AI agents act autonomously. Your governance has to keep up.
Agents answer customer questions, write code, prepare decisions and execute multi-step tasks without a human watching every move. That autonomy is exactly what sharpens the usual AI governance questions: who is responsible, what oversight is appropriate, and what must you be able to show?
Why agents demand their own approach
Autonomy is the risk factor
The EU AI Act fully covers agents: autonomy is literally part of the definition of an AI system. The more independent the agent, the heavier the questions about human oversight, logging and intervention weigh.
The transparency deadline applies to agents too
From 2 August 2026, AI systems interacting with people must identify themselves as AI and AI-generated content must be recognisable. A customer-facing agent falls squarely under that.
The chain is diffuse
Model from one party, agent platform from another, configuration by your own team. Which obligation sits where, and when Article 25 turns you into a provider yourself, must be determined per agent.
Decisions with legal effect
An agent that autonomously takes or prepares decisions about people already touches Article 22 GDPR today. That requires human intervention and explainability, independent of the AI Act timeline.
The approach, at fixed prices
Prices excluding VAT. Fixed scope, four guarantees, no hourly billing. The quickscan is obligation-free.
What lands on the table
Agent register
Every agent in view: purpose, autonomy level, permissions, owner, underlying model and vendor.
Role allocation per agent
Provider, deployer, or provider after all via Article 25: substantiated per agent, with the corresponding obligations.
Oversight that works
Human-in-the-loop where required, on-the-loop where possible: approval thresholds, escalation routes and a kill switch that actually works.
Evidence
Logging and traceability of agent actions, so you can show a regulator, auditor or client who did what and why.
Frequently asked questions about agentic AI governance
Does an AI agent fall under the EU AI Act?
Yes. The definition of an AI system in Article 3 explicitly mentions autonomy, so agents fall fully under the regulation. There is no separate agent regime: the task the agent performs determines the risk category and therefore the obligations. An agent that interacts with people additionally touches the Article 50 transparency obligations from 2 August 2026.
Who is responsible when an agent makes a mistake?
The organization deploying the agent remains responsible for its processes and decisions; "the AI did it" is not a defence. The model provider and platform provider carry their own obligations as well. Documenting the role allocation per agent, including whether Article 25 makes you a provider yourself, is therefore the core of the governance work.
May an agent take decisions about customers or employees autonomously?
For decisions with legal or similarly significant effect, Article 22 GDPR already applies today: individuals have a right to human intervention. In practice you arrange that with approval thresholds: the agent prepares, a human decides where impact is high. For high-risk tasks the AI Act human oversight regime comes on top.
We build our own agents on a GPAI model. Does that change our role?
Possibly. Whoever places an agent on the market under their own name, substantially modifies it or repurposes it for a high-risk use can become a provider via Article 25, with the corresponding documentation and conformity obligations. This is one of the first questions we answer per agent in the sprint.
What does getting agentic AI governance in order cost?
The quickscan is free. The Readiness Sprint with agentic scope costs EUR 9,900 fixed and delivers the register, classification, oversight framework and roadmap. The EUR 21,900 fixed Compliance Bundle adds implementation: logging, policy, vendor dossiers and Article 4 evidence. Fixed prices, fixed scope, four guarantees.
Our staff work with agents daily. Does that count for Article 4?
Yes. The AI literacy provision has applied since February 2025, and with agents it matters even more that users know what the agent may and may not do autonomously, how to check output and when to escalate. Through our sister platform LearnWize you build an audit-proof evidence dossier for that per role.
Need the deeper legal analysis? Read the full guide on the Responsible AI Platform: Agentic AI under the EU AI Act
Start with visibility on your agents
Take the free quickscan. You immediately see which agents and obligations need priority and which route fits.