AI agents and the EU AI Act: classified by what they decide.

The EU AI Act never uses the word "agent". It regulates AI systems by what they are for. That matters, because two agents built the same way, on the same model, with the same tool-calling loop, can land in different tiers: one books meetings, the other shortlists job candidates. This guide covers how an agent is classified, the duties that already apply to almost every agent today, and the point at which an agent becomes high-risk.

Classify an agent by its intended purpose and the decisions it takes about people, not by its architecture. Autonomy is part of the definition of an AI system in Article 3(1). It is not a risk tier.

An agent is an AI system

Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy that infers from its input how to generate outputs, including decisions, that can influence physical or virtual environments. An agent that reads a request, plans steps and calls tools fits every part of that. Sending an email, updating a CRM record or booking a slot is an output that influences a virtual environment.

So the useful question is not whether the Act covers your agent. It is who the provider is, and which tier the agent's purpose puts it in.

Who is the provider

• You ship an agent under your own name. You are its provider under Article 3(3), even if the model is someone else's. The general-purpose AI model duties in Article 53 stay with the model provider unless you modify the model substantially. Where that line sits.
• You run an agent-building platform. A customer who configures an agent on your platform and puts it into service under its own name may be the provider of that agent. Write down where your platform ends and their agent begins, because both of you will be asked. Provider or deployer?
• You use someone else's agent at work. You are its deployer under Article 3(4).

What applies to agents today

Disclosure is where agents fail first

Article 50(1) requires providers to design AI systems that interact directly with people so that those people are told they are dealing with an AI system, unless it is obvious. Article 50(5) adds that the information must be clear and given at the latest at the first interaction. For a chat agent inside your own product, a greeting does it.

Agents that act on a user's behalf are harder, because the person on the other end never chose to talk to an AI. A voice agent that phones a business to book a table is interacting directly with whoever answers. Say so in the first sentence. For email or messages an agent sends on a user's behalf the position is less settled, but disclosing costs one line and removes the question. The free Article 50 disclosure generator drafts notices for chat assistants and voice agents, and the disclosure templates show wording for voice and chat.

Generated content needs marking from December

From 2 December 2026, providers of AI systems that generate audio, image, video or text must mark the output in a machine-readable way, as far as technically feasible. There is an exception where the system only performs an assistive function for standard editing, or does not substantially alter the input. An agent that drafts and sends a whole message usually goes beyond that. Decide now whether you or your model provider marks the output, and check that the marking survives your pipeline. Article 50 in full.

Persuasion goals deserve an Article 5 check

Sales and retention agents are optimised to change what people do. That is lawful. The line in Article 5(1)(a) and (b) is crossed by subliminal, manipulative or deceptive techniques, or by exploiting age, disability or a social or economic situation, that materially distort behaviour and cause significant harm. Write down what your agent is allowed to say to win a sale and what it is not, and keep that note with your classification.

When an agent becomes high-risk

Not because it is autonomous. Because of what it decides. Some examples:

An agent inside an Annex III area can still fall outside high-risk under Article 6(3) if it only performs a narrow procedural task, improves the result of a human activity already completed, detects patterns without replacing human assessment, or does preparatory work. The exemption never applies to a system that profiles people. An agent that acts on its own conclusions about a person rarely fits "preparatory". The free high-risk checker walks through Annex III and the four Article 6(3) conditions for one system.

If an agent is high-risk, the Chapter III duties apply from 2 December 2027 after the June 2026 Omnibus. Two of them bite harder on agents than on other systems. Article 14 requires design that lets a human understand, override and stop the system, including a stop button or a similar procedure. Article 12 requires automatic logging of events. An agent that acts in a loop without a checkpoint will need both designed in, not added at the end.

Controls buyers ask about anyway

For most agents, Article 14 is not a legal requirement, but enterprise buyers ask about oversight in nearly every vendor questionnaire. The same four controls answer them:

• An approval step before irreversible actions: payments, deletions, messages to third parties.
• Scoped permissions: the agent can only reach the tools and data its purpose needs.
• An action log a person can read after the fact.
• A way to stop it mid-task.

Describe them as what they are: controls you run, not a conformity assessment you have done.

An agent checklist

1. Write the agent's intended purpose in one sentence, and list every action it can take.
2. Mark each action that scores, ranks or decides something about a person.
3. Check those actions against Annex III and Article 6(3).
4. Add a disclosure to every channel where the agent meets a person: chat, voice, email.
5. Decide who marks generated output before 2 December 2026.
6. Write down the persuasion limits for any sales or retention agent.
7. Record who on your team was trained on the agent, and when.
8. Put it in one dated row of your AI inventory.

Article 50 breaches fall under Article 99(4): up to €15,000,000 or 3% of worldwide annual turnover, and for SMEs and start-ups whichever is lower. Article 5 breaches reach €35,000,000 or 7%. How the tiers work.

The free scan gives an agent's likely risk tier in about two minutes: eight questions plus your email. The gap report puts the role analysis, the Annex III and Article 6(3) checks, the Article 50 duties and every post-Omnibus deadline into one dated document. See a sample report. It is a self-assessment, not legal advice.

Frequently asked questions

Does the EU AI Act regulate AI agents?

Yes, as AI systems. The Act does not use the word agent, but an agent that plans steps and acts through tools meets the Article 3(1) definition. It is classified by its intended purpose like any other AI system, so most agents are limited or minimal risk and some are high-risk.

Does my AI agent have to say it is an AI when it talks to people?

Where it interacts directly with people, yes. Article 50(1) has applied since 2 August 2026 and requires that people are informed they are dealing with an AI system, at the latest at the first interaction, unless that is obvious. That includes third parties a voice agent calls on a user's behalf.

Is an autonomous AI agent automatically high-risk?

No. Autonomy is part of the definition of an AI system, not a risk tier. An agent is high-risk when its purpose falls in Annex III, such as screening job applicants or assessing creditworthiness, and the Article 6(3) exemption does not apply. Those duties apply from 2 December 2027.