The EU AI Act: what it asks of an agent that acts

What it is

Regulation (EU) 2024/1689  (opens eur-lex.europa.eu, external site), the Artificial Intelligence Act, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It applies to providers placing AI systems on the EU market, to deployers using them in the EU, and to providers and deployers elsewhere when the system's output is used in the EU. An Indian business serving EU customers can be in scope.

Key dates

• 2 February 2025: prohibited practices (Article 5) and the AI literacy duty (Article 4) apply.
• 2 August 2025: obligations for general-purpose AI models, governance and penalties apply.
• 2 August 2026: the Act's general date of application.
• 2 December 2027: high-risk duties for stand-alone systems listed in Annex III, as moved by the Digital Omnibus on AI adopted in 2026.
• 2 August 2028: high-risk duties for AI embedded in products covered by Annex I, such as medical devices and machinery, under the same amendment.

When an agent is high-risk

Classification follows use (Article 6). Annex III lists areas including employment, access to essential private and public services, and emergency triage. Three are directly relevant to the industries elan1 serves:

• Creditworthiness assessment and credit scoring of natural persons, other than for detecting fraud.
• Risk assessment and pricing for natural persons in life and health insurance.
• Evaluating and classifying emergency calls, and emergency healthcare patient triage.

An agent that drafts emails is unlikely to be high-risk. The same agent, given the job of deciding a loan application, would be.

What high-risk means in practice

• Record-keeping (Article 12): the system must automatically log events over its lifetime, so its operation can be traced.
• Transparency (Article 13): deployers must get instructions that let them understand and use the output properly.
• Human oversight (Article 14): people assigned to oversee the system must be able to understand it, decide not to use its output, override it, and interrupt it through a stop button or similar procedure.
• Deployer duties (Article 26): use the system as instructed, assign oversight to competent people, monitor it, and keep the logs under their control for at least six months.
• Fundamental rights impact assessment (Article 27): required before use by public bodies and by deployers using credit scoring or life and health insurance pricing systems.

Penalties

Under Article 99, prohibited practices can draw fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaches of most other obligations, including the high-risk duties, can draw up to €15 million or 3%.

How elan1 maps to it (draft)

• Article 12 logging: elan1 Govern writes a 16-field record for every action, including refusals, that an auditor can verify offline.
• Article 14 oversight: risky actions wait for a named person, who can refuse; one emergency stop pauses every agent at once.
• Article 14 override: in credit and clinical intake, elan1 Decide is recommend-only, so a person always makes the decision.
• Article 26 log retention: records are kept for as long as your policy sets, well beyond the six-month minimum if you choose.

elan1 does not provide conformity assessment. Whether a particular use is high-risk, and who is its provider, are questions for your counsel.