The EU AI Act timeline for autonomous agents

It does not name agents as a category at all; it regulates by risk and by role, and an agent inherits its obligations from what it actually does. If your agent interacts with people or generates content, the Article 50 transparency duties apply. If it operates in a high-risk domain listed in Annex III — hiring, credit scoring, critical infrastructure and similar — the high-risk obligations apply, with their conformity, risk-management and oversight requirements. If it is built on a general-purpose model, GPAI obligations flow down to you from the model provider. The practical consequence is liberating: you do not need a legal ruling on whether your system counts as an agent, because the law never asks that question. You map your agent's concrete behaviours onto the Act's risk tiers and adopt whichever duties those behaviours trigger. When in doubt, classify by the most consequential thing the agent can do, not by the most flattering description of it.

The Article 50 transparency obligations become enforceable, which for most agent teams is the nearest hard deadline in the whole Act. Three duties matter in practice. First, disclosure: if a user is interacting with an AI system, they must be able to tell, unless it is already obvious from context. Second, content labeling: output that is generated or meaningfully manipulated by AI has to be marked as such, in a machine-readable way where feasible. Third, deepfake marking: synthetic image, audio or video must be disclosed. For an agent that chats with customers or produces written, visual or audio content, that translates into a clear notice in the interface plus a provenance signal on generated artefacts. The engineering is modest — mostly interface text, a content-provenance marker and a record that the disclosure happened — but the date is fixed, so it belongs on the roadmap now rather than in mid-2026.

The 7% figure is real but routinely misapplied. The highest tier — up to 35 million euro or 7% of global annual turnover, whichever is greater — is reserved for prohibited practices under Article 5, meaning manipulative or exploitative systems that the Act bans outright. Ordinary transparency duties under Article 50 do not sit in that tier; most obligations, including high-risk and transparency, fall under a lower ceiling of up to 15 million euro or 3% of turnover, and supplying incorrect information to authorities is lower still. Quoting the 7% number against a missing disclosure label is therefore inaccurate, and for SMEs the Act generally applies the lower of the fixed amount or the percentage. Describing the penalty honestly — naming the right tier for the right breach — is both more correct and more credible than reaching for the scariest figure, which is exactly the posture a regulator and a customer both reward.

Very often, yes, because the Act follows the market rather than the company's address. Its scope is extraterritorial: it reaches providers and deployers established outside the EU when their AI system is placed on the EU market, or when the system's output is used within the EU. So a company headquartered elsewhere that offers an agent to EU users, or whose agent produces results consumed in the EU, generally falls within scope even with no EU office. This mirrors the familiar reach of the GDPR and is deliberate, to prevent regulatory arbitrage. The practical takeaway is not to assume you are exempt because you are not an EU entity; instead, check whether EU users interact with your agent or rely on its output, and if they do, plan for the same Article 50 and, where relevant, high-risk obligations as an EU-based provider would. Geography of incorporation is the wrong test; where the system and its effects land is the right one.