EU AI Act Is Now Enforced: What US and EU Businesses Must Check Before Deploying an AI Agent

Since 2 August 2026, the EU AI Act requires any AI agent talking to someone in the EU to say it’s an AI. That rule is live, and it carries fines of up to €15 million or 3% of worldwide turnover.

But the rule most founders worry about is not live. The strict “high-risk” obligations were moved to 2 December 2027 by the EU’s Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.

So the EU AI Act is half enforced. This EU AI Act checklist covers which half applies to your agent, with five checks to run before it goes live. A lawyer should have the last word on your setup; this is the list we would want on our desk before shipping.

What the EU AI Act enforces today, and what moved to 2027

Three sets of rules apply now: the bans, the AI-literacy duty, and the transparency rules. The heavy rules for high-risk uses wait until December 2027, or August 2028 for AI built into regulated products.

Most founders read “AI Act” and think of conformity assessments, risk files and audits. However, those are the high-risk rules. They are delayed, and most agents will never need them.

What’s live is short and cheap to do: don’t use banned practices, train your people, and tell users they’re talking to an AI.

Does the EU AI Act apply to a US business?

Yes, if your agent’s output is used in the EU. Article 2(1)(c) brings in providers and deployers outside the EU “where the output produced by the AI system is used in the Union.”

For example, a support agent answering a customer in Lyon counts, wherever your servers sit. We looked at what EU regulators are already asking agent owners in AI agents broke out of the lab, now the EU wants answers.

Two words decide who does what. The provider is whoever builds the AI system and puts it out under their name. The deployer is whoever uses it in their business. So if you build your own agent on top of someone else’s model, you are probably both.

Check 1: Is your agent doing anything banned?

Almost certainly not, but rule it out in writing. Article 5 bans a short list of practices, including AI that manipulates people into decisions that harm them, exploits someone’s age or financial situation, or reads employees’ emotions at work.

In practice, the one to watch for a sales agent is pressure: tuning it to push a vulnerable customer into a purchase they don’t need.

Banned practices carry the highest fines in the Act, so write one paragraph saying why your agent isn’t one.

Check 2: Does it touch hiring, credit, insurance or education?

This is the check that decides your tier. Annex III lists the high-risk uses. For a business deploying an agent, the common ones are screening job applicants, scoring credit, pricing life or health insurance, and grading students.

If your agent does none of these, you are in the light tier of the EU AI Act. Answering order questions, booking appointments and qualifying leads are not on the list.

If it does one of them, you are deploying a high-risk system, and from 2 December 2027 Article 26 asks you to:

• put a trained person in charge of oversight, with authority to stop it
• keep the system’s logs for at least six months
• tell workers before you use it on them
• tell people when it is making or helping make a decision about them

The same model can sit in either tier; what it is used for decides. A chatbot that answers questions about your jobs page is light. The same chatbot ranking applicants is high-risk.

Check 3: Does the first message say it’s an AI?

Article 50 requires AI systems that talk to people to tell them they are dealing with an AI, unless it’s obvious. Paragraph 5 says it has to be clear and given “at the latest at the time of the first interaction.”

In other words, the first bubble says it. Not the footer, not the privacy policy, and not after the customer asks.

If you bought the agent, the duty sits with the vendor, but your logo is on the window. So check every channel, including WhatsApp and voice. Being open about the bot also helps service: most AI chatbots fail when customers can’t tell who they’re talking to or reach a person.

One sentence in the first message is the cheapest compliance work you will do this year.

Check 4: Does it make images, audio or video?

If your agent generates synthetic media, Article 50 has two more rules. Providers must mark the output in a machine-readable way. Deployers must disclose deepfakes, meaning realistic images, audio or video that could pass for real.

However, systems already on the market before 2 August 2026 get a grace period for the marking rule, until 2 December 2026. New systems don’t.

A text-only agent can skip this check, and it’s worth confirming that yours really is text-only.

Check 5: Can your team explain what it does?

Article 4 has applied since February 2025: providers and deployers must take measures to build AI literacy among the staff who run the system. The July 2026 amendments softened it. You no longer have to guarantee a level for every person, but you still have to do something.

For a founder, that simply means a short internal page: what the agent may do, what it must hand to a person, and who to call when it gets something wrong. Keep a record of who read it.

Also, the EU AI Act sits on top of GDPR, not in place of it. Every conversation with an EU customer is still personal data, so where your AI and its data run still matters.

If nobody on your team can say what the agent is allowed to do, that’s the first gap to close.

What this EU AI Act checklist can’t tell you

• The amended text. We could not load the Official Journal text of Regulation 2026/1744. Dates here come from the AI Act implementation timeline and three law-firm and vendor summaries that agree with each other.
• Article 4 fines. Commentators disagree on whether the literacy duty can be fined on its own. It is not in Article 99’s list.
• Your national regulator. Each member state enforces through its own authorities, and guidance is still arriving.
• Edge cases. An agent that touches health, finance or employment deserves an hour with a lawyer.

In short, the checks are cheap. Running them takes an afternoon.

---

Shipping an AI agent to customers in the EU? BrillMark builds custom AI agents grounded in your approved knowledge, which hand over or ask for approval when a decision is outside their authority, and are designed around your compliance requirements. Get a free working prototype built on your own website and one real customer journey.