Solutions
Article 50 transparency duties apply from 2 August 2026, subject to their scope, exceptions and transitional provisions.
Compliance for AI Agents
Oversight, disclosure and logging controls for systems that act on their own, built for teams shipping agents, copilots and autonomous workflows.
Autonomous agents that use tools, take actions, and chain steps raise AI Act questions standard checklists miss. We map your agentic workflows to the Act and deliver a control set built for systems that act on their own.
Where this fits. EU AI Act Readiness tells you what the Act requires of your systems generally. AI Governance & Documentation builds the artefacts. This page is the specialised lane for one class of system (autonomous agents acting in consumer funnels) where the exposure is concentrated, live today, and enforced on both sides of the Atlantic.
If the business also needs an entity, ownership documents and an operating framework, see LLC setup and maintenance for a personal AI agent. We assess whether a new company is needed and connect formation with the agent’s permissions and continuing records.
Common challenges
General AI checklists don’t account for systems that take real-world actions: sending messages, moving money, changing records.
Telling when an autonomous workflow crosses into the Act’s high-risk tier, or across a prohibited-practice line.
Turning a third-party general-purpose model into an agent can quietly change your role, and your obligations.
Approval and record-keeping controls have to be designed in for fast-chaining agents where a human can’t naturally intervene in time. Where a system is high-risk, Articles 14 and 12 add specific oversight and logging requirements.
Why agents are getting their own scrutiny
The direction of travel is explicit. The Commission’s 2026 classification guidance singles out agentic AI systems for closer scrutiny, including the expectation that providers monitor what their agents actually do in production, not merely what the terms and conditions say they do. Where Article 50(1) applies, the provider must ensure people are informed that they are interacting directly with an AI system, unless this is obvious in context. Separate marking and disclosure duties depend on the content, actor and use. These requirements do not amount to a general duty to announce every autonomous or machine-to-machine action. For agentic teams, ‘our policy prohibits it’ is no longer an answer if the agent’s logs show otherwise. Closing that gap between paper compliance and control is exactly what this engagement does.
Illustrative agent trace: the control set in action
Illustrative only. A composed example of the four controls, not a real system, client or product.
This customer-support workflow shows recommended operational controls. Articles 12 and 14 impose specific requirements on systems classified as high-risk, subject to their application dates and transitional provisions. Ordinary customer support does not become high-risk solely because software acts autonomously.
Our approach
Workflow mapping
For each agent or automated workflow: what it does, what tools and actions it can trigger (sending messages, moving money, changing records, calling external systems), and how much it decides without a human.
Classification handoff
Where autonomy shifts each workflow’s position under the Act: the high-risk uses an acting agent can drift into and the prohibited-practice lines it can cross. Full system classification is our EU AI Act Readiness assessment; this engagement starts where it ends and goes deeper on the agent-specific risks.
Human-oversight reviewArt. 14
We identify proportionate approval, escalation and stop controls for the workflow. Where the system is classified as high-risk, we map the applicable Article 14 requirements and their application date.
Transparency & disclosureArt. 50
We identify which Article 50 duties apply to the system and the responsible provider or deployer, including direct-interaction notices, applicable synthetic-content marking and use-specific disclosures. Required information must be clear, accessible and provided by the first interaction or exposure, subject to the relevant exceptions.
Logging & traceabilityArt. 12
We specify the action records needed for accountability, contracts, security and incident review. Where Article 12 applies to a high-risk system, we map its specific logging requirements.
Role & dependency check
Whether wrapping a general-purpose model into an agent makes you a provider, and which GPAI-linked obligations follow.
The deliverable
A workflow-by-workflow control checklist plus a prioritised gap report, in plain language your engineering team can act on.
Who it’s for
Agentic SaaS, AI-native products, and any company giving an LLM the ability to take real-world actions.
Hiring, credit, healthcare, critical services: where autonomy meets the Act’s strictest expectations.
Fast-chaining workflows where oversight has to be designed in, because nobody can watch in real time.
FAQ
The Act doesn’t have a separate “agent” category. Autonomy alone does not make a system high-risk: classification depends on the use. But tool use and the ability to act change how the existing rules apply to you, and which human-oversight and record-keeping controls are worth designing in. We assess your agents against the rules as they actually apply.
Usually yes. Deploying agents based on someone else’s model still brings obligations, and turning a general-purpose model into an agent can make you a provider in your own right. We map which role you hold and what follows from it.
Sequence and depth. The general Readiness assessment classifies any AI product and maps its obligations; it answers what you owe. This engagement is the specialised lane for agents: it builds and tests the controls autonomy demands (oversight points, stop/override mechanisms, disclosure moments, action logging) which a general assessment names but does not design. Most agentic teams run Readiness first; some come straight here when the agents are already live.
Related guides
- EU AI Act Readiness
Classify systems before designing agent-specific controls.
Related jurisdictions
- European Union in the AI hub
Locate the AI Act obligations governing the agent assessment.
Further reading
- Part VI AI agent compliance under EU law
5 October 2026
- Agentic AI Liability and Autonomous Decision-Making
4 June 2026
- Part V AI Act transparency for content and interactions
5 October 2026
- Agentic payments and refunds for an AI shopping agent’s wrong purchase
20 October 2026
Related solutions
- EU AI Act Readiness
Establish scope, role and risk classification first.
- AI Governance & Documentation
Build the governance documents supporting agent controls.
- Data Protection & GDPR for AI
Address personal data and automated decisions within agent workflows.
See where your agents stand
Walk us through what your agents can do and where a human sits in the loop. You get a workflow-by-workflow control checklist and a prioritised gap report your engineering team can act on.
Get the agent control reviewStart upstream: EU AI Act Readiness · AI Governance & Documentation
General information about the EU AI Act. It is not legal advice, and a control review is not a guarantee of compliance.