Agentic AI is a new generation of artificial intelligence in which systems not only respond to instructions but also set goals, make decisions, and take actions independently without constant human guidance. Under the European AI Act, autonomous AI agents generally fall into the high-risk category or are classified as General Purpose AI models, depending on their application and scale. In this article, we answer the most frequently asked questions about Agentic AI and the associated obligations under the AI Act.
How is Agentic AI different from regular AI models?
Agentic AI differs from conventional AI models in that the system does not wait for step-by-step instructions, but instead independently plans and executes a series of actions to achieve a goal. Whereas a traditional AI model answers a question or performs a task as soon as it is instructed to do so, an Agentic AI system takes the initiative, evaluates interim results, and adjusts its approach.
Traditional AI models are reactive: they process input and produce output. Think of a chatbot that answers a question or a model that classifies an image. Agentic AI goes a step further by combining multiple steps: it devises a plan, calls upon external tools or systems, processes the results, and then decides on the next course of action. This makes the system proactive and autonomous.
A practical example: A standard AI assistant answers the question, “When does my contract expire?” An Agentic AI system independently locates the contract, checks the expiration date, compares it with company policies, and then sends a renewal proposal to the appropriate employee—without anyone having to give it instructions to do so.
This distinction is also relevant for organizations that use Robotic Process Automation. What used to be called RPA—where bots carried out fixed instructions—is evolving into Agentic AI: self-thinking assistants that not only follow instructions but also take the initiative and act independently based on context and objectives.
Under the AI Act, what risk category will autonomous AI agents be assigned?
In most cases, autonomous AI agents fall under the “high-risk” category of the AI Act, especially when deployed in areas such as human resources management, access to essential services, law enforcement, or critical infrastructure. The exact classification depends on the specific use, not on the technology itself.
The AI Act uses a four-tier risk classification system: prohibited applications, high-risk AI, low-risk AI, and minimal-risk AI. Agentic AI systems are assessed based on their application and the domain in which they operate.
- High-risk (Annex III): Agents who make decisions regarding creditworthiness, evaluate job applicants, manage patient records, or handle emergency calls automatically fall into this category.
- Limited risk: Agents who perform solely informational tasks with no direct impact on human rights or security may be subject to less stringent transparency requirements.
- Minimal risk: Fully internal process automation that involves no contact with consumers or sensitive decision-making may fall outside the regulated categories.
An important point to note is that an Agentic AI system that performs profiling of natural persons is always classified as high-risk, regardless of the context. Organizations that are unsure about the classification of their system would be wise to proactively document this, including the rationale for why a system might fall outside the high-risk category.
What specific obligations apply to Agentic AI providers?
Providers of Agentic AI systems classified as high-risk must comply with a comprehensive set of requirements regarding risk management, technical documentation, human oversight, and conformity assessment before the system is placed on the market.
The main obligations for providers of high-risk Agentic AI are:
- Risk Management System: An ongoing system that identifies, assesses, and mitigates risks throughout the system’s entire lifecycle.
- Technical Documentation: Detailed documentation on the system’s operation, training data, performance, and limitations, in accordance with the requirements of the AI Act.
- Human oversight: The system must be designed so that people can intervene effectively, understand how it works, and shut it down if necessary.
- Robustness and accuracy: Demonstrable technical measures to ensure consistent performance and resistance to tampering.
- Registration in the EU database: High-risk AI systems must be registered in the central European database before they are deployed.
- Declaration of Conformity: A formal statement that the system complies with all applicable requirements of the AI Act.
When an organization modifies an existing Agentic AI system, adds its own name to it, or changes its intended use in such a way that the system becomes high-risk, that organization itself becomes a provider, with all the associated obligations. This is a crucial point for organizations that deploy and customize off-the-shelf AI platforms for their own use.
What are the transparency requirements for AI agents with regard to end users?
AI agents that interact with people must clearly inform end users that they are communicating with an AI system, unless this is evident from the context. This transparency requirement already applies to low-risk AI and becomes more stringent as the system becomes more autonomous and has a greater impact.
Specific transparency requirements apply to Agentic AI that go beyond the basic obligation to disclose that AI is involved:
- Users must understand what decisions the system makes and on what basis.
- For high-risk AI systems, users must be informed about the system’s capabilities and limitations.
- When an Agentic AI system simulates emotions or imitates human behavior, this must be explicitly stated.
- Users should always have the option to contact a person, especially when it comes to decisions that affect their rights or interests.
This is particularly relevant for organizations that use Agentic AI in customer interactions. An AI agent that independently handles complaints, processes orders, or provides information about services must clearly communicate its nature and limitations. This not only protects the end user but also limits the legal risk for the organization using it.
When will the AI Act take effect, and what are the deadlines?
The AI Act will take effect in phases. The first requirements are already in effect, and most of the relevant deadlines for high-risk AI systems—including Agentic AI—are in 2026 and 2027. Organizations that have not yet taken any action are falling behind schedule.
The most important milestones are:
- February 2, 2025: The prohibited practices set forth in Article 5 are in effect, as is the requirement for AI literacy within organizations (Article 4).
- August 2, 2025: Requirements for general-purpose AI models, penalty provisions, and the governance structure are in effect. National regulators must have been designated.
- August 2, 2026: Most of the requirements for high-risk Annex III systems take effect. This is the most relevant deadline for most Agentic AI applications in customer-facing and business processes.
- August 2, 2027: Requirements for high-risk AI used as a safety component in regulated products take effect. GPAI models that were on the market before August 2025 must be compliant by this date at the latest.
By 2026, most organizations will therefore already be required to meet the requirements for high-risk AI. Those who start now by mapping out their AI systems and preparing the required documentation will have enough time to become compliant.
What are the penalties for noncompliance with the AI Act?
The fines for noncompliance with the AI Act are substantial and follow a three-tiered structure. The most severe penalties apply to prohibited AI practices and can amount to 35 million euros or 7% of global annual revenue, whichever is higher.
The three levels of the penalty structure are:
- Prohibited Practices (Article 5): A maximum of 35 million euros or 7% of global annual revenue. This applies, for example, to manipulative AI systems or social scoring by governments.
- Other non-compliance: Up to 15 million euros or 3% of global annual revenue. This includes failure to meet the requirements for high-risk AI, such as missing documentation or insufficient human oversight.
- Providing false information to authorities: Up to 7.5 million euros or 1% of global annual revenue.
For small and medium-sized enterprises, the lower of the percentage or the fixed amount applies in each case, which offers some protection for smaller organizations. Enforcement is the responsibility of national market surveillance authorities, with the European AI Office serving as the supervisory authority for general-purpose AI models. In January 2026, Finland became the first member state to grant formal enforcement powers to its national authority.
How Pegamento Helps with Agentic AI and AI Act Compliance
We understand that the combination of new AI technology and complex regulations can feel overwhelming. At Pegamento, we help organizations deploy Agentic AI responsibly and effectively, keeping in mind both the business value and the legal obligations under the AI Act.
What we specifically offer:
- Agentic AI solutions for customer contact: Self-learning assistants that handle, route, and escalate repetitive questions, allowing your employees to focus on complex issues.
- Transparency and human oversight built in: Our systems are designed with the AI Act in mind, including clear user communication and effective mechanisms for human intervention.
- No costly custom development, but a smart combination of proven modules: We build customized solutions using standard building blocks that already meet the relevant compliance requirements.
- Everything under one roof: From consulting and implementation to management and support—without having to manage multiple vendors.
- ISO 27001 certified: Our approach meets the highest standards for information security, complemented by ISO 9001 and ISO 26000 certification.
Would you like to know how Agentic AI for customer service can help your organization, and how to implement it in a compliant manner? Contact us, and we’d be happy to work with you to find a solution.
Frequently Asked Questions
Hoe begin ik met het in kaart brengen van mijn Agentic AI-systemen voor AI Act compliance?
Start met een AI-inventarisatie: maak een overzicht van alle AI-systemen die je organisatie gebruikt, aanpast of aanbiedt, en beoordeel per systeem het toepassingsdomein en de mate van autonomie. Koppel dit aan de risicocategorieën uit de AI Act om te bepalen welke verplichtingen van toepassing zijn. Documenteer je bevindingen meteen, want die onderbouwing is zelf al een vereiste bij hoog-risico systemen. Wie nu begint, heeft ruim de tijd om vóór de deadline van augustus 2026 volledig compliant te zijn.
Wat als ik een standaard AI-platform van een externe leverancier gebruik en dat aanpas voor mijn eigen organisatie?
Zodra je een bestaand AI-systeem aanpast, je eigen naam erop zet, of het beoogde gebruik zodanig wijzigt dat het systeem in een hoog-risico categorie terechtkomt, word jij juridisch gezien de aanbieder met alle bijbehorende verplichtingen. Dit betekent dat je zelf verantwoordelijk bent voor de technische documentatie, het risicomanagementsysteem en de conformiteitsverklaring. Controleer daarom altijd contractueel welke compliance-verantwoordelijkheden bij jou en welke bij de oorspronkelijke leverancier liggen.
Geldt de AI Act ook voor Agentic AI-systemen die uitsluitend intern worden gebruikt, zonder contact met klanten?
Ja, de AI Act maakt geen onderscheid tussen intern en extern gebruik als het gaat om hoog-risico toepassingen. Een intern Agentic AI-systeem dat bijvoorbeeld sollicitanten beoordeelt, personeelsbeslissingen ondersteunt of toegang tot interne systemen beheert, valt gewoon onder de hoog-risico verplichtingen. Alleen volledig interne procesautomatisering zonder gevoelige besluitvorming én zonder impact op mensenrechten kan mogelijk buiten de gereguleerde categorieën vallen. Laat dit altijd juridisch toetsen voordat je aanneemt dat jouw systeem buiten scope valt.
Wat is het verschil tussen een 'aanbieder' en een 'gebruiker' onder de AI Act, en waarom maakt dat uit?
Een aanbieder is de partij die een AI-systeem ontwikkelt, op de markt brengt of in gebruik stelt, terwijl een gebruiker (in de AI Act ‘deployer’ genoemd) het systeem van een ander inzet voor eigen doeleinden. Aanbieders dragen de zwaarste verplichtingen, zoals conformiteitsbeoordeling en registratie in de EU-databank. Gebruikers hebben lichtere maar nog steeds concrete verplichtingen, zoals het zorgen voor menselijk toezicht en het informeren van eindgebruikers. Het onderscheid is cruciaal omdat veel organisaties onbewust de rol van aanbieder op zich nemen door aanpassingen aan ingekochte AI-systemen.
Hoe zorg ik ervoor dat 'menselijk toezicht' in de praktijk echt werkt en niet slechts een papieren vereiste is?
Effectief menselijk toezicht betekent dat medewerkers het systeem begrijpen, de uitkomsten kunnen beoordelen én daadwerkelijk kunnen ingrijpen wanneer nodig. Dat vereist training in AI-geletterdheid (ook al een verplichting per februari 2025), duidelijke escalatieprocedures en technische mogelijkheden om het systeem te pauzeren of te overschrijven. Vermijd de valkuil van ‘toezicht op papier’ waarbij een medewerker formeel verantwoordelijk is maar in de praktijk niet in staat is om de beslissingen van het systeem te begrijpen of te corrigeren.
Kan een Agentic AI-systeem van risicocategorie veranderen als ik het gebruik uitbreid naar nieuwe toepassingen?
Absoluut, en dit is een veelgemaakte fout in de praktijk. Een systeem dat begint als beperkt-risico informatietool kan hoog-risico worden zodra je het inzet voor besluitvorming over krediet, personeel of toegang tot diensten. Elke significante uitbreiding van het gebruik vereist een hernieuwde risicoanalyse en mogelijk een volledig nieuwe conformiteitsbeoordeling. Bouw daarom een intern proces in waarbij nieuwe toepassingen van bestaande AI-systemen altijd worden getoetst aan de AI Act-classificatie voordat ze worden uitgerold.
Wat zijn de meest voorkomende fouten die organisaties maken bij de voorbereiding op de AI Act?
De drie meest voorkomende fouten zijn: ten eerste het te laat starten, waardoor de vereiste documentatie en risicoanalyses ontbreken bij de deadline; ten tweede het onderschatten van de eigen rol als aanbieder bij aanpassingen aan ingekochte AI-platforms; en ten derde het behandelen van compliance als eenmalig project in plaats van een doorlopend proces. De AI Act vereist een levend risicomanagementsysteem dat meegaat met de ontwikkeling van het systeem, niet een document dat eenmalig wordt opgesteld en vervolgens in een la verdwijnt.
