Skip to content

Use case · EU AI Act

What the EU AI Act asks of agent actions, and what a record can show.

A plain-language map of the obligations that touch what an AI agent does: which bind now, which bind later, and for each one, what a sealed record of the agent's actions can show and what stays a human judgment.

Dates follow the Action State EU AI Act obligations mapping, 3 Sep 2026; Reg (EU) 2026/1744 (the Digital Omnibus on AI, in force 27 July 2026). It is not legal advice; where timing is contested we say so.

The EU AI Act is one use case among several for keeping evidence of what agents did. This map is the long form of the EU AI Act Obligations pack.

How to read each item

Each obligation is written as a statement someone could check. Under it, the kinds of evidence that bear on it. A record says present or absent for each item. It never rolls them up into a verdict on the law.

  • Fact · On the record: the event is there or it is not, with its time and order.
  • Rule · A stated rule, run over the record, marks each case.
  • Judged · A judgment. It stays with people; the verdict and who gave it can be recorded. Items with a gold edge include judgment.
  • Document · A document, cited by digest: present or absent.
  • Confirm · The other party's acknowledgement: present or absent.
  • State · The configuration in force when the action ran.

Three more rules for reading a report built on this map. A record that fails verification is reported as failed, never as “nothing found”. A field the record does not carry is reported as not present, never inferred. And each item says which record format its evidence came from.

Since 2 Feb 2025 (Chapter I–II)

Prohibitions bind providers AND deployers ('use' is covered). Art. 4 was softened on 27 Jul 2026 to a duty of effort.

  1. Art 5(1)(a) · Provider · Deployer

    The agent did not use manipulative or deceptive techniques that materially distorted a person's decision toward significant harm.

    Judged
    • A judgment. It stays with people; the verdict and who gave it can be recorded.

  2. Art 5(1)(b) · Provider · Deployer

    The agent did not exploit age, disability or socio-economic vulnerability to distort behaviour toward significant harm.

    Judged
    • A judgment. It stays with people; the verdict and who gave it can be recorded.

  3. Art 5(1)(c) · Provider · Deployer

    No decision by the agent treated a person unfavourably on the basis of a social score derived from unrelated context.

    Rule Judged
    • A stated rule, run over the record, marks each case.
    • A judgment. It stays with people; the verdict and who gave it can be recorded.

  4. Art 5(1)(ba)/(bb) — from 2 Dec 2026 · Provider · Deployer

    The agent generated no intimate/sexual imagery of an identifiable person without explicit consent, and no CSAM.

    Rule Fact
    • A stated rule, run over the record, marks each case.
    • On the record: the event is there or it is not, with its time and order.

  5. Art 4 (as amended 27 Jul 2026: a duty of effort) · Provider · Deployer

    The deployer took measures to support AI literacy of staff operating the agent.

    Document
    • A document, cited by digest: present or absent.

Since 2 Aug 2025 (GPAI Chapter V; penalties)

Binds GPAI MODEL providers — relevant to an agent builder as the downstream integrator receiving documentation

  1. Art 53(1)(b) · GPAI provider → integrator

    The agent's model epoch cites the provider's downstream documentation (Annex XII) for the model version actually used.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  2. Art 55(1)(c) (systemic-risk models) · GPAI provider

    Serious incidents involving the model were tracked and reported to the AI Office without undue delay.

    Fact Confirm
    • On the record: the event is there or it is not, with its time and order.
    • The other party's acknowledgement: present or absent.

Since 2 Aug 2026 (general application)

Art 50 is fully live (50(2) grace to 2 Dec 2026 for pre-existing systems). Arts 49/72/73/86 apply on their literal text from this date but presuppose the Dec-2027 regime — CONTESTED; treat as live for readiness, flag to counsel.

  1. Art 50(1) · Provider

    Each natural person interacting with the agent was informed they were interacting with an AI system, at the latest at first interaction (unless obvious).

    Fact
    • On the record: the event is there or it is not, with its time and order.

    Note: “(Commission FAQ names 'AI agents' explicitly.)”

  2. Art 50(2) · Provider

    Synthetic audio/image/video/text output by the agent carried machine-readable marking.

    Fact Rule
    • On the record: the event is there or it is not, with its time and order.
    • A stated rule, run over the record, marks each case.

  3. Art 50(3) · Deployer

    Persons exposed to emotion-recognition or biometric categorisation by the agent were informed.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  4. Art 50(4) · Deployer

    Deepfakes and AI-generated public-interest text published via the agent were disclosed as such, unless human-reviewed under editorial responsibility.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  5. Art 49(1)/(2)/(3) — timing contested · Provider (Deployer if public authority)

    The high-risk system (or self-assessed not-high-risk system) is registered in the EU database, with the registration receipt on the record.

    Confirm
    • The other party's acknowledgement: present or absent.

    Note: “Database reportedly not operational until ~Q3 2027”

  6. Art 72(1)-(2) — literal 2 Aug 2026, timing contested · Provider (deployer supplies data)

    Performance data on the agent was actively and systematically collected and analysed post-market, per the documented plan.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  7. Art 73(2)-(4) — literal 2 Aug 2026, timing contested · Provider (the deployer's duty to inform the provider, Art 26(5), applies only if the system is classified high-risk: from 2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I)

    Every serious incident was reported within 15 days (10 days if death; 2 days if widespread infringement/critical infrastructure) of awareness.

    Fact Confirm
    • On the record: the event is there or it is not, with its time and order.
    • The other party's acknowledgement: present or absent.

  8. Art 86(1) — literal 2 Aug 2026, timing contested · Deployer

    Each affected person who requested it received a clear, meaningful explanation of the agent's role and the main elements of the decision.

    Fact Judged
    • On the record: the event is there or it is not, with its time and order.
    • A judgment. It stays with people; the verdict and who gave it can be recorded.

  9. Arts 75a–75d (AI Office powers, 2 Aug 2026) · Provider (GPAI-based / VLOP-embedded systems)

    Records demanded by the AI Office were producible: complete, checkpointed, and verifiable offline.

    Fact
    • On the record: the event is there or it is not, with its time and order.

From 2 Dec 2027 — Annex III high-risk (Chapter III Sections 1–3: Arts 6–27)

The headline deferral. This is where record-keeping, human oversight and deployer duties bite for agents in Annex III uses (employment, credit, essential services, education, etc.). Every article in this group, Art 26 (deployer duties) included, applies only if the system is classified high-risk: from 2 Dec 2027 for Annex III systems, from 2 Aug 2028 for Annex I. A customer-service agent is not obviously an Annex III use, so classification comes first.

  1. Art 12(1) — only if the system is classified high-risk · Provider

    The agent automatically records events over its lifetime — every consequential action sealed at the time it occurred.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  2. Art 12(2)(a)-(c) — only if the system is classified high-risk · Provider

    The logs are sufficient to identify risk situations, support post-market monitoring, and support the deployer's monitoring duty.

    Document Fact
    • A document, cited by digest: present or absent.
    • On the record: the event is there or it is not, with its time and order.

  3. Art 12(3) — remote biometric ID only; only if the system is classified high-risk · Provider

    For each use: period of use (start/end), reference database checked, input data, and the natural persons who verified the result are recorded.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  4. Art 13(3)(f) — only if the system is classified high-risk · Provider

    The deployer was given the means to collect, store and interpret the agent's logs.

    Document
    • A document, cited by digest: present or absent.

  5. Art 14(3) — only if the system is classified high-risk · Provider · Deployer

    Human-oversight measures commensurate with the agent's autonomy were in place and operated.

    Fact State
    • On the record: the event is there or it is not, with its time and order.
    • The configuration in force when the action ran.

  6. Art 14(4)(d) — only if the system is classified high-risk · Deployer

    The overseer could and did disregard, override or reverse the agent's output where warranted.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  7. Art 14(4)(e) — only if the system is classified high-risk · Provider · Deployer

    The agent could be interrupted or brought to a safe halt; every stop was recorded.

    Fact Document
    • On the record: the event is there or it is not, with its time and order.
    • A document, cited by digest: present or absent.

  8. Art 14(4)(b) — only if the system is classified high-risk · Deployer

    Overseers were made aware of automation bias; approvals were not rubber stamps.

    Document Judged
    • A document, cited by digest: present or absent.
    • A judgment. It stays with people; the verdict and who gave it can be recorded.

  9. Art 15(1),(4) — only if the system is classified high-risk · Provider

    The agent performed consistently through its lifecycle; feedback loops in continually-learning systems were mitigated.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  10. Art 17(1)(i),(j) — only if the system is classified high-risk · Provider

    Post-market monitoring and incident reporting operated as documented QMS components.

    Document Fact
    • A document, cited by digest: present or absent.
    • On the record: the event is there or it is not, with its time and order.

  11. Art 26(1) — only if the system is classified high-risk · Deployer

    The agent was used in accordance with the provider's instructions for use.

    State Rule
    • The configuration in force when the action ran.
    • A stated rule, run over the record, marks each case.

  12. Art 26(2) — only if the system is classified high-risk · Deployer

    Human oversight was assigned to competent, trained, authorised persons.

    Document Fact
    • A document, cited by digest: present or absent.
    • On the record: the event is there or it is not, with its time and order.

  13. Art 26(4) — only if the system is classified high-risk · Deployer

    Input data under the deployer's control was relevant and sufficiently representative for the intended purpose.

    Judged Document
    • A judgment. It stays with people; the verdict and who gave it can be recorded.
    • A document, cited by digest: present or absent.

  14. Art 26(5) — only if the system is classified high-risk · Deployer

    Operation was monitored; risks to health/safety/rights were escalated (suspend + notify) and serious incidents were reported to the provider immediately.

    Fact Confirm
    • On the record: the event is there or it is not, with its time and order.
    • The other party's acknowledgement: present or absent.

  15. Art 26(6) — only if the system is classified high-risk · Deployer

    Automatically generated logs were retained for at least six months.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  16. Art 26(7) — only if the system is classified high-risk · Deployer

    Workers' representatives and affected workers were informed before the agent was deployed at the workplace.

    Fact Document
    • On the record: the event is there or it is not, with its time and order.
    • A document, cited by digest: present or absent.

  17. Art 26(11) — only if the system is classified high-risk · Deployer

    Natural persons subject to decisions made or assisted by the agent were informed of that fact.

    Fact
    • On the record: the event is there or it is not, with its time and order.

  18. Art 27 (narrow trigger) — only if the system is classified high-risk · Deployer (public bodies; credit/insurance uses)

    A fundamental-rights impact assessment was performed before first use and notified to the authority.

    Document Confirm
    • A document, cited by digest: present or absent.
    • The other party's acknowledgement: present or absent.

  19. Art 9(2)(c) — only if the system is classified high-risk · Provider

    Risk management consumed post-market monitoring data across the lifecycle.

    Document Fact
    • A document, cited by digest: present or absent.
    • On the record: the event is there or it is not, with its time and order.

  20. Art 11 / Annex IV — only if the system is classified high-risk · Provider

    Technical documentation describes the logging capability actually deployed.

    Document
    • A document, cited by digest: present or absent.

From 2 Aug 2028 — Annex I product-embedded high-risk

Same obligations as the 2 Dec 2027 group for agents embedded in regulated products (machinery, medical devices, vehicles…). The dates differ.

  1. Arts 6–27 via Annex I — only if the system is classified high-risk · Provider · Deployer

    Every row in the 2 Dec 2027 group applies to agents embedded in Annex I products, only if the system is classified high-risk.

    See it on real records

    The sample report shows each item as present, absent, or judged.

    Open the sample report → Both packs Ask us about it