Not every agent is high-risk
Classify by purpose and context under Article 6 and its annexes. Assess prohibitions and transparency separately; autonomy alone does not determine the category.
Art. 6 →AI Act: from obligations to evidence
A guide for businesses deploying AI agents: understand scope, assign responsibilities and assess controls without confusing architecture with certification.
Start with use. Then assess the control.
Who puts it into service
Developing or commissioning a system and putting it into service under your name may make you a provider. Review substantial changes and changes of purpose along the value chain.
Art. 3 / 25 →Who uses and oversees it
A deployer uses the system under its authority. For high-risk use, review instructions, accountable people, monitoring and log retention.
Art. 26 →BABYLON can support technical controls. Classification, documentation, organisation and conformity assessment depend on the system and its use. The AI Act does not mandate Touch ID or a particular database.
From an obligation to a testable claim
Indicative technical mappings for high-risk systems, not a conformity assessment. States come from the published snapshot; runtime tests have not been repeated here.
| Obligation | Related control | Available evidence | Limits |
|---|---|---|---|
| Art. 9 · Risk management | Adversarial tests and failure review. | heterogeneous_verification_quorum verified_local | A technical test suite cannot replace an ongoing organisational process. |
| Art. 12 · Automatic logging | Receipts linking operations and outcomes. | cose_ed25519_receipt verified | Receipt integrity does not prove completeness or absence of effects. |
| Art. 14 · Human oversight | Authorisation bound to the action. | secure_enclave_p256 verified_local | Biometrics do not prove understanding; suitable people, authority and interfaces are required. |
| Art. 15 · Accuracy, robustness and cybersecurity | Stopping and containment on failure. | inv_04_fail_stop_halt verified | Stopping does not prove accuracy, fairness or coverage of all threats. |
Timeline: phased application
Timeline checked against Article 1, point 40, of Regulation (EU) 2026/1744, amending Article 113 of the AI Act. Distinguish the general date from specific high-risk provisions. Also review the Article 6(5) exception, prohibitions with their own dates and Article 111 transitional rules for your case.
Initial provisions: Chapters I and II, subject to later exceptions in Article 113.
Governance and general-purpose model rules, with exceptions and transitional arrangements.
General application date; this is not one deadline for every obligation.
Article 6(2) / Annex III high-risk rules: date set by amended Article 113.
Article 6(1) / Annex I high-risk rules: date set by amended Article 113.
AI Act: responsibility, control and evidence
The AI Act and AI agents: obligations by role
From intended purpose to the value chain: define the system, classify risk and assign responsibility before selecting controls.
Read article →Human oversight: from Article 14 to effective control
Authority, context and intervention: a technical reading of human oversight for high-risk agentic systems.
Read article →Traceability: what to record and what evidence proves
Automatic logs, retention and custody: distinguish integrity, completeness and independent observation of an effect.
Read article →Sources and review scope
- EUR-Lex · Regulation (EU) 2024/1689
- EUR-Lex · Regulation (EU) 2026/1744 · Article 1(40)
- European Commission · Regulatory framework and timeline
- AI Act Service Desk · Article 113
This content distinguishes law, technical interpretation and product evidence. It is not legal advice or certification. Specific obligations require assessment of purpose, role and applicable regime.