TL;DR: I keep hearing companies say "our AI agents are compliant." Then I ask to see their risk assessment documentation. That's usually where the conversation ends. Most companies running AI agents in production today have zero compliance documentation. Zero. And the enforcement timeline is shorter than they think.
I talk to companies deploying AI agents regularly. Customer support agents. Internal workflow agents. Code generation agents.
When I ask about compliance, I get one of two answers:
- "We're small enough that it doesn't apply to us yet."
- "We have a lawyer looking at it."
Both are wrong. The EU AI Act doesn't have a company-size exemption for high-risk applications. And having a lawyer "looking at it" isn't compliance — it's pre-compliance at best.
AI agents are harder to classify under the Act than simpler AI tools. An agent that routes support tickets might be minimal risk. An agent that makes decisions about credit or hiring is high-risk. An agent that generates code that ends up in production? That depends on whether there's human oversight.
The ambiguity means you need to document your reasoning. Not because the Act requires perfect classification. Because it requires you to show you thought about it.
1. Don't try to classify your whole AI stack at once. Do it one agent at a time. What does it do? What happens if it makes a mistake? Is a human reviewing its decisions?
2. How do you monitor what the agent is doing? How often? Who's responsible? If the answer is "we check the logs occasionally," that's not sufficient. Write down what "occasionally" means and how you know it's working.
3. If an agent does something wrong — approves something it shouldn't, shares data it shouldn't — what happens? Who gets notified? How do you roll it back? The Act requires this for high-risk systems.
If you're running AI agents in production and you can't produce a risk assessment for each one, you're not compliant. The assessment doesn't need to be a fifty-page document. But it needs to exist. And it needs to be honest about what the agent does and what could go wrong.
Start this week. You have less time than you think.
*Free [EU AI Act Readiness Scan](https://ataraxium.ai/eu-ai-act-scan.html) — 2 minutes, no email needed for results.*