activity.

If you adopt an agent from a third party, you are therefore usually a deployer; if you develop a system and put it into service for your own use, under your own name, you may also be a provider. The European Commission clarified what counts as an AI system in its guidelines on the definition of February 2025.

02The timeline after the Digital Omnibus

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, has been in force since July 27, 2026 and amends Regulation (EU) 2024/1689, the AI Act. These are the dates that matter if you use AI agents.

prohibitions and AI literacy

Feb 2, 2025

general application and transparency obligations

Aug 2, 2026

high-risk, uses listed in Annex III

Dec 2, 2027

high-risk, systems in Annex I products

Aug 2, 2028

The obligations on general-purpose AI models, in force since August 2, 2025, apply to the providers of those models, not to those who use them through an agent. The same dates are listed on the European Commission's page.

03AI literacy: already an obligation

Article 4 applies to providers and deployers: AI literacy is already mandatory, since February 2, 2025. The Omnibus rewrote it: it now requires you to take measures to support it among your staff and anyone using the systems on your behalf, without having to guarantee a specific level for each person.

According to the Commission's questions and answers, national market surveillance authorities have been supervising these rules since August 2, 2026.

04Prohibited AI practices

Since February 2, 2025, Article 5 has prohibited certain AI practices, including for those who only use them. Among those that may concern a company:

• Manipulation: subliminal, manipulative or deceptive techniques that cause, or are likely to cause, significant harm.
• Vulnerabilities: exploiting people's age, disability or social or economic situation.
• Social scoring: classifying people by behavior or personal characteristics, leading to unjustified detrimental treatment.
• Emotions at work: inferring them in the workplace and in education institutions, except for medical or safety reasons.
• Biometric categorization: deducing from biometric data, for example, political opinions or sexual orientation.

From December 2, 2026, the Omnibus also prohibits using AI systems to generate non-consensual intimate material of identifiable people and child sexual abuse material. Fines for prohibited practices reach €35 million or 7% of total worldwide annual turnover, whichever is higher; for SMEs, the lower amount applies (Article 99). The details are in the guidelines on prohibited practices.

05When an agent becomes high-risk

In the AI Act, risk depends on the use, not the technology. Annex III lists the high-risk uses; among those that most often concern companies:

• Employment: recruitment, filtering applications, decisions on promotion and termination, allocating tasks based on behavior or personal traits, monitoring performance.
• Credit and insurance: creditworthiness of natural persons, except for fraud detection, and risk assessment and pricing in life and health insurance.
• Other areas: biometrics, critical infrastructure, education, essential public services.

Data entry, document reading, reports and first replies to customers are not, in themselves, on the list. An agent can become high-risk if its work serves one of those purposes: for example, screening CVs. The Commission's guidelines on classification are still in draft.

06Deployer obligations for high-risk systems

From December 2, 2027, if you use high-risk systems listed in Annex III you must comply with Article 26:

• Instructions for use: use the system as instructed by the provider, with appropriate technical and organizational measures.
• Human oversight: assign it to people with the necessary competence, training and authority.
• Monitoring: monitor operation and, if a risk emerges, inform the provider and the authorities and suspend use.
• Logs: keep automatically generated logs for at least six months, where they are under your control.
• Information: inform workers and their representatives before use in the workplace, and people subject to decisions made or assisted by the system.

Bodies governed by public law, private entities providing public services and those using systems for creditworthiness or for life and health insurance must also carry out a fundamental rights impact assessment (Article 27). Transitional rules apply to systems already on the market before December 2, 2027 (Article 111).

07Transparency towards customers and the public

The obligations in Article 50 were not postponed: transparency has applied since August 2, 2026.

• Interaction: the provider designs systems that interact with people so that they know they are interacting with an AI system, unless this is obvious.
• Marking: the provider of generative systems marks outputs in a machine-readable format; for those placed on the market before August 2, 2026, the deadline is December 2, 2026.
• Deep fakes and text: the deployer discloses deep fakes and generated text published to inform the public on matters of public interest, unless there is human review and editorial responsibility.

If an agent replies directly to your customers, check with the provider how this is disclosed; if you developed it yourself, the obligation may fall on you. The details are in the guidelines on transparency obligations.

08AI Act and GDPR

The AI Act does not replace the GDPR, which continues to apply to personal data processed by agents (Article 2(7)). For high-risk systems, the deployer uses the provider's information in the data protection impact assessment (Article 26(9)), to which the fundamental rights impact assessment can refer.

09A checklist to get started

1. 01Take an inventory of your AI agents and tools: processes, data, providers.
2. 02Clarify your role: for each system, are you a deployer, a provider or both?
3. 03Classify the uses: no prohibited practices, then Annex III and transparency obligations.
4. 04Train the people who use the agents, according to their role.
5. 05Define human oversight: who approves what, with what authority.
6. 06Record agent actions and keep the logs.
7. 07Ask providers for documentation: instructions for use, known limitations, data handling.

In our AI agents and automation projects we work with human approval and traceability of every action, data processed in the European Union and agents in isolated environments, with access limited to what is needed. These elements help organize the human oversight and record-keeping required for high-risk systems; they are not a certification of compliance. To choose where to start, read which processes to automate first.

Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, European Commission, AI Act, AI literacy, prohibited practices, AI system definition, high-risk systems, transparency obligations.