Does an HR, research or finance agent count as high-risk? The EU AI Act classifies actual uses and legal roles, not marketing labels. This independent guide follows the law as consolidated on 27 July 2026.
An AI agent is not inherently high-risk. Identify the use case and legal role first, then separately assess prohibitions, high-risk categories, transparency, implementation dates and evidence.
Does the EU AI Act cover AI agents?
The EU AI Act (Regulation 2024/1689) does not define every marketed “AI agent” as a separate high-risk category. A particular system must first fit the AI-system definition in Article 3 and the scope in Article 2. An assistant summarising public documents may require a different legal analysis from a system evaluating job candidates or individual creditworthiness.
The operational question is what the system actually does, for whom, and with what consequences. Tool autonomy, connectors and delegated permissions are important risk signals, but they do not replace the legal classification. Our AI agent fundamentals explain the architecture; this guide addresses the legal decision.
What applies in 2026, 2027 and 2028?
The version consolidated on 27 July 2026 incorporates Regulation (EU) 2026/1744. The principal dates are 2 February 2025 (including prohibitions and AI literacy), 2 August 2025 (notably general-purpose AI model-provider rules), 2 August 2026 (most provisions, including specified transparency requirements), 2 December 2026 (additional prohibitions and certain marking-related transitions), 2 December 2027 (Annex III high-risk AI) and 2 August 2028 (relevant Annex I product-related high-risk AI).
Postponing these high-risk duties did not suspend other applicable rules. Prohibitions, data protection, certain transparency requirements and model obligations may already apply. Check the EU implementation timeline and the consolidated text rather than relying on a pre-amendment compliance calendar.
Provider or deployer: who is responsible?
A provider develops or commissions an AI system and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, except for strictly personal non-professional use. A company might occupy both roles in different arrangements; buying a software subscription does not automatically make it the provider of its underlying general-purpose model.
Article 25 creates a critical transfer-of-responsibility risk. Rebranding a high-risk system, making a substantial modification, or changing a non-high-risk system's intended purpose so that it becomes high-risk can create provider obligations. Contracts, intended-purpose statements, modifications and system ownership must be evaluated together.
Check prohibited practices before high-risk classification
Article 5 prohibits certain practices, including narrowly defined manipulative or exploitative uses and specified forms of biometric or social scoring. Most prohibitions have applied since February 2025. The July 2026 amendment added specific prohibitions relating to non-consensual intimate material and child sexual abuse material that apply from 2 December 2026.
A chat interface or autonomous workflow does not by itself make a system prohibited. The decisive facts include purpose, methods, affected individuals, harm and the exact legal exceptions. For a potentially prohibited use, seek qualified legal review before running a pilot; a generic human-approval checkbox does not legitimise a banned practice.
When is an AI agent a high-risk system?
Article 6 refers to Annex III for certain standalone high-risk uses, including parts of employment, education, access to essential services, critical infrastructure, law enforcement, migration and justice. An agent ranking applicants for recruitment decisions may be in scope. A meeting assistant that merely records a call is not high-risk just because it is agentic.
Article 6(3) provides a narrowly framed derogation for some Annex III systems that do not present a significant risk, including tightly limited procedural or preparatory tasks, subject to the exact conditions. However, profiling natural persons within the relevant Annex III setting is expressly high-risk. A provider claiming the non-high-risk route must document its assessment and observe applicable registration requirements. “A human makes the final call” is not an automatic exemption.
What do provider and deployer obligations require?
Once a system falls within an applicable high-risk regime, providers face requirements concerning risk management, data and quality management, technical documentation, logs, operator information, human oversight, robustness and cybersecurity (Articles 8–17). Responsibilities attach to the actual system and supply chain; the foundation-model vendor's documentation is not a complete substitute for end-system compliance.
Article 26 addresses deployers: proper use under instructions, appropriate human oversight, monitoring, input-data management and handling risks or incidents, among other context-dependent duties. Check the operator instructions, downstream connector permissions, logs, review procedures and withdrawal of access in the specific deployment.
Fundamental-rights impact assessment is not universal
An FRIA under Article 27 is not required for every AI user or every deployment. In scope are certain public-law bodies, private entities providing public services and deployers of designated high-risk systems under Annex III point 5(b) and (c), with the provision's exceptions and limitations. The assessment concerns identified affected groups, foreseeable risks, human oversight and mitigations.
A GDPR data protection impact assessment (DPIA) may be required independently under GDPR Article 35. The amended AI Act allows cross-references to a DPIA for overlapping elements in an FRIA under specified conditions. A DPIA and FRIA are therefore related compliance work, not interchangeable legal tests.
Article 50: interaction notices and synthetic content
Article 50 became applicable from 2 August 2026 to its defined situations. Providers of AI systems designed to interact directly with people must generally ensure individuals are informed that they are interacting with AI unless it is obvious. Additional, distinct obligations address machine-readable marking of certain synthetic outputs and disclosures by deployers, including deepfakes, subject to exceptions.
A transition to 2 December 2026 covers certain providers' Article 50(2) marking responsibilities for systems already placed on the market before 2 August 2026. AI-generated text published to inform the public raises specific conditions, including the exception for human editorial control and editorial responsibility. Neither “every AI text needs a label” nor “human review removes every duty” is an accurate general rule.
Article 4 AI literacy still matters after the amendment
The amended Article 4 continues to require providers and deployers to take measures supporting AI literacy among staff and people operating systems on their behalf. Measures should reflect experience, training, context and affected groups. The amendment also clarifies that they do not have to guarantee a fixed literacy level in each individual.
Relevant practice may include role-specific training for tool permissions, prompt injection, stop conditions, escalation and approval decisions, with an auditable record of the programme. These are editorial examples of implementation, not a universal legal training-hour minimum or mandatory certificate.
The AI Act does not replace the GDPR
AI Act Article 2(7) preserves the application of EU personal-data law. If an agent processes personal data, the controller or processor must separately assess a lawful basis, purpose limitation, minimisation, data subject rights, processor arrangements, retention and, where needed, a DPIA.
An agent that falls outside Annex III may still be unlawful under data-protection rules. For instance, a research agent with overly broad access to private personnel records can create a significant data-protection problem without becoming an Annex III high-risk system. See our AI agent security reference.
Original AgentenCode matrix: six independent decisions
Our visual matrix is an editorial triage method, not an authority-issued legal classification. It counters six faulty assumptions: agentic means high-risk; human-in-the-loop equals legal compliance; EU hosting guarantees GDPR compliance; all generated text follows one marking rule; SaaS subscription equals system provider; and deferred high-risk dates eliminate current obligations.
For each intended purpose, record a responsible owner, named provider, data flows, affected populations, allowed actions, approval chain, applicable legal basis and date, official source, and unresolved evidence. Mark missing facts as unknown rather than turning them into a green compliance score.
| Review field | Evidence to record | Legal anchor |
|---|---|---|
| Purpose and role | Who controls purpose, data, people and actions? | Arts 2, 3, 25 |
| Prohibitions | Is the use prohibited? | Art 5 |
| High-risk use | Annex I / III? derogation? profiling? | Art 6 |
| Transparency | Direct interaction or synthetic content? | Art 50 |
| Effective date | Applies now, in 2027 or 2028? | Art 113 (2026 update) |
| Proof | Contracts, approvals, logs, DPIA/FRIA where needed? | Arts 26, 27; GDPR |
Four illustrative agent use cases
A – Internal research agent: summarises non-personal public documents; that activity alone does not determine an Annex III high-risk classification, though other rules may apply. B – Applicant ranking agent: orders applications and influences recruitment; Annex III employment-related provisions require careful classification, even when a person clicks the final approval button.
C – Customer chat agent: answers questions and performs simple scoped operations; direct-interaction transparency can apply independently of high-risk status. D – Finance agent: drafts internal invoices or assesses the creditworthiness of natural persons; those are different legal purposes. The examples are decision prompts, not legal findings about named products.
A 30-day pilot plan with concrete stop gates
Week 1: document intended purpose, provider/deployer role, process owner, prohibited-practice and Annex III review. Week 2: restrict connectors, check data protection, define action approvals, logging and revocation. Week 3: run bounded tests of authorised, erroneous and prohibited actions. Week 4: review results, literacy evidence, escalation paths, legal assessment and outstanding issues before approval or stop.
This is an editorial implementation suggestion, not a statutory 30-day deadline. See agent evaluations and agent monitoring for ways to verify actual outcomes and continuing safeguards.
What AgentenCode's product dossiers can and cannot establish
Our dossiers for Workday Talent Acquisition Agent, IBM watsonx Orchestrate and Mistral Studio Managed Agents track vendor-sourced product features and their evidence limits. Whether a particular customer setup is high-risk depends on actual purpose and configuration and cannot be inferred from the product name.
AgentenCode has not performed a legal certification, authority conformity assessment, independent regulatory audit or legal opinion on these products. A binding classification or FRIA/DPIA determination requires the relevant legal, data-protection, workplace and domain experts.
Frequently asked questions
Does every AI agent automatically fall under the EU AI Act?
No. Scope, AI-system status, intended purpose, legal role and risk classification must be assessed separately; the name “agent” is not itself a high-risk category.
Did all high-risk rules take effect in August 2026?
No. The amended schedule is 2 December 2027 for Annex III systems and 2 August 2028 for relevant Annex I products, while other rules apply already.
Must every company perform a fundamental-rights impact assessment?
No. Article 27 applies to certain deployers and uses, with defined exceptions. A GDPR DPIA is a separate assessment.
Does human approval alone establish compliance?
No. Human oversight does not replace classification, data protection, documentation or effective controls.
Was AI literacy removed from Article 4?
No. Article 4 still requires supporting measures, but does not require guaranteeing a fixed literacy level for each person.
Is the AgentenCode checklist a compliance certificate?
No. It is an independent editorial research and triage aid, not legal advice, legal certification or an official determination.
Official sources, legal version and limits
Source review and legal version: 10 November 2026. The consolidated Regulation (EU) 2024/1689 as amended by Regulation 2026/1744, applicable from 27 July 2026, is the core basis. Original texts take precedence over editorial summaries.
- EU AI Act consolidated text 27 July 2026 (Regulation 2024/1689 as amended by 2026/1744)
- European Commission: EU AI Act official implementation timeline
- EU AI Act Service Desk: Article 4, AI literacy
- EU AI Act Service Desk: Article 6, high-risk classification
- EU AI Act Service Desk: Article 25, provider responsibility in value chains
- EU AI Act Service Desk: Article 26, deployer obligations
- EU AI Act Service Desk: Article 27, fundamental-rights assessment
- EU AI Act Service Desk: Article 50, transparency
- Council of the EU: adopted 2026 simplification and new dates
- EU General Data Protection Regulation 2016/679
Note: This editorial matrix is not legal advice or certification; the product examples do not classify individual vendor offerings.