EU AI Act
EU AI Act compliance for AI agents
The EU AI Act's high-risk deadlines just moved. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) deferred the Annex III high-risk obligations from August 2, 2026 to December 2, 2027, and the Annex I obligations for AI embedded in regulated products to August 2, 2028.
The deferral happened for one reason: the harmonized standards that define technical conformity were not finished. That makes the extra time conditional in practice. You cannot build a conformity assessment against a standard that does not exist yet, so the real preparation window is whatever remains after the standards publish, which is expected from late 2026.
What did not move: the prohibited practices regime (in force since February 2025), GPAI provider obligations (since August 2025), and the Article 50 transparency duties that took effect on schedule on August 2, 2026. If your organization runs AI agents that touch hiring, credit, healthcare, critical infrastructure, or public services, the question is not when compliance starts. It is whether your controls will produce evidence when it does.
The three articles that bite for agentic systems
These apply to Annex III high-risk systems from December 2, 2027, and building toward them now is the point of the deferral.
Article 9 requires a risk management system that runs across the AI lifecycle, not a one-time assessment filed at deployment.
Article 12 requires automatic recording of events. High-risk systems must log their operation in a way that supports traceability of each decision.
Article 14 requires effective human oversight. A person must be able to understand what the system is doing and intervene or interrupt it.
Penalties scale to 35 million euros or 7 percent of global turnover for the most serious violations. The enforcement mechanism is documentary: regulators ask for records, and organizations that cannot produce them are exposed regardless of how well their systems actually behaved.
Mapping obligations to controls
Signed decision receipts answer Article 12. Every agent action carries a verifiable record of what was requested, which policy version evaluated it, and what was decided. The log is not a text file an engineer compiled after the incident. It is generated by the enforcement path itself and can be verified by a third party.
Override and escalation controls answer Article 14. Oversight is demonstrated with evidence of actual interventions: who overrode what, when, and under which authority. An org chart naming a responsible human is not oversight. A record of the human's decisions is.
Versioned policy bundles answer Article 9. Risk controls exist as executable artifacts with change history, so the risk management system is inspectable as code rather than described in prose.
Written from inside the standards process
The high-risk deadline moved because the harmonized standards were not ready. ExecLayer's founder holds a seat on CEN-CENELEC JTC 21, the committee writing those standards, along with ISO/IEC JTC 1/SC 42 through UNE and ASTM F45, the robotics, automation, and autonomous systems committee, where agentic systems meet physical safety scope. Most EU AI Act guidance summarizes the Act from the outside. The mapping on this page tracks the standards work that will define conformity, as it develops.
Where this applies
Financial services
Credit decisioning and automated underwriting fall inside Annex III. The long-form brief covers execution governance for finance.
Finance briefHealthcare
Clinical and administrative agents touch both Annex III and Annex I product-safety scope, on two different deadlines.
Healthcare briefPublic sector
Public services and essential-benefit decisioning carry high-risk classification and documentary enforcement exposure.
GovernmentGovernance Failure Radar
Ongoing record of AI governance failures, including enforcement actions and the gaps that produced them.
Failure radarGet the full obligation mapping
The complete mapping covers every applicable article, not just the three above, and is reconciled against our published compliance mappings. Request it through the briefing agent on this site and it arrives in writing. No call required.