Does the EU AI Act apply to my AI agent?

Only if the agent is placed on the market as, or deployed inside, a high-risk use listed in Annex III (recruitment, credit, safety systems, etc.). General-purpose agents outside those uses are generally out of scope. Most duties then fall on the deployer, not the model provider.

What is the current high-risk effective date?

Several Annex III high-risk obligations were delayed by the Digital Omnibus and currently track toward 2 December 2027. Effective dates change — verify against the Official Journal and the Commission before relying on a timeline.

Am I the provider or the deployer?

If you build and document the model, you are the provider. If you take an off-the-shelf model and run it in a specific high-risk use, you are the deployer and carry the operational duties (Art. 26). Many small teams are deployers.

Can AgentAegis make me EU AI Act compliant?

No. AgentAegis is decision-support that helps you evidence controls (logs, approval gates, rated risk). Conformity is the deploying organization's responsibility across the full system; AgentAegis is one preventive layer, not a certificate or a legal opinion.

Which articles does a guardrail layer actually help with?

Primarily Art. 9 (risk management), Art. 12 (record-keeping / logs), Art. 14 (human oversight via approval gates), and Art. 15 (robustness — by making risky calls visible). It supports, but does not alone satisfy, those obligations.

EU AI Act obligations for AI agents (Annex III, Art. 9–17)

Which agents the Act covers

The EU AI Act (Reg. 2024/1689) is risk-based. Most general-purpose agents are out of scope unless they are placed on the market as a high-risk system or deployed inside a high-risk use. The high-risk categories that commonly involve agents are in Annex III: recruitment and worker management, credit scoring, access to essential services, law enforcement, and safety components of products.

If your agent operates in one of those areas, the obligations below attach — and most of them attach to the deployer, not the model provider.

The obligations that matter (Art. 9–17)

For high-risk systems the Act requires, among others:

Art. 9 — Risk management system: a continuous process to identify and mitigate known and foreseeable risks.
Art. 10 — Data governance: training and evaluation data must be relevant, representative, and free of errors/bias to the extent relevant.
Art. 11 — Technical documentation: evidence the system meets the requirements.
Art. 12 — Record-keeping: logs that enable traceability of each run.
Art. 14 — Human oversight: a natural person can understand, monitor, and interrupt the system.
Art. 15 — Accuracy, robustness, cybersecurity: the system performs as intended under error, perturbation, or attack.

A guardrail layer — tool-call risk ratings, approval gates, and run logs — is decision-support that helps you evidence Art. 9, 12, 14, and 15. It is not the certificate itself.

Deployer vs provider

This split is the part teams miss. The provider builds and documents the model; the deployer puts it into a specific high-risk use and carries the operational duties (Art. 26 for deployers of high-risk systems). If you are a small team deploying an off-the-shelf model as a recruiting screener, you are the deployer and you own Art. 9/14/15 in practice.

Current timeline (Digital Omnibus)

Effective dates have shifted. General-purpose AI rules and several obligations took effect in 2024–2025; many Annex III high-risk obligations have been delayed by the Digital Omnibus and currently track toward 2 December 2027. Dates move — confirm the current effective date against the Official Journal and the European Commission before committing a compliance plan to a deadline.

What a guardrail layer gives you

Concretely, a guardrail layer can:

Produce the run logs Art. 12 wants.
Put a human-approval gate on high-risk tool calls (Art. 14).
Make tool-call risk visible and rated (Art. 9, 15).

It narrows the gap between "we think it's safe" and "we can show it." That is the whole job of preventive controls under the Act.

Authoritative references

EU AI Act text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
AI Act explorer (clause-by-clause): https://artificialintelligenceact.eu/
European Commission, regulatory framework on AI: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai