EU AI Act
Keep your agent working in the EU as the AI Act phases in
Your agent can keep serving EU customers when your compliance team can show, decision by decision, that people oversaw it and the logs were kept. VeriProof records both as the agent works, so the evidence exists before anyone asks for it.
Three dates to plan around
Scroll horizontally to see all columns.
| Applies from | What starts | Who it reaches |
|---|---|---|
| August 2, 2026 (in effect) | Article 50 transparency duties | Providers and deployers of AI systems that interact with people or generate content, such as a customer-facing agent that must say it's an AI |
| December 2, 2027 | High-risk obligations for Annex III uses | Systems used in areas such as employment, credit scoring, access to essential services, and education |
| August 2, 2028 | High-risk obligations for Annex I products | AI that is a safety component of products already covered by EU product law, such as machinery and medical devices |
The AI Omnibus moved the Annex III date from August 2026. Penalties are set out in Article 99. The regulatory timeline keeps these dates next to other rules that reach AI agents.
If your company deploys the agent
Most businesses that put an agent to work are deployers, not providers. For a high-risk system, Article 26 asks the deployer to:
- use the system according to the provider's instructions
- assign human oversight to people with the competence, training, and authority to do it
- make sure the input data they control is relevant to the system's purpose
- monitor the system in operation and tell the provider about risks or serious incidents
- keep the logs the system generates, where they are under the deployer's control, for at least six months
- inform workers and their representatives before using the system at work, and tell people when a high-risk system makes or helps make decisions about them
Several of these are organizational steps only your team can take. The oversight, monitoring, and log duties are where recorded decisions help most.
Requirement to evidence
Scroll horizontally to see all columns.
| Article | What it asks for | What VeriProof provides | What your reviewer sees |
|---|---|---|---|
| Article 12, record-keeping | High-risk systems allow automatic recording of events over their lifetime. | A decision record written at each policy check, as part of the check, with the facts, the rule version, and the outcome the application reported. | A timestamped history of each decision that shows which rule version applied |
| Article 14, human oversight | People can understand the system's output, decide not to use it, and intervene or stop it. | Escalation rules that pause an action and send it to a person with authority, with the context and the responses available to them. | Who was asked, what they saw, what they decided, and what the agent did next |
| Article 26, deployer obligations | Assign competent oversight, monitor operation, and keep generated logs for at least six months. | Review routing that sends each exception to a person with authority, reminders and escalation for overdue reviews, and retention you set per application. | Who handled each exception and the log retention in force |
| Article 72, post-market monitoring | Providers collect and analyze data on the system's performance throughout its life. | Policy outcomes, exceptions, and overrides from live decisions, trended over time. | How often the agent needed a person, and whether that is changing |
| Article 73, serious incidents | Providers report serious incidents to the market surveillance authority within set deadlines. | The decision records and review history for the actions involved, exportable as one evidence pack. | The sequence of events behind the incident, with integrity proofs |
Your legal team decides your role under the Act and whether the system is high-risk. The mapping gives them the operating evidence for the duties that apply.
Reading Article 12 as an engineer
Article 12 turns on two words: automatic, and lifetime. Our field note walks through what that means when an agent proposes an action and a person approves it.
Open a sample pack before your next review
The sample evidence pack shows the decision records, reviewer decisions, redaction report, and proofs a reviewer would receive, using synthetic data.
Sources
The consolidated EU AI Act on EUR-Lex sets out the requirements and operator roles. The Commission's AI Act Service Desk timeline lists the application dates.