EU AI Act and AI agents: what applies to agents
Regulation (EU) 2024/1689 does not use the term AI agent. It governs AI systems by role and risk. For agents, this means: which obligations apply depends on who provides or deploys them and for what purpose.
Leutrim Miftaraj, Founder, Innopulse Consulting GmbH
Published
Key points
- Regulation (EU) 2024/1689 has no separate term for AI agents.
- Obligations depend on role, provider or deployer, and on the risk of the use.
- For agents in contact with people, the transparency obligations under Article 50 are especially relevant.
- Switzerland has no AI law of its own and adapts its law sector by sector.
Agents within the meaning of the regulation
The AI Act defines AI systems as machine-based systems that operate with varying levels of autonomy and infer outputs such as predictions, content, recommendations or decisions from inputs (Article 3 point 1). An AI agent generally falls under this. There is no separate term for agents.
Many agents are based on general-purpose AI models. Their providers have obligations of their own, such as technical documentation and information for downstream providers (Article 53). Whoever builds an agent on such a model is usually the provider of the agent as an AI system.
Roles: provider and deployer
Obligations attach to roles. Providers develop an AI system or have it developed and place it on the market under their own name. Deployers use an AI system under their own authority. A company using a purchased agent for procurement is a deployer; a software house offering the agent is a provider.
The regulation also applies to providers and deployers outside the EU if the system's output is used in the EU (Article 2). For Swiss companies with customers or activities in the EU, this is relevant.
Transparency: when agents talk to people
Article 50 is especially relevant for agents. Providers must design AI systems intended to interact directly with natural persons so that these persons are informed that they are interacting with an AI system, unless this is obvious. An agent that calls a customer service line or writes to a case officer can fall under this.
Further transparency obligations concern artificially generated content. Which obligation applies in a given case depends on the agent's function and use.
High-risk uses, record-keeping and oversight
If an agent is used in an area the regulation classifies as high-risk, such as certain decisions on credit, employment or access to essential services, stricter requirements apply. These include automatic recording of events (Article 12), human oversight (Article 14) and obligations of deployers (Article 26).
Regardless of risk class, since 2 February 2025 the regulation has required providers and deployers to ensure sufficient AI literacy among their staff (Article 4).
Deadlines
| Date | What applies |
|---|---|
| 1 August 2024 | Entry into force of the regulation |
| 2 February 2025 | Prohibited practices, AI literacy |
| 2 August 2025 | Obligations for general-purpose AI models |
| 2 August 2026 | Most remaining provisions, including transparency obligations under Article 50 |
| 2 August 2027 | Certain high-risk systems in regulated products |
In 2025, the European Commission proposed adjustments to individual deadlines. The regulation text in force on EUR-Lex is authoritative.
The situation in Switzerland
Switzerland has no AI law of its own. In February 2025, the Federal Council decided to ratify the Council of Europe Framework Convention on Artificial Intelligence and to make the necessary adjustments sector by sector in existing law wherever possible. Swiss companies are also subject to the Data Protection Act and, when active in the EU, to European requirements.
In practice, this means for agents: whoever operates in both markets follows the stricter requirements and documents how agents are used and controlled.
Where verifiable evidence helps
Traceability runs through the regulation: records, documentation, human oversight. Mandates, decisions and receipts for agent actions provide exactly the kind of evidence with which a company can show what an agent was allowed to do, how it was decided and what happened.
KYA verifies such evidence independently. This replaces neither a conformity assessment nor a legal assessment, but it creates a solid basis for both. A practical list for adoption is provided by the checklist for AI agents.
What companies can do now
Regardless of role, an inventory pays off: which agents are in use, for what, with which risk? On this basis, obligations can be assigned and evidence built up.
Frequently asked questions
Does the AI Act regulate AI agents explicitly?
No. The regulation has no separate term for agents. Agents generally fall under the definition of an AI system, and obligations depend on role and risk.
Does the regulation apply to Swiss companies?
It can apply if a Swiss company places AI systems on the EU market or if a system's output is used in the EU. Whether that is the case depends on the individual situation.
Does an agent have to identify itself as AI?
If it is intended to interact directly with natural persons and this is not obvious, Article 50 requires that the persons be informed. The obligation falls on the provider when designing the system.
Does KYA make a company meet the regulation?
No. KYA verifies technical evidence about agent actions. This can support documentation and traceability but replaces neither a legal assessment nor a conformity assessment.
What does AI literacy mean under the regulation?
Providers and deployers ensure that people who operate or use AI systems on their behalf have sufficient knowledge. This has applied since 2 February 2025.
Where can I find the text of the regulation?
On EUR-Lex, the Official Journal of the European Union. The version in force is authoritative.
Who is the provider of a purchased agent?
Usually the company that develops the agent and offers it under its own name. Whoever uses it is the deployer.
General information, not legal advice. The statutes and the circumstances of each case are decisive.
Sources
- Verordnung (EU) 2024/1689 (AI Act), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Europarat: Rahmenkonvention über künstliche Intelligenz: https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence