The Timeline Has Changed
If you last looked at the EU AI Act a year ago, your dates are probably out of date. The AI Omnibus, published in the EU's Official Journal on 24 July 2026, pushed back the main high-risk deadlines. However, some duties have already started.
This article is general information, not legal advice. What applies to you depends on your systems and your role, so confirm the details with legal counsel.
The Key Dates
• 2 February 2025: Bans on prohibited AI practices began to apply.
• 2 August 2025: Obligations for general-purpose AI models began to apply.
• 2 August 2026: Most Article 50 transparency duties began to apply.
• 2 December 2026: The machine-readable marking duty applies to generative AI systems that were already on the market.
• 2 December 2027: Rules for stand-alone high-risk systems under Annex III begin to apply, moved from August 2026.
• 2 August 2028: Rules for high-risk AI built into regulated products under Annex I begin to apply, moved from August 2027.
Does It Apply to Your Agents?
The Act has no separate category for AI agents. Your obligations depend on what the system does, how it is used, and your role, such as whether you provide the system or deploy it.
Being based outside the EU doesn't automatically put you out of scope. The Act can reach companies elsewhere if they place AI systems on the EU market, or if a system's output is used in the EU. If you have EU customers, employees, or users, it is worth checking.
What Applies Now: Transparency
The duty most relevant to many agents is simple. Systems that interact directly with people, such as chatbots and voice assistants, must be designed so that people know they are dealing with an AI, unless that is obvious from the circumstances.
The European Commission adopted non-binding guidelines on these duties on 20 July 2026. Law firm summaries put the maximum fine for breaching them at up to €15 million or 3% of worldwide annual turnover.
In practice, that means reviewing:
• Support chatbots and voice agents, including how the agent introduces itself at the start of a call
• Sales and outreach agents that message people directly
• Any agent that generates content, since marking and labeling rules may also apply
What Comes Next: High-Risk Uses
Whether an agent counts as high-risk depends on its use. Annex III includes certain uses in areas such as recruitment, credit scoring, and education, so an agent that screens job applicants needs closer attention than one that schedules meetings.
High-risk systems will have to meet requirements that include risk management, data governance, technical documentation, record-keeping, human oversight, and accuracy and robustness.
Why You Shouldn't Wait Until 2027
The extra time is useful, but these requirements are slow to add at the end of a project. Record-keeping and human oversight in particular shape how an agent is designed. Much of the work also overlaps with what it takes to run agents reliably anyway:
• Tracing provides the basis for your records.
• Approval gates support human oversight.
• Evals give you evidence of accuracy over time.
• An agent register shows what is running, who owns it, and what it does.
So even if the Act never applies to you, these practices are still worth having.
Five Steps to Take Now
• List your AI systems and agents, including those embedded in vendor products.
• Mark where each one touches the EU, through users, customers, employees, or output.
• Check that people are told when they are dealing with an AI.
• Flag possible high-risk uses, especially in hiring, credit, and education, and get legal advice on them.
• Start keeping records and adding oversight in new agent projects, rather than retrofitting them later.
Keep Checking
These rules and the guidance around them are still developing, so check the current position with your legal team before you make decisions. If you would like help with the technical side, such as tracing, approval gates, and agent inventories, get in touch through our contact form.