Mayur PatilContact

Last checked 2026-11-01

AI agents in Europe

The EU AI Act is the most detailed AI law in force. It classifies AI systems by risk and sets duties for each role in the supply chain. An agent that a company builds and runs internally is usually a deployer under the Act, even when someone else built the model. The duties depend on what the agent is used for, not on the technology behind it. That is the first thing a European builder should settle, because the same agent can be ordinary in one use and high-risk in another.

What buyers here ask me first

  • Whether an agent is high-risk under the Act's annexes, which depends on the use case and not on the technology.
  • What changed when the Digital Omnibus moved the high-risk dates, and which dates apply to their system.
  • Which transparency duties apply to chat and to generated content.
  • What evidence of logging and human oversight the team must keep.
  • How the work interacts with GDPR, and, in some countries, with works council rules.

The duties that matter for an agent deployer

AI literacy (Article 4). Providers and deployers must support a sufficient level of AI literacy among the staff and others who work with their AI systems. The duty takes account of their technical knowledge, experience and training, and of the context in which the system is used. The amended wording does not require any specific level for any one person. For a builder, the practical meaning is a training record for the people who operate or oversee the agent, and a short explanation of what the agent does and does not do.

High-risk uses (Article 26). A deployer of a high-risk system must use it according to its instructions for use. Human oversight must be assigned to people with the necessary competence, training and authority, and they must have the support they need to carry it out. This is a design requirement. The approval step, the stop control and the review screen must be built into the system, not promised in a policy.

Transparency. Some interactions with AI, and some generated content, must be disclosed to the people affected. The timing of these duties has been reported differently by different sources. The consolidated text of Article 50 is the reference for the date that applies to a given system, and it should be read directly.

Automated decisions (GDPR Article 22). Where a decision about a person is made solely by automated means and has legal or similarly significant effect, the person has rights. These include an explanation, human intervention and the right to contest the decision. An agent that decides, rather than recommends, needs a route for those rights, and the route must work in practice.

The dates

The Digital Omnibus, adopted in 2026 as Regulation (EU) 2026/1744, moved the high-risk dates. According to the commentary, the Annex III high-risk duties now apply from 2 December 2027, and the Annex I duties from 2 August 2028. The EUR-Lex text is the reference for the exact dates in each case. Several law firms reported that most transparency duties apply from August 2026 and that some date in Article 50 is later. That point is one of the places where the sources disagree, and the consolidated text should decide it.

How an agent is built to meet these duties

Start with the use case, because classification follows it. Describe what the agent decides or influences, who is affected, and what data it uses. Only then decide which duties apply.

Context and data. The agent reads only the personal data the task needs, and the record of what it read is kept. For employment, credit or access to services, the inputs are where a regulator will look first, so they are documented in detail.

Tools. Each tool has a written contract with its inputs, outputs, errors and permissions. A tool that changes a person's record or makes a decision about a person requires a named approver, and the approval is logged.

Controls and oversight. A named overseer has the authority to stop an action, and the system shows that person what the agent proposes and why. The disclosures the use requires are built into the interface. A route for a person to contest a decision is part of the workflow.

Evidence. An evaluation set of real cases, with expected outcomes agreed by the business owner, is the evidence an auditor will ask for. It is run after every change, and its results are kept with the version of the system they describe.

The responsible AI controls term describes the controls written down before a build, and the evaluation harness term describes the testing that produces the evidence.

Where the picture is still moving

The amended text and the commentary on it are recent. Read the consolidated text rather than summaries, and check the dates for the specific obligations that apply to your system. The Commission may issue further guidance, and that guidance should be read alongside the text.

What a first project looks like

The first project is one use case, classified before anything is built. I start with a readiness review of two weeks. The first step is to describe what the agent decides or influences, who is affected and what personal data it uses. Only then is the use case placed against the Act's categories, and the duties that follow are listed. The second step is to map the data, the tools and the approvers.

If the project proceeds, the first working slice runs outside production. It is scored against an evaluation set agreed with the business owner, and the set includes the cases where a person would be affected by the decision. The training record for the people who operate the agent is started at this point, not at launch. The handover passes the agent to a named overseer with the authority to stop it, together with the logs, the evaluation results and the record of the classification. Each document is kept with the version of the system it describes.

Where the sources disagree

The dates for transparency duties under Article 50 are reported differently by different commentators, and the consolidated text is the reference. The amended wording of Article 4 is described differently in some commentary, so the amending regulation and the consolidated text should be read together. Commentary also disagrees on which penalty tier applies to which article. The fines should be checked against the text, not the summaries.

A composite example

[Composite] A bank in Germany wanted an agent to prepare first drafts of credit explanations for customers. The classification showed that the agent influenced a decision about a person, which brought GDPR Article 22 into view. The team kept a human credit officer as the decision-maker, logged every draft, and gave customers a route to contest the explanation. The training record for the officers was completed before the first draft was used.

A checklist before launch

Before an agent goes live in the EU, the following should be on paper: the classification of the use case, with the reasons; the personal data it reads and the lawful basis for each use; the disclosures the Act or the GDPR requires for the use, and where they appear; the training record for the people who operate and oversee the agent; the named overseer with the authority to stop it; the route for a person to contest a decision; the evaluation results and the version of the system they describe; and the log retention period. Each item is a document an auditor or a data protection authority can read, and each is simpler to produce before the first run than to reconstruct afterwards.

Common questions

Does the AI Act apply to an internal agent?

It can. The Act applies to AI systems put into service or used in the EU, and internal use is not excluded. Whether the duties apply depends on the use case, so classification comes first.

What is AI literacy in practice?

A record that the people who operate or oversee the agent have been trained for their role, plus a clear explanation of what the agent does and where it can fail. The amended duty does not require a fixed score for any individual.

When do the high-risk duties start?

According to the commentary on the Digital Omnibus, the Annex III duties start on 2 December 2027, and the Annex I duties on 2 August 2028. Confirm the date for your system against the consolidated text before you plan around it.

Is a customer chatbot covered by the transparency rules?

It may be. Article 50 sets disclosure duties for certain interactions with AI and for certain generated content. Whether a specific chatbot falls within them depends on the design and should be checked against the consolidated text.

When does Article 22 of the GDPR apply to an agent?

When a decision about a person is made solely by automated means and has legal or similarly significant effect. The safeguards it requires must work in practice, so an agent that decides needs a route for explanation, human review and contest.

Does a works council have a say?

In some countries, works councils have rights over the introduction of monitoring or decision-support tools that affect employees. That depends on national law and on the company's agreements, and it should be checked in each country.

What should a European team do first?

Classify each use case, map the personal data it touches, and set up the record: training, logs, oversight and evaluations. A team that does this now will adapt more easily when the detailed rules are final.

Resources

Work with me

If you are deciding whether an agent is worth building in Europe, start with the AI Delivery Readiness Review. It is a two-week check on one workflow that ends in a written decision to proceed, reframe or pause. For teams that want to build the capability themselves, the AIXL Academy forward-deployed AI engineering cohort is the route, with its own schedule and terms on that page. I work with European teams on engagements, and I travel for engagements. The work location is stated in each engagement. You can also send an enquiry.

Work with me in Europe

This page summarises public sources as of the date above. It is not legal advice. Where sources disagree, the page says so. Sources marked as commentary are secondary and should be checked against the official text before a decision.

Explainers on Europe

Explainers on the rules and the technology for this country will be listed here as they are published.

Sources

This page summarises public sources as of the date above. It is not legal advice. Where sources disagree, the page says so.

Enquiry

Tell me about the work

The use case, where it is blocked and who is involved. I reply with a suggested starting point. Or email hello@mayurpatil.ai.

Goes to my CRM and my inbox. No newsletter, no sharing. See Privacy (opens in a new tab).

Close