No separate regime
Agents are AI systems under Article 3(1) and follow the ordinary risk ladder. The task determines the risk, not the autonomy.
Agentic AI governance
Agentic AI governance under the EU AI Act
The central place for governing AI agents that act autonomously: from qualification and roles to controls, risk assessment and responsibility.
Organisations are moving from AI that answers to AI that acts. An agent reads an email, consults a file, checks the conditions, drafts a decision and updates the system, all on its own. Governing agents is not a new legal regime, it is the disciplined application of rules that already exist: the EU AI Act through Article 3(1) and the GDPR through Article 22. This hub brings together the six questions you answer per agent and links to the deep dives.
Updated: October 2026Topic hub
Article 50 from 2 August 2026
For direct AI interaction, the disclosure duty in paragraph 1 sits with the provider. For synthetic output and deepfakes, the duty and actor depend on paragraph 2 or 4.
GDPR Article 22 applies today
Solely automated decisions with legal or similarly significant effects are prohibited in principle unless an Article 22(2) exception applies, and then with the Article 22(3) safeguards. Meaningful human involvement before the decision takes it outside; a rubber stamp does not.
The six controls for autonomous agents
The practical core of agent governance. Human oversight under Article 14 is the design principle beneath them, even where it is not yet formally mandatory.
1
Scoped permissions per agent, following least privilege.
2
A deliberate choice between human in the loop and human on the loop.
3
Logging that makes every agent action reconstructable.
4
A tested kill switch with an incident process.
5
Periodic review of behaviour and risk classification.
6
Inclusion of every agent in the AI register, with an owner.
Who must do what: provider and deployer
With agents the chain is rarely simple: a lab supplies the model, a platform the framework, your organisation configures it. Article 25 can shift the roles. Record the role division per agent, in the contract, before an incident forces the question.
| Role | What | Core duties |
|---|---|---|
| Provider | Builds the agent and places it on the market. | Applicable design duties and Article 50(1) for direct interaction and Article 50(2) for machine-readable output marking. |
| Deployer | Uses the agent under its own authority. | Operational duties, meaningful human oversight (Article 14), use in line with intended purpose, the GDPR Article 22 boundary. |
Deep dive per question
This hub is the starting point. The analyses below cover each component separately.
Qualification
Agentic AI under the EU AI Act (complete guide)
The risk ladder, the value chain, GDPR Article 22 and the full governance framework.
Does an AI agent fall under the EU AI Act?
The qualification question with examples per agent type.
The AI agents governance challenge
Why a fast, decentralised rollout puts governance under pressure.
Privacy and GDPR
AI governance through the privacy function
The route agents come in through as well: AI intake, one register, a DPIA with an AI addendum and DPO oversight.
AI agents and GDPR Article 22
When an agent takes an automated decision, and why consent rarely fixes it.
DPIA for AI systems: when it is required
Article 35 GDPR, the WP248 criteria and the Dutch DPA list applied to AI.
GDPR Article 22: the text
The provision on automated individual decision-making, with commentary.
Roles in the value chain
Controls and oversight
Agentic AI governance: the six controls
Permissions, in or on the loop, logging, kill switch, review and register, with a starting plan.
Human oversight (Article 14)
Oversight that is effective rather than ceremonial.
Risk management system (Article 9)
The system that surrounds the controls around an agent.
Shadow AI: the invisible challenge
Agents rolled out without any governance.
Risk assessment
FRIA under the AI Act: what, who and how (Article 27)
The fundamental rights impact assessment for public and credit/insurance deployers.
DPIA versus FRIA
When privacy impact and fundamental rights impact intersect.
The AI register and inventory
Why every agent belongs in the register, and how to set it up.
Getting started: agent governance in three steps
1. Inventory every agent
List each agent in the AI register with its purpose, model, platform, reachable systems and owner. An agent that is not in the register does not exist for your governance.
2. Classify and assess per agent
Classify on the task, not the vendor. Where high-risk tasks or personal data are involved, check whether a FRIA (Article 27) or a DPIA (Article 35 GDPR) is required and run it.
3. Put controls and oversight in place
Apply the six controls and use Article 14 as the design principle. Make sure supervisors have the time, information and mandate to intervene.
From insight to evidence
Bring your agents under control
With a signed assessment (Fixed price up front · within three working days of a 30-minute call · 1 to 4 weeks), Praxikon puts your AI systems, agents included, in a register, classifies each one, sets out your role per system and delivers a plan for the first 90 days. Effective oversight also needs capable people. Carried out by Zahed Ashkara, the lawyer behind this explanation.
Frequently asked questions about agentic AI governance
What is agentic AI governance?
Agentic AI governance is the practice of applying the EU AI Act, the GDPR and your own controls to AI agents that act autonomously. It is not a separate legal regime: agents are AI systems under Article 3(1) and follow the ordinary risk ladder. In practice you answer six questions per agent: whether it is an AI system, what its risk is, who is provider and who is deployer, which controls it needs, how you assess its risk, and who is responsible when it fails.
Do AI agents fall under the EU AI Act?
Yes, fully. The definition of an AI system in Article 3(1) explicitly refers to varying levels of autonomy, so agents that autonomously execute tasks, call tools and reason in multiple steps are squarely covered. There is no separate category for agents.
What controls does an autonomous AI agent need as a minimum?
Six building blocks: scoped permissions following least privilege, a documented choice between human in the loop and human on the loop, logging that makes every action reconstructable, a tested kill switch with an incident process, periodic review of behaviour and risk classification, and inclusion in the AI register. Human oversight under Article 14 is the practical anchor.
When does an AI agent become high-risk?
When it performs a task listed in Annex III, such as assessing job applicants, preparing credit decisions or triaging applications for essential services. Regulation (EU) 2026/1744 provides that the core obligations for standalone Annex III systems apply from 2 December 2027.
May an AI agent take decisions about customers autonomously?
Sometimes, but GDPR Article 22 sets the frame today. Decisions based solely on automated processing that have legal or similarly significant effects, such as rejecting a claim, are prohibited in principle unless an Article 22(2) exception applies (contract necessity, authorisation by law or explicit consent), and then the Article 22(3) safeguards apply, such as human intervention and the right to contest the decision. Meaningful human involvement before the decision takes it outside Article 22; a routine sign-off does not.