tl;dr

As of 4 November 2026, the EU AI Act requires little of teams that use AI tools and agents from vendors. Your organization is a deployer, the Act’s word for an organization that uses an AI system at work. Everyday uses such as writing, research or code aren’t high-risk, the Act’s label for a short list of uses such as hiring, staff evaluation and credit decisions. That changes when someone uses an agent for one of those tasks.

  • Three rules apply today. Avoid the practices Article 5 bans. Take measures to support your staff’s AI literacy. Disclose AI-generated content in a few specific cases.
  • Using an agent for hiring, staff evaluation or credit decisions can make you a provider. If a skill (a set of instructions an agent loads) tells an agent to rank job applicants, the Act can treat your organization as the provider, the organization responsible for how a high-risk system is designed. Staff can install skills themselves, so this can happen in teams outside IT without IT knowing.
  • Agent logs can feed a high-risk use. People reading them is fine, but an AI system that rates employees’ performance from them can fall under the high-risk rules.
  • High-risk duties for uses such as hiring, staff evaluation and credit start on 2 December 2027. The Digital Omnibus, a 2026 law that amended the Act, postponed them from August 2026.
  • What to do now. Record your AI literacy measures, and find out whether any team uses an agent to screen candidates, rate staff or assess credit.

What the EU AI Act requires today

As of 4 November 2026, three rules in the EU AI Act apply to teams using AI tools and agents from vendors, and none requires much.

The bans in Article 5 have applied since 2 February 2025. The one most likely to affect an IT team is Article 5(1)(f), which bans AI systems used “to infer emotions of a natural person” (an individual) “in the areas of workplace and education institutions”, except for medical or safety reasons.

Article 4 requires providers and deployers to “take measures to support the development of AI literacy” of their staff and others using AI systems on their behalf. That wording comes from the Digital Omnibus on AI, a 2026 law that amended the Act and doesn’t require you to guarantee any particular level of literacy.

Article 50 covers transparency and has applied since 2 August 2026. Telling people they’re interacting with an AI system is the provider’s duty (Article 50(1)), which for a tool from a vendor means the vendor. Under Article 50(4), deployers must disclose deepfakes and AI-generated text “published with the purpose of informing the public on matters of public interest”, unless a person reviewed it and someone holds editorial responsibility. In my view, this duty doesn’t cover internal documents, tickets or code.

When use becomes high-risk

More rules in the EU AI Act apply when someone uses an agent for a task the Act calls high-risk. Take a hypothetical case. A recruiter uses an AI agent on her laptop to draft reports. She installs a skill from a shared folder that tells the agent to read a folder of CVs, score each candidate against the job description and write a ranked shortlist. Nobody in IT knows.

The Act sorts AI systems by how they are used. Annex III lists the high-risk uses, and two of them matter for teams using agents: point 4, employment and worker management, and point 5(b), assessing the creditworthiness of individual people. The Commission’s AI Act Service Desk, its official question-and-answer site, says AI agents “are not a separate category of AI under the AI Act”, and calls its own views on them “only preliminary at this stage”. Processing personal data alone doesn’t make an agent high-risk; that is a question for the GDPR, the EU’s data protection law.

The recruiter’s agent is now doing what Annex III point 4(a) describes: a system used “to analyse and filter job applications, and to evaluate candidates”. The Article 6(3) exception, for Annex III systems that only do a narrow procedural task, doesn’t apply. An Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”, and, as I read it, scoring people from their CVs is profiling (automated evaluation of a person, such as their suitability for a job).

Article 25(1)(c) covers what happens next. If a deployer changes the intended purpose of an AI system (the use it was designed for) “which has not been classified as high-risk”, and the system becomes high-risk as a result, the deployer is treated as its provider. The company bought an AI tool for general office work. As I read Article 25, it’s now the provider of a high-risk hiring system, and from 2 December 2027 it has that system’s provider duties.

No official guidance says whether adding an MCP server (a connector to other tools and data), a skill or a plugin changes an agent’s intended purpose. The Commission’s guidelines on Article 6 classification were still a draft in early November 2026, and they don’t address these components. Until the guidelines are final, I’d assume classification depends on how the agent is used, whichever tool it is.

The same test applies to monitoring. An AI system that rated employees from agent logs for performance reviews would be a system “to monitor and evaluate the performance and behaviour of persons”, which is Annex III point 4(b). People reading the logs themselves don’t trigger it. The Commission’s guidelines on prohibited practices say the emotion-inference ban above covers biometric signals such as typing rhythm, but not written text. In my view, an AI system that used emotion inference from text to rate staff could still fall under point 4(b).

Is your organization a deployer or a provider?

Under the EU AI Act, an organization that uses an AI agent at work is a deployer, and depending on what it does with the agent, it can also become the agent’s provider. A deployer is anyone “using an AI system under its authority” for anything beyond personal, non-professional use (Article 3(4)). A provider develops an AI system, or has one developed, and places it on the market (makes it available in the EU) or puts it into service under its own name. Putting into service includes supplying a system “for own use” (Article 3(3) and 3(11)). Changing what a vendor’s agent is used for so that the use becomes high-risk, as the recruiter’s company did, is one way to become a provider. Building your own agent is another.

Two cases cover most teams:

  • If your staff use AI assistants and agents from vendors for ordinary work, your organization is a deployer and the vendor is the provider. This includes Claude, ChatGPT, Microsoft Copilot, Claude Code and Cursor. It stays true when staff add MCP servers, skills or plugins, unless one of them gives the agent a high-risk use, as the recruiter’s skill did.
  • If someone in your organization builds their own agent and uses it at work, I’d treat your organization as its provider (Article 3(3) and 3(11)). Agent builders that need little or no code, such as Microsoft Copilot Studio and ChatGPT’s GPT builder, let people in sales, HR or finance build agents too, so this can apply in teams outside IT. No official guidance yet says how much configuration makes you the provider of a new AI system. As long as the agent isn’t high-risk, being its provider adds few duties. The exception is an agent that interacts directly with people, such as customers: then the Article 50(1) duty to tell them they’re interacting with AI is yours.

Dates and high-risk duties

The EU AI Act’s high-risk rules (Chapter III, Sections 1 to 3) start to apply to Annex III uses such as hiring on 2 December 2027. The dates are set in Article 113, with transition rules in Article 111.

The EU AI Act, stage by stage What applies when, as of 4 November 2026

Eight stages in order. 1 August 2024: the Act enters into force and its rules apply in stages. 2 February 2025: the Article 5 bans and the Article 4 AI literacy duty apply. 2 August 2025: duties for general-purpose AI models and the Article 99 fines apply. 2 August 2026: Article 50 transparency and most of the rest of the Act apply. 4 November 2026: today, the date of the legal position in this post. 2 December 2026: two new Article 5 bans apply, on AI that makes non-consensual intimate images or child sexual abuse material. 2 December 2027: high-risk duties for Annex III uses such as hiring, staff evaluation and credit apply; they were due on 2 August 2026 until the Digital Omnibus postponed them. 2 August 2028: high-risk duties for AI built into regulated products (Annex I) apply.

  1. 1 Aug 2024 In force The Act becomes law. Its rules apply in stages.
  2. 2 Feb 2025 Bans and AI literacy Article 5 bans and the Article 4 literacy duty.
  3. 2 Aug 2025 Model rules and fines Duties for general-purpose AI models (the large models behind AI assistants) and the Article 99 fines.
  4. 2 Aug 2026 Transparency Article 50 and most of the rest of the Act.
  5. 4 Nov 2026 Today
  6. 2 Dec 2026 Two new bans On AI that makes non-consensual intimate images or child sexual abuse material.
  7. 2 Dec 2027 High-risk duties Annex III uses: hiring, staff evaluation, credit. Was 2 Aug 2026
  8. 2 Aug 2028 High-risk products AI built into regulated products (Annex I).

Under Article 111(2), high-risk systems placed on the market or put into service before 2 December 2027 are covered only if their design changes significantly after that date. Agents change often, so I wouldn’t rely on this.

If your organization uses a high-risk agent, Article 26 requires you to:

  • give oversight to people with “the necessary competence, training and authority” (26(2));
  • monitor its operation and, where you consider it presents a risk, inform the provider and the market surveillance authority (the national regulator) and “suspend the use of that system” (26(5));
  • keep the logs it generates, where you control them, for “at least six months” unless other law says otherwise (26(6));
  • inform workers’ representatives and affected workers before you use it at the workplace (26(7)).

If you built the agent, or became its provider under Article 25 like the recruiter’s company, you have the provider duties in Article 16. They include a risk management system (Article 9), technical documentation (Article 11), a quality management system (Article 17) and a conformity assessment before use (Article 43). Three other provider duties concern security: automatic logging (Article 12), a way for overseers to stop the system (Article 14(4)(e)), and resilience against attempts to alter its use or outputs (Article 15(5)). Article 15(5) doesn’t name prompt injection, but as I read it, prompt injection is one of the attacks it covers.

What to do now

Most teams have one AI Act duty to act on today, AI literacy, and one risk to check: that someone uses an agent for hiring, staff evaluation or credit without anyone in IT knowing. My advice for teams using agents today:

  1. Record your AI literacy measures (Article 4): short guidance for each role that uses agents, and who received it.
  2. Know which agents are on each device, which MCP servers, skills and plugins they load, and what each skill does. That’s how you’d find the recruiter’s skill. For organizations in scope of NIS2, the EU cybersecurity directive for essential and important organizations, national laws implementing it require “asset management” (Article 21(2)(i)) and “supply chain security” (Article 21(2)(d)), which arguably includes agent components.
  3. If agents can reach HR systems or bulk personal data, consider runtime control for those actions: require approval for them or block them, with the rule enforced outside the model. The AI Act doesn’t require it for agents that aren’t high-risk. The GDPR already applies to that processing: security “appropriate to the risk” (Article 32), and an impact assessment before high-risk processing (Article 35).
  4. Keep logs that would let you show what an agent did, and record that their purpose is security. If NIS2 covers you, the same logs help you report significant incidents (Article 23). Check with your works council (the elected body that represents employees in many EU countries) or other employee representatives before you start using them, since national labour law may treat agent logs as employee monitoring.
  5. If you build agents in-house, keep the documentation from the company that makes the model your agent uses. Article 53(1)(b) requires model makers to give it to the businesses that build systems with their models, and you’ll need it if one of your agents becomes high-risk.

Steps 2 to 4 rely on three controls: an inventory of agents and what they load, runtime control that approves or blocks an agent’s actions as they happen, and logs of what each agent did. The AI Act doesn’t require these controls for ordinary use. Each also supports a legal duty: NIS2 or GDPR duties that apply today, or the high-risk duties that start on 2 December 2027.

Agent controls and the law Which legal duties each control supports, as of 4 November 2026

Three controls, as of 4 November 2026. Agent inventory: know what agents run and load. It supports NIS2 asset management and, arguably, supply chain security under Article 21(2)(i) and (d), if NIS2 covers you, today. Runtime control: approve or block risky actions. It supports GDPR security of processing under Article 32 when agents reach personal data, today, and, for high-risk agents, AI Act human oversight under Article 26(2) and a way to stop the agent under Article 14(4)(e) if you are the provider, from 2 December 2027. Agent logs: keep logs and report incidents. It supports NIS2 incident reports under Article 23, if NIS2 covers you, today, and, for high-risk agents, keeping AI Act logs for at least six months under Article 26(6) and automatic logging under Article 12 if you are the provider, from 2 December 2027.

  • Agent inventory Know what agents run and load NIS2 asset management and, arguably, supply chain security (Article 21(2)(i) and (d)), if NIS2 covers you: today.
  • Runtime control Approve or block risky actions GDPR security of processing (Article 32), when agents reach personal data: today. AI Act human oversight (Article 26(2)) and a way to stop the agent (Article 14(4)(e), if you are the provider), for high-risk agents: from 2 Dec 2027.
  • Agent logs Keep logs and report incidents NIS2 incident reports (Article 23), if NIS2 covers you: today. AI Act logs kept for at least six months (Article 26(6)) and automatic logging (Article 12, if you are the provider), for high-risk agents: from 2 Dec 2027.

Summary

As of 4 November 2026, the EU AI Act asks little of ordinary agent use beyond the bans, AI literacy and a few disclosure duties. That changes when someone uses an agent for a high-risk task such as hiring, staff evaluation or credit. Your organization can then become the provider of a high-risk system, with duties from 2 December 2027. Record your AI literacy measures now, and find out whether anyone uses agents that way.

Signals Corps Control Plane is one way to keep an inventory of agents, control their actions and search their logs: its Supply Chain module for the inventory and skill checks, Runtime for controlling actions, and Hunt for investigating agent logs.

This post explains the law as it was on 4 November 2026. It isn’t legal advice for your organization.