The EU AI Act timeline for autonomous agents
When each EU AI Act obligation actually bites — the Article 50 transparency duties have applied since 2 August 2026, and the next hard deadline for agent teams is the high-risk requirements on 2 December 2027.
Definition
The EU AI Act is the European Union's risk-based AI regulation. Its obligations phase in over several years; the Article 50 transparency duties, which govern how AI involvement must be disclosed, have applied since 2 August 2026, and the nearest upcoming deadline for agents is the high-risk requirements on 2 December 2027.
Most teams building autonomous agents know the EU AI Act exists. Far fewer know when each part applies to them. The Act does not switch on all at once — it phases in by risk tier over several years. For agents the first big clock has already struck: the Article 50 transparency duties have applied since 2 August 2026, and the next hard deadline — the high-risk requirements under Annex III — falls on 2 December 2027 (deferred by the Digital Omnibus).
The Act regulates behavior, not the label “agent”
The AI Act never defines an “agent” as a regulated category. It regulates by risk and by role. That is good news: you do not need a lawyer to tell you whether your system is “an agent.” You map what your agent does onto the Act’s obligations.
- Does it interact with people or generate content? Article 50 transparency applies.
- Does it operate in a high-risk domain (Annex III) such as hiring, credit or critical infrastructure? High-risk obligations apply.
- Is it built on a general-purpose model? GPAI obligations flow down from the provider.
The phased timeline
Prohibited practices + AI literacy
Article 5 bans take effect; Article 4 requires staff to have adequate AI literacy.
GPAI obligations begin
Duties for general-purpose AI model providers start to apply.
Article 50 transparency enforceable
Disclosure of AI interaction, labeling of AI-generated content, deepfake marking. Now in force.
High-risk (Annex III) duties
Conformity, risk management and oversight obligations for high-risk use cases. Deadline deferred by the Digital Omnibus.
Remaining high-risk (Annex I)
Obligations tied to regulated products phase in.
What does Article 50 actually require of an agent?
Since 2 August 2026, three duties matter to a typical agent:
- Disclose the AI. If a user interacts with your agent, they must be able to tell it is an AI system, unless it is obvious from context.
- Label AI-generated content. Output that is generated or meaningfully manipulated by AI must be marked as such, in a machine-readable way where feasible.
- Mark deepfakes. Synthetic image, audio or video content must be disclosed.
None of this is exotic. The engineering work is mostly plumbing: a disclosure in the interface, a content-provenance signal, and a record that the disclosure happened.
| Duty | Triggers when | How to implement |
|---|---|---|
| Disclose the AI | A user interacts with the agent | Clear in-interface notice, not a footer |
| Label AI content | The agent generates or edits text or media | Machine-readable provenance, e.g. C2PA |
| Mark deepfakes | Synthetic media resembles real people or events | Explicit disclosure on the artefact |
Two implementation details carry most of the weight. Prefer a content-provenance standard such as C2PA over a visible caption alone: a caption can be cropped away, an embedded signal travels with the file. And record that each disclosure was shown — that log entry turns “we comply” into something you can demonstrate. If you want an external check that these duties map cleanly onto your systems, an AI Act compliance audit is a practical starting point.
The honest version of the penalty story
It is tempting to sell compliance with the scary number. Resist it. The 35 million euro / 7% of turnover tier is reserved for prohibited practices under Article 5 — manipulative or exploitative systems — not for missing a transparency label. Article 50 breaches sit in a lower tier. Communicating this accurately is itself a trust signal: you describe a real, dated obligation without manufacturing fear.
The fine tiers, so the 7% figure lands on the right breach:
| Breach tier | What it covers | Maximum fine |
|---|---|---|
| Prohibited practices (Art. 5) | Manipulative, exploitative or banned systems | €35M or 7% of global turnover |
| Other obligations (incl. Art. 50, high-risk) | Transparency, high-risk and provider duties | €15M or 3% of turnover |
| Incorrect information to authorities | Misleading or incomplete information to regulators | €7.5M or 1% of turnover |
What to do now — Article 50 already applies
- Inventory every agent that talks to people or produces content.
- Add clear AI disclosure to those interfaces.
- Capture signed, tamper-evident audit logs of agent decisions — a log that can be altered is worthless before an EU court.
- Document who is accountable for each agent’s actions.
For the controls that make oversight real, see human oversight; for the audit-logging foundation, see observability. Definitions of the terms above live in the glossary.
Frequently asked questions
Does the AI Act regulate AI agents specifically?
No — the Act never names agents as a category. It regulates by risk and by role, so an agent inherits obligations from what it does: interacting with people or generating content triggers Article 50; operating in an Annex III domain such as hiring or credit triggers the high-risk regime; building on a general-purpose model brings GPAI duties down from the provider. Map behaviours to tiers; the label does not matter.
When is AI disclosure not required under Article 50?
When AI involvement is already obvious from context — judged by the ordinary user, not the builder. In practice the exemption is narrower than teams hope: what feels obvious to you is often not obvious to a first-time user. Purely internal tooling with no person on the other side and no published output also falls outside the duty. The safe default is to disclose, and to document the judgement whenever you rely on the exemption instead.
Is it true that fines reach 7% of turnover?
The figure is real but belongs to a different breach. The €35M / 7% tier is reserved for prohibited practices under Article 5. Transparency and most other duties, Article 50 included, sit under a €15M / 3% ceiling, and misinforming authorities lower still. Quoting 7% at a missing disclosure label is inaccurate — and regulators and customers both notice inflated numbers.
Does the AI Act apply if my company is outside the EU?
Usually yes, because the Act follows the market, not your address. It reaches providers and deployers outside the EU when the system is placed on the EU market or its output is used in the EU — the same extraterritorial logic as the GDPR. The right test is where your users and the system's effects are, not where the company is registered.