EU AI Act Countdown

⚠️ What Changed on June 16

The Digital Omnibus package delayed high-risk AI compliance (Annex III) to December 2027 — but Article 50 transparency obligations remain at August 2, 2026. If your organisation deploys chatbots, virtual assistants, or generative AI tools that interact with users or produce synthetic content, you are still subject to the August 2 deadline with €15M / 3% penalties.

AI Agent Compliance Checklist Act Now

10 actionable steps to prepare your agent infrastructure for the EU AI Act. Each item maps to specific articles and obligations.

1. Disclose AI Chatbots and Synthetic Media — Article 50 (Due Aug 2) Aug 2 Deadline

   Article 50 of the EU AI Act requires transparency obligations that apply from August 2, 2026 — regardless of the high-risk deadline extension to December 2027. Any AI system interacting directly with natural persons must disclose that it is an AI. Synthetic audio, image, video, or text content must be labelled as artificially generated. Non-compliance: up to €15 million or 3% of annual worldwide turnover. Do your chatbots and content systems declare their AI origin?

2. Inventory Every AI Agent in Production

   Create a living register of every autonomous AI agent operating in your environment — including sub-agents, cascading chains, and embedded agents in third-party SaaS. The EU AI Act requires providers and deployers to maintain transparency documentation for high-risk AI systems (Art. 11-13). If you cannot list every agent today, you cannot audit them.

3. Implement Credential-Brokered Enforcement

   Do not give agents standing credentials. Deploy an enforcement gateway that brokers every action permit — read, write, execute, transact — on a per-call basis with cryptographic attestation. The Act's risk management requirements (Art. 9) demand continuous control, not point-in-time configuration.

4. Establish an Event-Sourced Audit Trail

   Every agent action — approved, denied, escalated — must produce a tamper-evident log entry. RFC 3161 Merkle anchoring provides independent timestamp proof without blockchain overhead. Audit trails are not optional under Art. 12 (Record-keeping and logging).

5. Define Action Boundaries per Agent Role

   Map each agent to a bounded action set using an explicit policy language. Agents should not discover their own capabilities — you define them. Art. 29 (Obligations of deployers) requires human oversight commensurate with risk level. Split-key approvals for high-risk actions satisfy this requirement.

6. Deploy a Human-in-the-Loop Escalation Path

   Not every agent action can be pre-authorised. Build an escalation channel that routes high-risk or ambiguous actions to a designated human operator with context, provenance, and a clear audit trail. Art. 14 (Human oversight) mandates this for high-risk AI systems.

7. Run Pre-Deployment Conformity Assessments

   Before any agent enters production, assess it against the Act's requirements: risk classification, data governance, transparency, accuracy, and robustness (Art. 15). Automated pre-flight checks catch non-compliance before it reaches users. Document every assessment for regulatory submission.

8. Monitor for Drift and Re-Evaluate Continuously

   AI agents drift — their behaviour changes as models update, contexts shift, and tool access expands. Continuous monitoring that compares actual agent actions against permitted boundaries is the only way to maintain compliance beyond day one. Flag deviations immediately and trigger re-assessment.

9. Prepare Your Technical Documentation Package

   The Act requires technical documentation (Art. 11) covering system design, development methodology, training data, performance metrics, and risk mitigation measures. Start building this package now — it takes longer than you think. A structured documentation template aligned with Annex IV saves weeks of regulatory scrambling.

10. Test Your Incident Response Plan

    When a rogue agent acts outside its permitted boundaries, you have minutes — not days — to respond. Run a tabletop exercise with your engineering and legal teams. Does your current plan cover agent takeover, data exfiltration, and unauthorised transactions? If not, the gap is your compliance risk.