EU AI Act Compliance for AI Agent Buyers (2026)

The four risk tiers (in plain English)

Unacceptable / prohibited. Subliminal manipulation that exploits vulnerabilities, social scoring by public authorities, real-time remote biometric identification in public spaces (with narrow law-enforcement exceptions), exploitation of children. Cannot be deployed at all in the EU.
High-risk. Recruiting / CV screening, credit scoring, education admission, critical infrastructure, biometric categorisation, law enforcement profiling, medical devices, etc. Requires risk management system, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness testing, conformity assessment, EU database registration.
Limited-risk. AI systems that interact with people (chatbots, agents), generate or manipulate content (deep-fakes), recognise emotions. Main obligation is transparency: clearly disclose to the user that they are interacting with an AI; label synthetic content.
Minimal-risk. Spam filters, AI in video games, basic productivity AI. No specific obligations beyond existing law (GDPR, consumer protection).

Most workflow agents people are buying in 2026 — lead routing, meeting summarisation, calendar autopilot, internal data extraction — fall into limited-risk. Hiring, credit, and medical agents fall into high-risk.

The GPAI layer (foundation models)

Beyond the risk-tier obligations on the deployer, the AI Act imposes a separate set of duties on general-purpose AI (GPAI) providers — OpenAI, Anthropic, Google, Mistral, Meta. These cover technical documentation, copyright training-data disclosure, and (for "systemic-risk" GPAI) extra evaluation, incident reporting, and cybersecurity standards. As a buyer, this is mostly indirect: you should expect your model provider to publish a summary of training-data and offer model documentation. Ask for it.

2026 enforcement timeline (what is in force, what is coming)

February 2025 — prohibitions on unacceptable-risk uses + AI literacy obligations apply. Already in force.
August 2025 — obligations on GPAI providers (including transparency) apply. Already in force.
August 2026 — the bulk of high-risk obligations apply, plus penalties for breaches. National supervisory authorities ramp up enforcement through Q3-Q4 2026.
August 2027 — full applicability, including high-risk product-safety integration.

Practical 2026 reality: limited-risk transparency rules are already enforceable. Plan for the August 2026 high-risk deadline if any of your agents touch the listed sectors. Many enterprises are taking a precautionary approach in 2026 even where strictly only required from 2027.

Buyer pre-deployment checklist

Before you ship an AI agent in the EU:

Classify the use case. Walk through the four risk tiers. Be honest about what the agent could be used for, not just the headline use case. If in doubt, escalate to counsel.
Disclose AI use to end users. Mandatory for limited-risk and above. Plain-language label, not legalese.
Obtain a model card or technical doc from your platform / model provider. If they cannot supply it, you are taking on documentation duty yourself.
Document the human-oversight path. Who reviews escalations? Who can override the agent? What is the kill-switch?
Log decisions. Most agent platforms (Lindy, Gumloop, Voiceflow, Relevance AI) ship execution logs by default. Preserve them at least one year.
Run prompt-injection + jailbreak tests. Document the result. The AI Act expects "robustness" — not perfection, but evidence of reasonable testing.
For high-risk uses, additionally: register in the EU AI database, pass conformity assessment, implement a risk-management system, retain a notified body for review.

How this intersects with GDPR + California ADMT

The AI Act sits on top of the existing GDPR framework, not instead of it. Every obligation that applied to your data processing before — lawful basis, data-subject rights, DPIA for high-risk processing — still applies. The AI Act adds more obligations specific to the AI system. In practice, agents trained or fine-tuned on personal data trigger both regimes; pure prompt-engineering agents on hosted GPAI models trigger mainly the AI Act transparency layer and standard GDPR controller / processor analysis with the model provider. See our AI Agents and GDPR guide for the GDPR-specific buyer checklist.

If your deployment also touches California consumers, add the CCPA Automated Decision-Making Technology rules on top — jurisdictionally separate but conceptually similar to GDPR Art. 22 and the AI Act's transparency obligations. For procurement-level vendor due diligence, see SOC 2 for AI Agents.

What this means for your platform choice

Most top-tier agent platforms in 2026 ship with EU-compatible defaults: EU data residency options, audit logs, role-based access, prompt-injection guardrails, the option to bring your own model. The platforms most explicit about EU AI Act readiness are the ones with European customer bases (n8n is Germany-headquartered with self-hosting in your data centre as the strongest data-control posture; Voiceflow + Botpress ship EU-region deployments). For high-risk use cases, demand the platform's AI-Act compliance documentation up front; if they cannot supply it, walk away.