As of 29 September 2026, the EU AI Act is partly applicable. The transparency duties in Article 50 have applied since 2 August 2026. Prohibited practices and the rules for general-purpose AI already applied earlier. What changed in July is the high-risk timetable: the EU's Digital Omnibus on AI moved the rules for Annex III high-risk systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028[1]. The later deadlines give teams more time to classify systems and build the controls the Act describes.
What changed on 29 September 2026: the fundamental-rights impact assessment now covers credit and insurance uses correctly, the December 2027 row names credit scoring, and the page answers the questions teams ask most.
What is the EU AI Act timeline now?
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices and the Act's definitions began to apply. The 2026 Omnibus simplified the AI-literacy duty for companies, with the Commission and the Member States taking a stronger role in promoting AI literacy. |
| 2 August 2025 | Governance rules and obligations for providers of general-purpose AI models began to apply. |
| 2 August 2026 | Article 50 transparency rules began to apply, including disclosure for certain AI interactions and labelling or marking duties for specified AI-generated content. |
| 2 December 2026 | New prohibitions apply to AI systems that generate non-consensual sexual deepfakes or child sexual abuse material. It is also the transitional deadline for providers of systems generating synthetic content that were already on the market before 2 August 2026 to meet the Article 50(2) marking duties. |
| 2 December 2027 | High-risk rules apply to Annex III uses such as employment, education, biometrics, migration and essential services, including creditworthiness assessment and credit scoring (point 5(b)) and risk assessment and pricing in life and health insurance (point 5(c)). |
| 2 August 2028 | High-risk rules apply to AI that is a regulated product, or a safety component of one, under Article 6(1). |
The shift is narrower than the headline "the AI Act was delayed." The Commission's Article 50 guidance was published on 20 July and those transparency obligations are live[2]. The EU moved the high-risk dates because standards and support measures were not ready. The underlying requirements remain.
How does the Act classify an AI agent?
The Act classifies an AI system primarily by its intended purpose and use. Calling the interface an agent, copilot, or workflow does not determine its category. An agent that drafts internal summaries may sit outside the high-risk categories. The same technical stack used to screen job candidates, determine access to essential services, assess creditworthiness, or make certain decisions about workers may fall into an Annex III category. The Commission's 2026 classification guidance gives practical examples, but it also says those examples are not exhaustive[3].
A company may be a provider, a deployer, or both in different parts of the same agent stack. The intended purpose of the system you assemble, how you put it into service, and whether you substantially modify an existing system all affect the analysis, regardless of who supplied the underlying model. Classify the system before production, with legal advice for the actual use case.
What should deployers of action-taking agents prepare?
For high-risk systems, the deployer obligations require operational controls that work in production. Article 26 requires deployers to use the system according to its instructions, assign competent people with real authority for human oversight, monitor operation, act on risks or serious incidents, and retain logs under their control for at least six months unless another law provides otherwise[4]. Some deployers must also carry out a fundamental-rights impact assessment before first use: public bodies, private entities providing public services, and deployers of high-risk systems that assess creditworthiness or set credit scores, or that price life and health insurance (Annex III points 5(b) and 5(c))[6]. A lender or BNPL provider that uses AI for credit decisions is in that group.
For an agent that can pay, provision, approve, delete, or publish, that translates into five concrete engineering questions:
- Scope: which systems and real-world decisions can this agent affect?
- Authority: which actions are allowed, under which policy version, and within what limits?
- Oversight: where can a qualified person review, approve, suspend, or stop an action?
- Monitoring: how will operators detect drift, policy violations, and serious incidents?
- Evidence: can you reconstruct the decision, authority, approval, action, and outcome later?
Does Article 50 apply to a customer-support agent?
Usually yes, if customers talk to it. Article 50(1) requires that people are told they are interacting with an AI system, unless that is obvious from the context, and it has applied since 2 August 2026. The duty sits with the provider. A firm that builds or assembles an agent and puts it into service under its own name is usually its provider, so the disclosure is often the firm's own job; confirm the role split for your setup with counsel[5].
Article 50 also requires some AI-generated or manipulated content to be marked or labelled. An internal action ledger cannot replace a customer-facing disclosure. Both layers may be necessary.
How does DORA apply to AI agents at a financial entity?
For EU financial entities the nearer rule is not the AI Act but DORA, Regulation (EU) 2022/2554, which has applied since 17 January 2025. Its scope includes payment institutions, electronic money institutions and crypto-asset service providers authorised under MiCA. DORA makes the entity responsible for the ICT risk of every system that acts on its behalf, including systems supplied by third parties, and requires a register of information on its ICT third-party arrangements. An AI agent that executes refunds, payouts or account changes is such a system, and its supplier is such a third party. The practical questions are the five above: scope, authority, oversight, monitoring and evidence. The auditor will ask who approved each action and how the record can be trusted. For the register, contract and record in detail, see what DORA requires the Head of Operations to show.
Where FeirOS fits
FeirOS provides an operational control layer. It sits between agents and sensitive systems so an action can be checked against policy before execution, carried out without giving the agent a standing credential, metered against a budget, and sealed into a signed, hash-chained evidence record afterward. Those controls can support an organization's oversight, monitoring, and record-keeping work. EU AI Act compliance requires work outside FeirOS, including system classification, technical documentation, fundamental-rights impact assessments, and labels for AI-generated content.
| Operational question | How FeirOS helps | What remains yours |
|---|---|---|
| Was the action authorized? | Evaluates routed actions against policy, approvals, and authority before execution. | Define lawful policy, roles, risk classification, and oversight design. |
| Could the agent exceed its mandate? | Uses a default-deny boundary, brokered credentials, and metered budgets. | Route every relevant action through the boundary and close direct paths. |
| Can we prove what happened? | Seals governed decisions into signed, hash-chained records that can be verified offline. | Set retention, cover events outside FeirOS, protect personal data, and meet regulatory reporting duties. |
| Was the person properly informed? | Provides action evidence that can support internal review. | Implement Article 50 disclosures, content marking, notices, and user-facing explanations. |
The coverage boundary is important: FeirOS can only govern and prove actions routed through it. A direct database write, an unmanaged API key, or an external model call remains outside its record. Compliance depends on the architecture and operating practice around the product.
Common questions about the AI Act and AI agents
Is the EU AI Act delayed?
Partly. The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products. The prohibited practices (since 2 February 2025), the general-purpose AI rules (since 2 August 2025) and the Article 50 transparency rules (since 2 August 2026) were not delayed.
Is an AI agent in customer operations high-risk?
Usually not by its purpose alone. Handling customer cases, refunds or payouts is not an Annex III use. The same system becomes high-risk if it is used for an Annex III purpose, such as assessing creditworthiness or setting credit scores, and those rules apply from 2 December 2027. DORA applies to the agent now either way.
Is AML transaction monitoring high-risk under the AI Act?
It is not named in Annex III. Point 5(b) covers creditworthiness and credit scoring and excludes systems used to detect financial fraud, and point 6 covers use by or on behalf of law enforcement authorities[7]. A firm monitoring transactions for its own AML duties is neither, but check the facts of your system with counsel.
What to do before 2027
Use the additional time to inventory agent use cases, classify them by intended purpose, map provider and deployer roles, and turn oversight into enforceable system behavior. Start with the sensitive action path: define authority, require approval where consequence demands it, keep credentials out of the agent, add a real stop mechanism, and preserve independently verifiable evidence before autonomous operations spread across the company.
Where to start: choose one consequential workflow and put its actions behind the authorize, bound, prove boundary. See AI agents in payment operations, or how FeirAI deploys governed agents for EU crypto and fintech operations.
Sources
- European Commission, AI Omnibus enters into force, 27 July 2026; Regulation (EU) 2026/1744.
- European Commission, Guidelines on transparency obligations for providers and deployers of AI systems, 20 July 2026.
- European Commission, Draft guidelines on the classification of high-risk AI systems, 19 May 2026.
- EU AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems.
- European Commission, Quick facts: transparency rules for AI systems, updated 29 July 2026.
- EU AI Act Service Desk, Article 27: Fundamental rights impact assessment for high-risk AI systems.
- EU AI Act Service Desk, Annex III: High-risk AI systems referred to in Article 6(2).
This article provides general information, not legal advice. The classification and obligations for a particular system depend on its facts, role, and intended purpose.