As of 11 August 2026, the EU AI Act is partly applicable. The transparency duties in Article 50 have applied since 2 August 2026. Prohibited practices and the rules for general-purpose AI already applied earlier. What changed in July is the high-risk timetable: the EU's Digital Omnibus on AI moved the rules for Annex III high-risk systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028[1]. The later deadlines give teams more time to classify systems and build the controls the Act describes.
What is the EU AI Act timeline now?
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices and the Act's definitions began to apply. The 2026 Omnibus replaced the former company AI-literacy duty with non-binding encouragement. |
| 2 August 2025 | Governance rules and obligations for providers of general-purpose AI models began to apply. |
| 2 August 2026 | Article 50 transparency rules began to apply, including disclosure for certain AI interactions and labelling or marking duties for specified AI-generated content. |
| 2 December 2027 | High-risk rules apply to Annex III uses such as employment, education, essential services, biometrics, and migration. |
| 2 August 2028 | High-risk rules apply to AI that is a regulated product, or a safety component of one, under Article 6(1). |
The shift is narrower than the headline "the AI Act was delayed." The Commission's Article 50 guidance was published on 20 July and those transparency obligations are live[2]. The EU moved the high-risk dates because standards and support measures were not ready. The underlying requirements remain.
How does the Act classify an AI agent?
The Act classifies an AI system primarily by its intended purpose and use. Calling the interface an agent, copilot, or workflow does not determine its category. An agent that drafts internal summaries may sit outside the high-risk categories. The same technical stack used to screen job candidates, determine access to essential services, assess creditworthiness, or make certain decisions about workers may fall into an Annex III category. The Commission's 2026 classification guidance gives practical examples, but it also says those examples are not exhaustive[3].
A company may be a provider, a deployer, or both in different parts of the same agent stack. The intended purpose of the system you assemble, how you put it into service, and whether you substantially modify an existing system all affect the analysis, regardless of who supplied the underlying model. Classify the system before production, with legal advice for the actual use case.
What should deployers of action-taking agents prepare?
For high-risk systems, the deployer obligations require operational controls that work in production. Article 26 requires deployers to use the system according to its instructions, assign competent people with real authority for human oversight, monitor operation, act on risks or serious incidents, and retain logs under their control for at least six months unless another law provides otherwise[4]. Public authorities and some providers of public services also face a fundamental-rights impact assessment before first use.
For an agent that can pay, provision, approve, delete, or publish, that translates into five concrete engineering questions:
- Scope: which systems and real-world decisions can this agent affect?
- Authority: which actions are allowed, under which policy version, and within what limits?
- Oversight: where can a qualified person review, approve, suspend, or stop an action?
- Monitoring: how will operators detect drift, policy violations, and serious incidents?
- Evidence: can you reconstruct the decision, authority, approval, action, and outcome later?
Article 50 adds a separate concern: people may need to know that they are interacting with AI, and some AI-generated or manipulated content must be marked or labelled. An internal action ledger cannot replace a customer-facing disclosure. Both layers may be necessary[5].
Where FeirOS fits
FeirOS provides operational governance infrastructure. It sits between agents and sensitive systems so an action can be checked against policy before execution, carried out without giving the agent a standing credential, metered against a budget, and sealed into a signed, hash-chained evidence record afterward. Those controls can support an organization's oversight, monitoring, and record-keeping work. EU AI Act certification requires work outside FeirOS, including system classification, technical documentation, fundamental-rights impact assessments, and labels for AI-generated content.
| Operational question | How FeirOS helps | What remains yours |
|---|---|---|
| Was the action authorized? | Evaluates routed actions against policy, approvals, and authority before execution. | Define lawful policy, roles, risk classification, and oversight design. |
| Could the agent exceed its mandate? | Uses a default-deny boundary, brokered credentials, and metered budgets. | Route every relevant action through the boundary and close direct paths. |
| Can we prove what happened? | Seals governed decisions into signed, hash-chained records that can be verified offline. | Set retention, cover events outside FeirOS, protect personal data, and meet regulatory reporting duties. |
| Was the person properly informed? | Provides action evidence that can support internal review. | Implement Article 50 disclosures, content marking, notices, and user-facing explanations. |
The coverage boundary is important: FeirOS can only govern and prove actions routed through it. A direct database write, an unmanaged API key, or an external model call remains outside its record. Compliance depends on the architecture and operating practice around the product.
What to do before 2027
Use the additional time to inventory agent use cases, classify them by intended purpose, map provider and deployer roles, and turn oversight into enforceable system behavior. Start with the sensitive action path: define authority, require approval where consequence demands it, keep credentials out of the agent, add a real stop mechanism, and preserve independently verifiable evidence before autonomous operations spread across the company.
Where to start: choose one consequential workflow and put its actions behind the authorize, bound, prove boundary. See FeirOS for organizations, read what an agent audit trail requires, or open the live demo.
Sources
- European Commission, AI Omnibus enters into force, 27 July 2026; Regulation (EU) 2026/1744.
- European Commission, Guidelines on transparency obligations for providers and deployers of AI systems, 20 July 2026.
- European Commission, Draft guidelines on the classification of high-risk AI systems, 19 May 2026.
- EU AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems.
- European Commission, Quick facts: transparency rules for AI systems, updated 29 July 2026.
This article provides general information, not legal advice. The classification and obligations for a particular system depend on its facts, role, and intended purpose.