The EU AI Act is the first comprehensive attempt to regulate artificial intelligence, and it is phasing into force now. For teams deploying AI agents it can feel daunting, but the core idea is pragmatic: the more risk an AI use carries, the more you have to do about it. Most of the preparation is good governance you would want regardless. This is practical guidance, not legal advice — involve your legal and compliance teams on anything specific.

What the Act does, in plain terms

The Act regulates AI by use and risk rather than by technology. It bans a small set of unacceptable practices outright, imposes substantial obligations on a defined set of high-risk uses, requires transparency for certain limited-risk uses, and leaves the large minimal-risk category mostly alone. Obligations apply on a phased timeline, so different requirements take effect at different points.

The risk tiers

  • Unacceptable risk — prohibited uses (for example, certain manipulative or social-scoring systems).
  • High risk — uses in sensitive areas carry strict obligations: risk management, data governance, documentation, human oversight, accuracy and more.
  • Limited risk — transparency obligations, such as telling people they are interacting with AI or that content is AI-generated.
  • Minimal risk — the majority of uses, largely unregulated.

Where AI agents usually land

An agent workflow is assessed like any other AI use — by what it does. Many internal, bounded workflows (triaging an inbox, preparing a draft, chasing a document) sit in limited or minimal risk. But agents used in areas such as recruitment, creditworthiness, or access to essential services can fall into the high-risk tier, with real obligations. The first job is therefore to classify each use honestly, which is exactly what our AI assurance work does.

Transparency and human oversight

Two themes recur throughout the Act and are worth designing for now regardless of tier: transparency (people should know when they are dealing with AI) and human oversight (a person should be able to understand, intervene in and override high-stakes AI decisions). Both map directly onto how we already build agents — disclosure where appropriate, and the human-in-the-loop design that keeps people in control.

Practical steps to prepare

You do not prepare for the Act with a legal memo alone; you prepare by running AI well. Inventory your AI uses, classify each by risk, add transparency where required, design proportionate human oversight, and keep documentation and evidence so you can demonstrate diligence. That is the same evidence-led governance covered in our AI governance checklist — and where you need a roadmap for the board, our strategy and advisory practice can help sequence it.