Preparing for Agent Compliance Regulations

Overview

The AI Act became applicable on 2 August 2026, three days before this was written, and the part most enterprise teams were bracing for is no longer due. That is a useful moment to reread what the text asks for, because the extension changed the calendar and nothing else.

Agents are the sharpest version of this problem. An agent is not a model returning a prediction. It is an actor that takes steps, calls tools, moves data and produces outcomes a regulator can trace back to a decision. The obligations that bite hardest are therefore the record-keeping ones, and those are the only obligations in the regulation you cannot satisfy late. A risk assessment can be written next quarter. A log of what an agent did last quarter either exists or does not.

We covered the AI Act's runtime governance model in a separate post. This one is narrower and more operational: which dates are now real, which articles create which evidence, how long each record has to survive, and what a single reconstructible record looks like.

The Dates, Corrected

Several planning documents still carry 2 August 2026 as the high-risk deadline. It is not, and the correction comes from the Commission's own page on the regulatory framework, which records the AI Omnibus amendment adopted on 19 November 2025, political agreement on 7 May 2026, and entry into force on 27 July 2026.

Table 1 — The applicable dates after the AI Omnibus amendment, from the European Commission's regulatory framework page.

Whether any of this reaches your agents depends on Annex III, which is a specific list rather than a vibe. The categories that catch ordinary enterprise automation are employment and worker management, covering recruitment, "job advertisement targeting" and candidate evaluation as well as "decisions on work terms, promotions, terminations, task allocation, and performance monitoring"; creditworthiness, covering systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud"; and eligibility for public assistance and essential services. A procurement agent reconciling supplier statements is not on that list. An agent that ranks applicants is.

The penalties set the size of the bet. Article 99 provides for fines up to EUR 35 000 000 or 7% of total worldwide annual turnover for breaching the prohibited practices, up to EUR 15 000 000 or 3% for breaching most high-risk obligations including the deployer duties in Article 26, and up to EUR 7 500 000 or 1% for supplying "incorrect, incomplete or misleading information" to notified bodies or authorities. That third tier is the one worth rereading. Answering an inquiry badly is its own offence.

What the Text Requires

Regulators keep reaching for the same four tools, and the AI Act writes each into a specific article. Read as engineering requirements rather than legal prose, they are unusually concrete.

Table 2 — Six articles, and what each one turns into once you have to satisfy it for a specific agent on a specific day.

Article 86 is the one that surprises engineering teams, because it makes an individual, not a regulator, the requester. Anyone subject to a decision taken on the basis of a high-risk system's output that adversely affects them can ask what the system contributed. A trace that only a platform engineer can read does not answer that.

Article 14 is the one that gets promised and rarely tested. The stop procedure has to bring the system "to a halt in a safe state", which for an agent midway through a multi-step task is a design question about partial work, not a button.

How Long to Keep What

Retention is where good intentions meet a storage bill, and the Act sets more than one clock.

Table 3 — Three different clocks on the same system. Six months is a floor on logs, not a retention policy.

Two practical consequences. First, we think six months is shorter than most inquiry cycles, so aligning log retention exactly to the floor guarantees that some questions arrive after the answer expired. Second, financial institutions are treated differently in all three places. The Act lets institutions subject to Union financial services law keep logs and technical documentation as part of the documentation those regimes already require, so the sector rule sets the period, not Article 19.

The failure we would plan against is not deleting too early. It is keeping the wrong field. A six-month log of HTTP requests is not evidence about an agent unless each record carries the agent's identity, the acting user's identity, the tool and arguments, the decision taken before the call, and a trace identifier that links the agent's step to whatever a human did next. That record is aact:audit-granularity/per-action-with-principal-chain in the Agent Access Control Taxonomy, as against the session-level and none-distinguishable records most systems emit.

What You Will Be Asked

When scrutiny arrives, whether from a regulator, an external auditor, a customer's security review or your own board, the questions are concrete. Nobody asks about your philosophy of AI.

• Which agents exist? A complete account of the autonomous systems operating across the enterprise, not a sample of the ones someone remembers.
• What is each agent used for? Its purpose, the business process it touches, and who it affects.
• What data does it access? The systems and datasets it can reach, and whether that access is appropriate.
• What actions can it perform? The scope of what it is permitted to do, especially anything irreversible.
• Who owns it? A named, accountable person with the authority Article 26(2) describes, not a team alias.
• What happened when it acted? The concrete record of what it did and what the outcome was, for a specific action on a specific day.

None of these are exotic. They are the questions a competent operator would want answered anyway. Regulation does not introduce a new burden so much as raise the cost of not having done the basic work of running what you built.

Evidence, Not Policy

A policy describes what is supposed to happen. Compliance is about proving what did happen, and the gap between the two is where most organisations are exposed. NIST's AI Risk Management Framework draws the same line in one sentence, and it is worth keeping: "Transparency can answer the question of 'what happened' in the system."

Consider three ordinary policy statements and what each one actually requires you to show.

"High-risk actions stay outside the agent's scope." Take a procurement agent that can issue purchase orders under a spend limit. You need to show, for a specific order above that limit, that the scope check failed on it, and that the order was posted by a named person using their own credential rather than the agent's.

"Agents access only sanctioned data sources." Consider a marketing analytics agent that segments audiences. You must show which sources that agent actually reached over a period, and surface any access outside the sanctioned set.

"Agents are reviewed periodically." Take an HR screening agent that ranks applicants, which Annex III point 4 puts squarely in scope. Evidence means a documented review history and a current attestation: who reviewed it, when, what they checked, and that an accountable owner has affirmed it is still fit to operate.

We think most compliance programmes fail at exactly this step. They can produce the policy. They cannot produce the record that it held.

In Practice: Assembling the Record

Picture a financial-services firm whose reconciliation agent proposes journal entries and flags discrepancies for a controller. A regulator opens an inquiry into a misstated figure, and the firm is asked to reconstruct a single questionable entry.

With a structured record, that reconstruction is a query rather than a crisis.

trace_id:     8f2c-0e41-b7
agent:        recon-agent-v4   (owner: j.okafor, controller-ops)
trigger:      nightly ledger close, 2026-07-31T02:14:07Z
identities:   agent=recon-agent-v4, acting_user=svc.close@example.com
data_access:  GL system (sanctioned), bank feed (sanctioned)
action:       proposed journal entry JE-88213
decision:     scope_check=pass, action_check=pass (agent scope: propose-only)
outcome:      proposed, routed to the review queue
---
trace_id:     8f2c-0e41-b7
actor:        j.okafor (human, own credential)
action:       posted JE-88213
decision:     scope_check=pass (post-journal-entry scope held by user)
outcome:      posted; variance flagged
retention:    logs 18 months; technical documentation until 2036-04-01

Figure 1 — Three records per action, and the article each one answers. The trace identifier is the part that makes them a single account rather than three logs.

Every claim the firm wants to make is backed by records produced at the moment they mattered. That the agent never exceeded its scope. That the posting happened under a named person's own credential. That an owner is accountable. The firm is not reconstructing intent from memory.

A firm without this layer is reduced to interviewing engineers, grepping scattered logs and hoping the relevant lines were retained.

Figure 2 — Two paths through the same inquiry. One is a query. The other is a negotiation, and the fork was decided months earlier.

Beyond the EU

A compliance programme built only for Brussels will be surprised twice, and the AI Act itself is the first surprise for non-EU teams. Article 2(1) applies it to providers "irrespective of whether those providers are established or located within the Union or in a third country", and to providers and deployers in a third country "where the output produced by the AI system is used in the Union". Where the agent runs is not the test.

In the United States the action is at state level and already in force. Texas HB 149, "relating to regulation of the use of artificial intelligence systems in this state; providing civil penalties", took effect on 1 January 2026. Colorado's SB 24-205 was delayed by a special-session bill that "extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026", so its duties on developers and deployers of high-risk systems are now live too.

Two voluntary frameworks do most of the connective work between these regimes. NIST's AI Risk Management Framework supplies the methodology and the vocabulary that several regulators borrow. OWASP's Top 10 for Agentic Applications, published on 9 December 2025, supplies the threat list your controls will be measured against in a customer security review, which in practice arrives long before a regulator does.

Where Fabriq Fits

Agentic Fabriq carries two identities on every call, the agent and the acting user, and writes an audit record for it, which is the shape Table 2 asks for. Credentials sit in a vault and are attached server-side at the moment of the call, so the agent never handles the secret, and an agent's effective tool list is the intersection of the user's scopes and the agent's.

What it does not do is decide your retention or answer the inquiry. Audit export is API-only, and the six months in Article 19 is a floor you have to configure against your own inquiry cycle.

Frequently Asked Questions

Was the August 2026 high-risk deadline delayed? Yes. The AI Omnibus amendment entered into force on 27 July 2026 and moved the Annex III high-risk obligations to 2 December 2027, with Annex I systems embedded in regulated products following on 2 August 2028. The Act itself still became applicable on 2 August 2026, and the transparency rules took effect then.

Are AI agents high-risk systems under the AI Act? Not by default. High-risk status comes from use, and Annex III is a closed list. The entries that catch enterprise agents are recruitment and worker management, creditworthiness scoring other than fraud detection, and eligibility for public assistance and essential services. An agent ranking job applicants is in scope; one reconciling invoices is not.

How long do we have to keep agent logs? At least six months under Article 19 for providers and Article 26(6) for deployers, "unless provided otherwise in the applicable Union or national law". Technical documentation runs to ten years after the system is placed on the market under Article 18. Financial institutions fold both into the documentation their sector regime already requires.

What are the fines? Up to EUR 35 000 000 or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 000 000 or 3% for most high-risk obligations including deployer duties, and up to EUR 7 500 000 or 1% for giving authorities incorrect, incomplete or misleading information.

Does the AI Act apply to us if we are not in the EU? Probably, if the output is. Article 2(1) reaches providers placing systems on the Union market regardless of where they are established, and providers and deployers in a third country where the output is used in the Union.

Do we need a human in the loop for every agent action? No. Article 14 requires oversight measures "commensurate with the risks, level of autonomy and context of use" for high-risk systems, plus the ability to interrupt the system through a stop procedure that leaves it in a safe state. That is a choice between the taxonomy's aact:human-oversight/post-hoc-review and approval-for-high-risk, not a mandate for approval-for-all. The one place the text demands more is biometric identification under Annex III point 1(a), where an identification must be "separately verified and confirmed by at least two natural persons".

What does an auditor ask for first? The inventory, then one specific action. The inventory question tests whether you know what you are running; the specific action tests whether your records connect the agent's step to the human outcome. The second is where programmes fail.

Do we need to buy a governance product to comply? No, and starting there is a common way to spend a year without producing evidence. The obligations are about records: events logged over the lifetime of the system, permissions narrow enough that high-risk actions fall outside them, a named owner with authority, retention you can demonstrate, and monitoring that runs continuously. Most teams can satisfy the first and last from infrastructure they already run.

Start Before the Pressure

Agent compliance will not be solved by a policy document, an annual training or a one-time risk assessment. It requires systems of record and monitoring operating continuously while agents do their work, which is exactly the part an extended deadline does not help with.

What we would tell a team starting today is that the hard part is not picking a framework. It is deciding which fields every agent action writes, and how long they live. Get the three clocks right, tie the agent's step to the human outcome with one identifier, and the eventual review becomes a query.

Sources

All URLs read 2026-09-29.

• European Commission, AI Act regulatory framework — entry into force, applicability on 2 August 2026, the AI Omnibus timeline, and the extensions to 2 December 2027 and 2 August 2028.
• AI Act Article 12: Record-keeping — automatic recording of events over the lifetime of the system, and what the logs must capture.
• AI Act Article 14: Human oversight — oversight commensurate with risk and autonomy, the stop procedure and the safe-state requirement, and two-person verification for biometric identification.
• AI Act Article 18: Documentation keeping — the ten-year retention on technical documentation, quality management records and the declaration of conformity.
• AI Act Article 19: Automatically generated logs — the six-month floor for providers, and the treatment of financial institutions.
• AI Act Article 26: Obligations of deployers — oversight by people with competence, training and authority, monitoring duties, and the deployer log retention floor.
• AI Act Article 72: Post-market monitoring — the requirement to actively and systematically collect performance data throughout the system's lifetime.
• AI Act Article 86: Right to explanation of individual decision-making — clear and meaningful explanations for affected persons.
• AI Act Article 99: Penalties — the three fine tiers and which infringements each covers.
• AI Act Article 2: Scope — application to third-country providers and deployers where the output is used in the Union.
• AI Act Annex III: High-risk AI systems — the employment, creditworthiness and essential-services categories.
• Texas HB 149, 89th Legislature — the caption and the 1 January 2026 effective date.
• Colorado SB 25B-004 — the extension of SB 24-205's requirements to 30 June 2026.
• NIST AI Risk Management Framework 1.0 (AI 100-1) — transparency as the characteristic that answers what happened in the system.
• OWASP Top 10 for Agentic Applications, v1.0 — published 9 December 2025, the threat list customer security reviews increasingly reference.
• Agent Access Control Taxonomy — the audit granularity and human oversight dimensions, and the questions they ask: what is recorded about agent actions and who they are attributed to, and when a person gets involved.
• Agent access control taxonomy, audit-granularity.yaml — aact:audit-granularity/per-action-with-principal-chain as a record of "the agent, the human or upstream agent it acted for, the policy decision, and the inputs that led to it", against none-distinguishable, session-level and per-action.