---
title: "EU AI Act for AI Agents"
description: "EU AI Act for AI Agents: risk classes, obligations and concrete compliance steps for deploying agents in the EU."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents"
category: "AI Agents"
updated: "2026-10-17T15:40:52.379Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# EU AI Act for AI Agents

EU AI Act for AI Agents: risk classes, obligations and concrete compliance steps for deploying agents in the EU.

> Note: This article is informational and does not constitute legal advice. As of October 2026, the Digital Omnibus has been [in force since 27 July 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force) as Regulation (EU) 2026/1744, and the deadlines it postponed are binding.

## Why the EU AI Act is relevant for AI agents - even though it doesn't actually recognize "agents"

The [EU AI Act](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - formally Regulation (EU) 2024/1689 of 13 June 2024 - is the world's first comprehensive, horizontal [AI](https://blckalpaca.at/en/glossary/ai) regulation. Published on 12 July 2024 and entered into force on 1 August 2024, it applies as a directly applicable regulation in all Member States. For decision-makers in DACH companies that deploy or offer AI agents, the key conceptual insight is: **the AI Act defines neither "AI agent" nor "[agentic AI](https://blckalpaca.at/en/glossary/agentic-ai)".** The Digital Omnibus (Regulation (EU) 2026/1744) likewise introduced no [agent](https://blckalpaca.at/en/glossary/agent) definition.

Agentic AI systems - that is, AI systems that plan, invoke tools and [execute multi-step action chains](https://blckalpaca.at/en/blog/agentic-ai-design-patterns-for-2026-build-trustworthy-systems) with reduced human involvement - are captured indirectly, via four legal anchors:

- the general definition of an **AI system** (Art. 3(1));
- the **GPAI model rules** (Art. 51-55) for the foundation-model layer beneath the agent;
- the **Annex III high-risk catalog** and the transparency layer of **Art. 50**;
- the **value-chain rules** (Art. 25) where deployer-side composition, fine-tuning or [prompt engineering](https://blckalpaca.at/en/glossary/prompt-engineering) becomes a substantial modification.

The practical consequence, and at the same time the most important rule of thumb for any compliance project: what is classified is never "the agent" as an architecture, but always the specific **use case** (intended purpose). An "office assistant" is not a legal object - an agent that performs CV screening very much is.

## The definition of an AI system - and why every LLM agent falls under it

Under Art. 3(1), an "AI system" is a machine-based system that operates with varying levels of autonomy, may exhibit adaptiveness after deployment, and infers from the inputs it receives how to generate outputs - predictions, content, recommendations or decisions - that can influence physical or virtual environments.

The non-binding **Commission guidelines on the definition of an AI system** (C(2025) 924 final, published on 6 February 2025) break this down into seven cumulative elements, with the **capacity to infer** regarded as the decisive, indispensable distinguishing feature versus ordinary software. Purely rule-based systems, simple optimization methods (linear or logistic regression) and classical data processing fall outside for lack of inference. **Every serious [AI agent](https://blckalpaca.at/en/glossary/ai-agent) - [LLM](https://blckalpaca.at/en/glossary/llm)-based copilots, [RAG](https://blckalpaca.at/en/glossary/rag) systems with tool use, [autonomous multi-agent orchestrations](https://blckalpaca.at/en/blog/ai-agent-swarms-when-ai-agents-work-together) - meets all seven elements.** Classical, deterministic RPA without inference, by contrast, generally does not.

## The risk pyramid: four tiers plus a parallel GPAI regime

The AI Act layers AI systems into four tiers, plus a parallel regime for GPAI models. The tiers are not mutually exclusive: an agent can simultaneously be subject to Art. 5, Art. 50 and - via its foundation model - the GPAI rules.

| Tier | Content | Relevance for AI agents | Applicable from |
| --- | --- | --- | --- |
| **Prohibited (Art. 5)** | Eight prohibited practices, ten from 2 Dec 2026 (Digital Omnibus) | Emotion recognition in the workplace, manipulative persuasion agents | 2 Feb 2025 (already applicable); new prohibitions from 2 Dec 2026 |
| **High-risk Annex I** | AI as a safety component of regulated products (machinery, MDR/IVDR …) | Medical triage agents | 2 Aug 2028 (Omnibus) |
| **High-risk Annex III** | Eight standalone categories | HR, credit, insurance, infrastructure agents | 2 Dec 2027 (Omnibus) |
| **Limited risk (Art. 50)** | Transparency obligations | Chatbots, generative marketing agents, deepfakes | 2 Aug 2026 (already applicable); Art. 50(2) for legacy systems from 2 Dec 2026 |
| **Minimal risk** | Everything else | Internal RAG agents, code copilots | Only Art. 4 literacy |
| **GPAI models (Art. 51-55)** | Parallel regime, model layer | Foundation-model layer of every agent stack | 2 Aug 2025 (already applicable) |

The strategic core message: [**most mid-market agent deployments](https://blckalpaca.at/en/blog/ai-agents-for-small-business-roi-guide-2026) fall into the bottom two tiers** - with a small but high-impact subset (HR, credit, insurance, critical infrastructure, medicine) that lands in Annex III or Annex I.

### Prohibited practices (Art. 5) - the red line

Eight categories have been entirely prohibited in the EU since 2 February 2025, backed by the highest fine tier (up to EUR 35 million or 7 % of worldwide annual turnover). The prohibition most directly relevant for DACH agents is **Art. 5(1)(f): emotion recognition in the workplace**. HR-analytics agents that infer employees' mood, focus or stress from video, audio or biometrics are prohibited (narrow exceptions only for medical and safety purposes). The Digital Omnibus adds two prohibitions that apply from 2 December 2026 ([Art. 5(1)(ba) and (bb)](https://artificialintelligenceact.eu/article/5/)): AI systems that generate intimate or sexually explicit depictions of identifiable persons without their consent, and AI systems that generate child sexual abuse material.

### High-risk Annex III - the eight categories

Annex III names eight standalone high-risk areas. The most important for AI agents:

- **Employment and workforce management** (point 4): recruitment and selection (CV screening), performance evaluation, promotion, termination, task allocation.
- **Essential private and public services** (point 5): creditworthiness assessment and credit scoring (except fraud detection), risk assessment and pricing for life and health insurance, emergency call triage.
- **Critical infrastructure** (point 2): AI as a safety component in transport, water, gas, electricity, critical digital infrastructure.

The remaining categories (biometrics, education, law enforcement, migration/asylum, justice and democratic processes) are less frequently relevant for the typical mid-market company.

**Art. 6(3) exception:** Even in an Annex III use case, a system is not high-risk if it does not pose a significant risk of harm, for example because it performs a narrow procedural task, improves the result of a previously completed human activity, detects deviations without replacing the human assessment, or carries out a preparatory task. **Profiling of natural persons, however, always remains high-risk** ([Art. 6(3) third subparagraph](https://artificialintelligenceact.eu/article/6/)). Anyone relying on the exception must document the justification (Art. 6(4)) and register the classification in the EU database (Art. 49(2)). The Art. 6(5) guidelines for practical implementation were due by 2 February 2026. The Commission published a [draft](https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems) on 19 May 2026; as far as we know, the final version is still pending as of October 2026.

## Examples: how specific AI agents are to be classified

| Agent use case | Tier | Legal anchor |
| --- | --- | --- |
| Marketing [copywriting](https://blckalpaca.at/en/glossary/copywriting) agent (internal) | Minimal + Art. 50(2) labeling | Art. 50(2) for synthetic content |
| Customer-service [chatbot](https://blckalpaca.at/en/glossary/chatbot) in retail | Limited (Art. 50(1)) | Chatbot disclosure |
| Internal knowledge management over confidential documents | Minimal | Only Art. 4 |
| Predictive-maintenance agent in manufacturing | Minimal | No Annex III anchor |
| HR CV-screening agent | **High-risk Annex III(4)(a)** | Art. 6(2) + Annex III point 4 |
| Performance-evaluation agent (employee ranking) | **High-risk Annex III(4)(b)** | Art. 6(2) + Annex III point 4 |
| Credit-decision agent (retail banking) | **High-risk Annex III(5)(b)** | Creditworthiness assessment |
| Payment-card fraud detection | Minimal/limited (carve-out) | Annex III(5)(b) exception |
| Health-insurance pricing agent | **High-risk Annex III(5)(c)** | Annex III point 5 |
| Mood-recognition agent in the workplace | **Prohibited Art. 5(1)(f)** | Art. 5 |

One important agent-specific peculiarity is **runtime risk drift**: the same agent platform can shift between risk tiers depending on the tool inventory connected at runtime. Adding an HR data source can turn a minimal-risk knowledge agent into an Annex III(4) high-risk system overnight. The classification should therefore be reassessed on every change to the tool configuration.

## Deployer or provider? Art. 25 as the trapdoor

For DACH practice, the question of role is decisive. A **deployer** (Art. 3(4)) uses an AI system under its own authority - this is the default role of nearly all DACH SMEs. A **provider** (Art. 3(3)) develops a system and places it on the market under its own name or puts it into service. Even someone who builds an internal HR-screening system solely for their own use "does not place it on the market" - but they "put it into service", and the full provider obligations apply.

**Art. 25 is the trapdoor** through which a deployer becomes a provider - with all the obligations under Art. 16, including conformity assessment and technical documentation under Annex IV. Three triggers:

1. **Rebranding**: putting one's own name or trademark on a high-risk system already placed on the market or put into service. This applies [without prejudice to contractual arrangements that allocate the obligations otherwise](https://artificialintelligenceact.eu/article/25/) (Art. 25(1)(a));
2. **substantial modification** under Art. 3(23): a subsequent change not foreseen in the original conformity assessment that affects compliance with Art. 8-15 or changes the purpose;
3. **repurposing to high-risk**: deploying a previously non-high-risk (or a GPAI) system for a new, now high-risk purpose.

For GPAI models, the Commission guidelines of 18 July 2025 introduce an indicative threshold: a downstream modification using more than **one third** of the original training compute counts as a substantial modification. Standard RAG, prompt engineering and light LoRA [fine-tuning](https://blckalpaca.at/en/glossary/fine-tuning) lie well below this. **The agent-specific trap:** [building an agent that combines](https://blckalpaca.at/en/services/ai-agent-integration) a third-party GPAI with its own tool-calling, memory and [orchestration](https://blckalpaca.at/en/glossary/orchestration) usually does not create a new GPAI model - but it does create a **new AI system**, whose provider is the integrator. This is the most common misclassification in DACH agent projects.

## Deployer obligations (Art. 26) - the DACH mid-market core

The twelve operational obligations of Art. 26 apply to Annex III high-risk systems from 2 December 2027 and to Annex I systems from 2 August 2028. The Digital Omnibus set these dates ([Art. 113](https://artificialintelligenceact.eu/article/113/), [detailed timeline](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/eu-ai-act-timeline-2024-2028)). The most important: use in accordance with the provider's instructions (26(1)); human oversight by competent, authorized persons (26(2)); monitoring and suspension in case of risk (26(5)); retention of the automatically generated logs for at least 6 months (26(6)); information of affected persons in the case of high-risk decisions (26(11)); cooperation with the relevant competent authorities ([26(12)](https://artificialintelligenceact.eu/article/26/)). In addition, affected persons have a right to an explanation of individual decisions under Art. 86.

### The DACH specificity: works council and staff representation (Art. 26(7))

Art. 26(7) is the norm most underestimated in English-language literature. Before putting a [high-risk AI](https://blckalpaca.at/en/glossary/high-risk-ai) system into service in the workplace, employees and their representatives must be informed - which triggers the national co-determination procedures:

- **Germany:** § 87(1) no. 6 BetrVG gives the works council a genuine **co-determination right** (not merely information) for technical equipment used to monitor behavior/performance; §§ 90 and 95(2a) BetrVG require information or involvement in the case of AI-supported selection guidelines.
- **Austria:** [§ 91 ArbVG](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329&Paragraf=91) requires the employer to inform the works council about employee data processed by automated means. Control measures that affect human dignity ([§ 96(1) no. 3 ArbVG](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329&Paragraf=96)) as well as personnel data and assessment systems ([§ 96a ArbVG](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329&Paragraf=96a)) generally require the works council's consent; under § 96a, the arbitration board can replace it.
- **Switzerland:** Participation Act (Art. 9, 10) and CO 328b.

In practice this means: Art. 26(7) information **before** putting into service, early works council/staff representation consultation, often resulting in a works agreement. This typically extends a high-risk rollout by **3-6 months** and should be started in parallel with the FRIA.

## Fundamental rights impact assessment (FRIA, Art. 27)

Art. 27 obliges certain deployers to carry out their own **fundamental rights impact assessment (FRIA)** - one of the few substantive obligations independent of the provider documentation. Affected are public-law bodies, private providers of public services, as well as private deployers of Annex III systems for creditworthiness (5(b)) and life/health insurance pricing (5(c)). Critical-infrastructure operators (Annex III(2)) are expressly exempt.

The FRIA must contain six elements (Art. 27(1)(a)-(f)): process description, duration and frequency of use, affected groups of persons, specific risks of harm, human oversight measures, and governance and complaint mechanisms. It must be carried out before first use, updated when facts change, and notified to the market surveillance authority (Art. 27(3)); under Art. 27(5), the AI Office is to provide a questionnaire template for this, including as an automated tool. A [GDPR](https://gdpr-info.eu/) DPIA (Art. 35) typically covers only 30-40 % of the FRIA content; an integrated DPIA-plus-FRIA is best practice. Each fundamental right must be assessed independently - a positive effect on one right cannot offset a negative effect on another.

## Transparency obligations under Art. 50: applicable since 2 August 2026

Art. 50 sits between minimal risk and high-risk and applies independently of the high-risk classification. The obligations have applied since **2 August 2026**. There is a transition period only for the [machine-readable marking](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/art-50-transparenzpflichten) under Art. 50(2): providers of [generative AI](https://blckalpaca.at/en/glossary/generative-ai) systems placed on the market before 2 August 2026 must implement it by **2 December 2026** ([Art. 111(4)](https://artificialintelligenceact.eu/article/111/), inserted by the Digital Omnibus).

The four obligations: under **Art. 50(1)**, providers must design AI systems intended to [interact directly with humans](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/article-50-for-chatbots-and-ai-agents-what-you-must-disclose) so that users are informed that they are interacting with AI (except where obvious from the context; to be construed narrowly). Under **Art. 50(2)**, providers must mark synthetic audio, image, video and text outputs as AI-generated in a machine-readable form.

Under **Art. 50(3)**, deployers of emotion recognition or biometric categorization systems inform the affected persons. Under **Art. 50(4)**, deployers label deepfakes as well as AI-generated text on matters of public interest (exception where there is human editorial responsibility). The Commission's draft guidelines on Art. 50 appeared on 7-8 May 2026. After two drafts (17 December 2025 and 3 March 2026), the [final, voluntary code of practice on marking and labelling AI-generated content](https://www.jonesday.com/en/insights/2026/06/european-commission-publishes-final-code-of-practice-on-marking-and-labelling-aigenerated-content) followed on 10 June 2026.

## GPAI obligations (Art. 51-55) and the Code of Practice

The GPAI rules hit the **model layer** beneath every agent and have applied since 2 August 2025; fines for GPAI providers (Art. 101) have been enforceable since 2 August 2026. All GPAI providers must provide technical documentation (Annex XI), downstream documentation for integrators (Annex XII - the central value-chain anchor for DACH agent builders), a copyright policy and a public training-data summary. From a cumulative 10^25 FLOP, a model is deemed a GPAI with systemic risk (Art. 51(2)) with additional obligations under Art. 55.

The **GPAI Code of Practice** of 10 July 2025 creates a presumption of compliance for Art. 53/55. The 26 signatories include Amazon, Anthropic, Google, IBM, Microsoft, [OpenAI](https://blckalpaca.at/en/glossary/openai), Mistral AI, Aleph Alpha and Cohere; **Meta has not signed.** For DACH deployers this means: agents built on Claude, Gemini, Azure OpenAI or ChatGPT inherit a stronger compliance position by default, while the use of Llama/Meta models increases the due-diligence burden.

## Fines and enforcement in DACH

| Tier | Maximum fine | Trigger |
| --- | --- | --- |
| **Tier 1** | EUR 35 million or 7 % of worldwide annual turnover | Art. 5 prohibited practices |
| **Tier 2** | EUR 15 million or 3 % | Obligations under Art. 16 (providers, including after a role change under Art. 25), 22, 23, 24, **25(2) and (4)**, **26**, 31, 33, 34 and **50** |
| **Tier 3** | EUR 7.5 million or 1 % | Incorrect, incomplete or misleading information to notified bodies or authorities ([Art. 99(5)](https://artificialintelligenceact.eu/article/99/)) |

For SMEs, the **lower** amount applies in each case (Art. 99(6)); the Digital Omnibus extends this protection to small mid-caps (SMCs) for tiers 2 and 3 (Art. 99(6a)). Art. 4 (AI literacy) is not in any of the three tiers of [Art. 99](https://artificialintelligenceact.eu/article/99/); whether infringements of it are penalized is up to the Member States under Art. 99(1). In Germany, the KI-MIG (the national act on AI market surveillance and innovation) entered into force on 29 July 2026. Since then, the [Federal Network Agency (BNetzA)](https://bundesnetzagentur.de/SharedDocs/Pressemitteilungen/DE/2026/20260729_KI_VO.html) has been the market surveillance authority, single point of contact and complaints body for the AI Act; in fully harmonized product areas, established supervisors such as BaFin remain responsible. The BNetzA's AI Service Desk offers SMEs and start-ups initial guidance, for example an online tool for a first risk-class assessment.

In Austria, according to [ORF](https://orf.at/stories/3437724/), there was still no government bill for an implementing act and no designated AI supervisory authority at the end of July 2026; the AI Service Center at RTR, set up in 2024, provides information but is not a market surveillance authority. Switzerland has no direct AI Act fines; FINMA (Guidance 08/2024 refers to Art. 9-15 of the AI Act), FMA equivalents and Swissmedic act on a sectoral basis. Via Art. 2(1)(c), however, Swiss companies can be captured if their agent outputs are used in the EU.

## Timeline and the Digital Omnibus

| Date | Provision |
| --- | --- |
| 1 Aug 2024 | Entry into force |
| 2 Feb 2025 | Art. 4 AI literacy + Art. 5 prohibitions (already applicable) |
| 2 Aug 2025 | GPAI Art. 51-55, governance, most of the penalty provisions (already applicable) |
| 27 Jul 2026 | Digital Omnibus ([Regulation (EU) 2026/1744](https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force)) enters into force; Art. 4 amended |
| **2 Aug 2026** | General application: Art. 50 transparency, GPAI fines under Art. 101 (already applicable) |
| **2 Dec 2026** | Art. 50(2) marking for legacy systems ([Art. 111(4)](https://artificialintelligenceact.eu/article/111/)); new prohibitions under Art. 5(1)(ba) and (bb) |
| **2 Dec 2027** | Annex III high-risk obligations incl. Art. 26 and 27 ([Art. 113](https://artificialintelligenceact.eu/article/113/)) |
| **2 Aug 2028** | Annex I product-safety AI ([Art. 113](https://artificialintelligenceact.eu/article/113/)) |

The **Digital Omnibus** was [published in the Official Journal on 24 July 2026](https://www.cuatrecasas.com/en/spain/intellectual-property/art/digital-omnibus-ai-has-been-published) as Regulation (EU) 2026/1744 and has been [in force since 27 July 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force); Parliament and Council reached the political agreement on 7 May 2026. It postpones [the substantive Annex III obligations](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/eu-ai-act-implementation-2026-2027) to 2 December 2027 and the Annex I obligations to 2 August 2028 with binding effect. **Important:** the deferral concerns only the substantive high-risk obligations. Not postponed are Art. 4 (literacy), Art. 5 (prohibitions), the GPAI rules, Art. 50 (only the Art. 50(2) marking for legacy systems has a deadline of 2 December 2026) and the fine framework. The Omnibus did, however, [amend Art. 4](https://artificialintelligenceact.eu/article/4/): providers and deployers must take measures that support the AI literacy of their staff, but no longer have to ensure a specific level. Renowned law firms (Latham & Watkins, Baker McKenzie, CMS, Gleiss Lutz, Bird & Bird) consistently warn: the deferral is no reason to pause the governance work.

## Practical recommendations for DACH decision-makers

The strategic message is: use the additional time wisely, do not pause the work. [A layered compliance posture](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/the-eu-ai-act-for-marketing-agencies-the-2026-compliance-checklist) typically comprises:

1. **AI literacy first** (Art. 4): a role-based, German-language program integrated into the LMS, with documented completions. The obligation has applied to all risk tiers since February 2025. Since the Digital Omnibus, it requires [measures that support AI literacy](https://artificialintelligenceact.eu/article/4/) rather than a specific level; documented training remains the simplest evidence for authorities.
2. **Use-case register**: every agent with purpose, classification memo, owner and oversight role; reassess on every tool change (runtime drift).
3. **Vendor due diligence**: confirmation of provider compliance, CoP signatory status of the foundation model, Annex XII documentation, contractual Art. 25 allocation and Art. 73 escalation paths.
4. **Design Art. 50 disclosure**: chatbot notice ("You are chatting with an AI assistant"), labeling of [AI-generated content](https://blckalpaca.at/en/glossary/ai-generated-content), deepfake labels.
5. **Art. 26(7) process**: start works council/staff representation consultation early (3-6 months lead time).
6. **FRIA + DPIA** integrated where credit, insurance or public services are involved.

The typical DACH SME remains a pure deployer as long as it uses the system within the documented purpose, does not substantially modify the model, does not rebrand and does not repurpose it to a new Annex III purpose. The common self-deception "We only use [Microsoft 365 Copilot](https://www.microsoft.com/en-us/ai/ai-platform), so we are not affected" is wrong: if Copilot is used to prepare an employment-related decision, the deployer lands in the Annex III(4) area. Equally wrong: "Open source is exempt" - the exception under Art. 2(12) is narrow and does not apply to high-risk applications, GPAI with systemic risk or Art. 50 transparency.

> Reminder: This overview is informational and does not replace legal advice. For the binding classification of a specific AI agent - in particular where it is close to Annex III, where Art. 25 reclassification is possible, or in cross-border Swiss matters - a case-specific legal review is required. The deadlines reflect the legal position after the Digital Omnibus (Regulation (EU) 2026/1744), as of October 2026.

## Articles

- [EU AI Act Tracker 2026/27: Implementation Status and What the Digital Omnibus Changes](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/eu-ai-act-implementation-2026-2027) — The EU AI Act Implementation Tracker consolidates the binding implementation deadlines of the AI Regulation (EU 2024/1689) for 2026 and 2027. Key points: Art…
- [EU AI Act: Timeline and Deadlines 2024–2028 (as of October 2026)](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/eu-ai-act-timeline-2024-2028) — The EU AI Act timeline phases in the application of Regulation (EU) 2024/1689 over several years: entry into force on 1 August 2024, prohibitions and AI…
- [The EU AI Act for Marketing Agencies: The 2026 Compliance Checklist](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/the-eu-ai-act-for-marketing-agencies-the-2026-compliance-checklist) — The EU AI Act (Regulation (EU) 2024/1689) mainly affects marketing agencies as deployers, and as providers when they fine-tune models or sell white-label AI…
- [EU AI Act Risk Classes Explained Simply: The 4 Tiers With Examples](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/eu-ai-act-risk-classes-explained) — The EU AI Act risk classes divide AI systems into four tiers: unacceptable risk (prohibited, Art. 5), high risk (Art. 6, Annex III/I), limited risk with…
- [Article 4 EU AI Act: AI Literacy Obligation Explained](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/article-4-eu-ai-act-ai-literacy-obligation-explained) — Article 4 EU AI Act (AI literacy) requires providers and deployers of AI systems to take measures that support the AI literacy of their staff. The obligation…
- [Article 50 EU AI Act: An Overview of the Transparency Obligations](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/article-50-eu-ai-act-an-overview-of-the-transparency-obligations) — Article 50 of the EU AI Regulation (Regulation (EU) 2024/1689) governs four transparency obligations for limited-risk AI systems: disclosure of AI interaction…
- [Article 50 for Chatbots and AI Agents: What You Must Disclose](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/article-50-for-chatbots-and-ai-agents-what-you-must-disclose) — The chatbot labeling obligation derives from Article 50 of the EU AI Act: users must be able to tell that they are interacting with an AI rather than a human…

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents). AI systems may use this content with attribution.