EU AI Act compliance

It depends on what the agent is used for and on your role. Most agents in customer service or operations carry transparency duties: people must know they are dealing with AI, and generated content must be marked. An agent used in an area the Act lists as high-risk, such as hiring, credit scoring or access to essential services, carries more, including risk management, data governance, event logs, human oversight, accuracy and robustness, and technical documentation. We map which of these may apply to each system, and your legal team confirms.

In stages. Prohibited practices have applied since February 2, 2025 and duties for general-purpose AI models since August 2, 2025. Transparency duties under Article 50 apply from August 2, 2026. Providers whose generative systems were on the market before that date have until December 2, 2026 to mark the content they generate. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk duties: December 2, 2027 for systems in the areas listed in Annex III, and August 2, 2028 for AI built into products covered by Annex I. Dates as of October 2026; your legal team should confirm them for your case.

No. We are engineers. We list the obligations that may apply to each system, build the technical side (logging, human oversight, disclosure, technical documentation) and give your legal and compliance team the records they need to decide. Classifying the system, and any conformity assessment, stays with your lawyers and, where the law requires one, a notified body.

If you build an AI system, or have one built, and put it into service under your own name, you may count as its provider, even when only your own staff use it. If you use a system someone else provides, you are a deployer, with fewer duties. The role decides the duties, so the inventory records it for every system and your legal team confirms it.

The model provider carries the duties for the general-purpose model itself. Your agent is an AI system built on that model, and its duties follow from how it is used: transparency for most agents, the high-risk set if it works in an Annex III area. We record which model and version each system uses, so a change of provider shows up in the documentation.

High-risk systems must record events automatically over their lifetime, so that results can be traced. We build that as a log per run: the input, the documents retrieved, every tool call, the output, the model version and who approved what. The logs stay in your environment and are kept for the period your legal team sets, which for high-risk systems is at least six months (Articles 19 and 26).

The people overseeing the system need to understand what it does, spot when it goes wrong and be able to stop or override it. In an agent that means approval steps before consequential actions, a way to stop a run, the sources behind each answer on screen, and alerts when results drift. Which actions wait for a person is decided per system, with the team that will do the oversight.

Under Article 50, people must be told they are interacting with an AI system unless it is obvious, and synthetic audio, images, video or text must be marked as AI-generated in a machine-readable way. We build the notice into the interface and the marking into the outputs, and test both on every release.

It sits next to them. GDPR covers the personal data the system processes, and ISO/IEC 42001 is a management system standard for AI. The inventory, logs, oversight steps and documentation we build serve all three, so your teams do not keep separate records for each.

An inventory of your AI systems with the obligations that may apply to each, the logging, oversight and disclosure code in your repository, tests for them in your CI, technical documentation per system and runbooks for the people who will look after it. All of it is yours to change, extend or take to another team.

We only build tailored agentic AI systems, so we are biased. If your only AI system is a vendor's chatbot that you use as it comes, you are a deployer, and the vendor's documentation and your legal team may cover most of what you need. We are useful when you build your own system or have one built, or when an agent takes actions in your other systems.