EU AI Act: Duties for Agent Deployers

Start with your role for the particular system, not with the model vendor’s compliance statement. The Commission’s FAQ distinguishes providers of AI systems, deployers of AI systems and providers of general-purpose AI models. Commission FAQ, read 28 September 2026.

Interpretation for this guide: using a model does not by itself make a deployer a provider. Do not treat that distinction as a conclusion about your company: ask separately who provides the model, who provides the agent system and who uses that system. The cited summaries do not settle whether your particular integration, modification or rebranding changes your role. Start with the role distinctions in the Commission FAQ, read 28 September 2026, then check the official definitions with counsel.

This is orientation, not legal advice or a finding that any reader is inside or outside the Act’s scope. The official text governs if a summary differs from it. Use the Commission’s AI Act page, read 28 September 2026 to reach “Text of the AI Act in all EU official languages” and the final AI Omnibus text; this guide is a signpost, not a substitute for those texts.

Source-check date: 28 September 2026. This is the first baseline for this guide, not a report of a newly announced change. Recheck weekly, next due 5 October 2026, and correct this same guide when the evidence changes.

Separate the role from the application date

The Commission says the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions. AI Act overview, read 28 September 2026. Entry into force is therefore not a sufficient date for an obligation checklist: record the application date of the particular provision.

Timing sources, read 28 September 2026: AI Act application timeline and FAQ transparency section. The first three dates have passed at this source check; the two high-risk dates have not. Do not turn a future high-risk obligation into a claim that it is already applicable.

The overview separately says its ninth prohibition comes into effect in December 2026. Its ninth listed practice concerns AI systems generating non-consensual sexually explicit and intimate content or child sexual abuse material. AI Act overview, read 28 September 2026. Do not assign the earlier prohibition date to that addition.

Which obligations belong to which actor?

High-risk system: deployer duties versus provider duties

For the future high-risk dates above, the FAQ’s deployer section lists use according to instructions, operational monitoring, action on identified risks or serious incidents, assignment of equipped human oversight, and relevant, sufficiently representative input data when the deployer supplies it. FAQ, “What are obligations of deployers of high-risk AI systems?”, read 28 September 2026.

For those same future high-risk dates, the FAQ’s provider section instead describes conformity assessment before market placement or putting into service, quality management and registration in a public EU database. FAQ, “What are the obligations for providers of high-risk AI systems?”, read 28 September 2026. These are separate lists: do not copy the provider list into a deployer checklist or assume the vendor’s work answers the deployer questions.

Use the FAQ’s additional deployer sections as prompts for counsel, not as an exhaustive checklist:

• Does the intended workplace use require advance information to workers and their representatives?
• What information must affected people receive, and when might an explanation be required?
• Is registration required for this public-sector use, and in which part of the database?
• Does a fundamental-rights impact assessment apply, including under the separate discussion of public services, creditworthiness and life or health insurance?

Locate those questions in the FAQ’s high-risk deployer and fundamental-rights assessment sections, read 28 September 2026, then check the operative text and its conditions.

Transparency: distinguish design duties from disclosure duties

For Article 50, applicable from 2 August 2026, the FAQ assigns interaction-notice design duties to providers of systems directly interacting with people and machine-readable output marking to providers of generative AI systems. FAQ transparency section, read 28 September 2026.

For Article 50, applicable from 2 August 2026, the FAQ assigns deployers disclosure duties for deepfake image, audio or video content and AI-generated or manipulated text published to inform the public on matters of public interest. FAQ transparency section, read 28 September 2026.

For Article 50, applicable from 2 August 2026, the FAQ also says deployers of emotion-recognition or biometric-categorisation systems must inform exposed individuals, and that specific exceptions apply to all the listed transparency obligations. FAQ transparency section, read 28 September 2026. Do not infer from these summaries that every agent output needs the same label, or that a model vendor’s marking resolves your disclosure question.

Model-provider obligations are a separate question

In its GPAI discussion, whose obligation set the Commission dates to 2 August 2025, the FAQ assigns model providers technical-information duties, copyright policies and publication of a training-content summary. FAQ GPAI and application-date sections, read 28 September 2026. Ask counsel to check exemptions and transitional provisions rather than applying this summary to every model identically.

Worked example: a third-party customer-service agent

Hypothetical: a company operates a third-party agent on its EU-facing customer-service site. It supplies a product catalogue and support policies, chooses which tools the agent can call, and presents the service under its own brand. No classification or compliance conclusion is assumed.

1. Record the actors and system components. Name the model supplier, agent-system supplier, operating company and customer-facing service. Keep the contract, instructions, branding and change history together. Ask counsel whether the operating company is a deployer, a system provider, or occupies different roles for different activities. Ask whether other roles in the official text, such as importer, distributor or authorised representative, need consideration; the cited pages do not provide their full definitions or duties.

2. Describe the actual intended purpose. Is the agent answering product questions, deciding eligibility for a service, or supporting a credit decision? The FAQ says high-risk classification depends on intended purpose, the function performed and how the system is used. FAQ high-risk classification section, read 28 September 2026. Compare the documented use with the annexes; do not classify it from the word “agent”.

3. Identify who is responsible for transparency. Have counsel identify who bears the interaction-notice design duty and whether any deployer disclosure duty applies to the proposed outputs. Record Article 50’s published application date, 2 August 2026, beside that question, using the FAQ transparency section, read 28 September 2026. Leave exceptions unresolved until checked.

4. Build a conditional high-risk worksheet. If counsel identifies a high-risk route and a deployer role, use the deployer section above to prepare owners for instructions, monitoring, oversight and input data. If counsel identifies a provider role, examine the provider section as well. Record the relevant published future date rather than merging the two routes.

5. Keep the unresolved questions visible. Does rebranding change the role? Do tool additions or modifications change the system or its purpose? Which territorial provisions, exceptions and transition rules apply? The cited summaries cannot decide these questions for this hypothetical company.

Save a decision record, not a scope verdict

For each system version and use case, keep a short record with these fields:

• Intended purpose, users, affected people and deployment locations.
• Proposed role for each actor, with the relevant definition copied from the official text.
• Applicable obligation set, provision, exception and application date, pending counsel’s confirmation.
• Operational owner, supplier evidence and missing information.
• Questions requiring counsel, decision date and next review date.

Limitations: this guide does not reproduce the full regulation, determine territorial scope, resolve role changes, establish an exemption or describe enforcement practice. No legal review was obtained. Do not use it as a compliance certificate.

Sources and maintenance notes

The FAQ still describes transparency guidelines as forthcoming, while the overview describes guidelines and a marking-and-labelling code as already developed. FAQ and overview, both read 28 September 2026. That difference is not resolved here; inspect the linked instruments and official text before relying on their status or contents.

• Commission: AI Act regulatory framework. Displayed last update: 3 August 2026; read 28 September 2026. Start here for the timeline and links to the legal texts. digital-strategy.ec.europa.eu
• Commission: AI Act questions and answers. Displayed last update: 7 August 2026; read 28 September 2026. Use the separate provider, deployer, GPAI and transparency sections. digital-strategy.ec.europa.eu
• Commission: European AI Office. Displayed last update: 8 September 2026; read 28 September 2026. Included for institutional context, not as a company-specific determination. digital-strategy.ec.europa.eu

At the weekly review, compare role guidance, obligation wording, exceptions and dates. Preserve this baseline unless the evidence supports a correction; a new retrieval date alone is not a policy change.