The EU AI Act and AI agents: what a manufacturing or trading company must do

What is the AI Act, and are you a provider or a deployer?

The AI Act, Regulation (EU) 2024/1689, sets rules for AI systems by risk. It distinguishes the provider, who develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, from the deployer, who uses an AI system under its own authority. A company that uses an agent in its business is at least a deployer.

Who counts as provider of an agent that an external party builds and you run under your own brand depends on the setup, for example who decides on the purpose and whose name is on it. Have that assessed for your situation; the obligations differ per role.

Which dates apply now?

The AI Act entered into force on 1 August 2024 and applies in phases. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026, moved the high-risk dates: 2 December 2027 for uses listed in Annex III and 2 August 2028 for AI in products under Annex I.

AI Act dates after the Digital Omnibus (as of October 2026)

Must a chatbot or AI agent say that it is AI?

Yes. Under Article 50, AI systems that interact directly with people must be designed so that people know they are dealing with AI, unless that is obvious. The Commission's guidelines of 20 July 2026 name customer support chatbots as in scope and say helpdesk chatbots do not get the obvious-from-context exception. According to the Commission, AI agents should also disclose on whose behalf they act.

• How: for example a chatbot that opens by saying it is based on AI, an AI label at the top of an email an agent sends, or a voice assistant that says so at the start.
• When: at the latest at the first interaction.
• The duty to design for this lies with the provider; as a deployer you make sure the agent you use does it.
• Staff who use AI to help them write to customers, and send the reviewed message themselves, are not direct interaction with AI.
• According to the Commission, product descriptions and advertising texts written with AI fall outside the labelling rule for published text; claims about for example health, safety or sustainability are not covered by that example, so check those separately.

What does AI literacy require from your company?

Article 4, as amended by the Omnibus, requires providers and deployers to take measures to support the AI literacy of staff and others who use AI on their behalf, without guaranteeing a specific level. According to the Commission, no certificate and no AI officer are needed; you can keep an internal record of training.

• It also covers everyday use: staff who use ChatGPT to write advertising texts should be informed about risks such as hallucination.
• It can also cover contractors, service providers or clients who use AI on your behalf.
• Reading the instructions for use is often not enough, according to the Commission. Train for the specific risks of the systems you use.
• Supervision lies with national market surveillance authorities, from 2 August 2026.

Is a sales, service or order status agent high-risk?

Not by its purpose: customer service, lead qualification, order status and internal questions about ERP or CRM are not listed in Annex III. Classification follows the intended purpose, so the same agent becomes high-risk if you use it to filter job applicants. Annex III covers, among others, recruitment, decisions about staff, emotion recognition and credit scoring of natural persons.

• Employment: AI to recruit or select people, to analyse and filter applications, or to decide on promotion or termination, allocate tasks based on behaviour or traits, or monitor and evaluate the performance and behaviour of staff.
• Credit: AI that evaluates the creditworthiness of natural persons. Credit checks on companies that are legal persons fall outside this point; sole traders are natural persons.
• Exceptions in Article 6(3): an Annex III system is not high-risk if it does not materially influence the outcome, for example a narrow procedural task. An Annex III system that profiles people is always high-risk.
• Deployers of high-risk systems must, among other things, follow the instructions for use, assign human oversight to competent people, monitor the system, keep logs for at least six months and inform staff before using it at work.
• Manufacturers: the Omnibus moved machinery to Section B of Annex I, so the AI requirements for machinery will come through the Machinery Regulation (delegated acts applying by 2 August 2028), not directly from the AI Act. AI used only for non-safety aspects such as user assistance, efficiency or quality control is not a safety component, unless its failure would endanger health and safety.

• Human in the loop: which agent actions need approval

Which AI uses are prohibited?

Since 2 February 2025, among others: AI that manipulates or deceives people in a way that causes significant harm, AI that exploits vulnerabilities such as age or a person's economic situation with significant harm, social scoring, and AI that infers the emotions of employees at work, except for medical or safety reasons.

For a sales or service agent this means: no manipulative or deceptive techniques that push customers into harmful decisions they would otherwise not take, and no analysis of the mood of your own staff during calls.

What are the fines?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaches of listed obligations, including transparency (Article 50) and the duties of deployers of high-risk systems (Article 26). For SMEs the lower of the two amounts applies. The exact national penalty rules follow from Dutch implementing law.

Who supervises in the Netherlands?

That is not yet settled by law. The cabinet proposes ten existing supervisors, with the Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) coordinating, and the AP as supervisor of the transparency rules. The implementing act is planned for parliament in the second quarter of 2027. The obligations apply anyway, because the regulation applies directly.

• RDI is proposed as the single point of contact for citizens and businesses.
• The GDPR keeps applying next to the AI Act, including the rules on automated decisions about people.
• Some government pages still show dates from before the Omnibus. The dates on this page follow the amended regulation.

What should you arrange now for an AI agent?

1. 01

   List your AI uses

   Which agents and AI tools do you use, for what purpose, and who is provider and who deployer? Check whether any purpose is in Annex III.

2. 02

   Tell people they talk to AI

   Make sure every customer-facing chatbot and agent says so at the first interaction, for example with an AI label on emails an agent sends on its own.

3. 03

   Arrange AI literacy

   Give staff who work with AI a short training on its risks and keep a record of it.

4. 04

   Keep control of actions

   Approval for actions with impact and a log of what the agent does fit the purpose of human oversight, even where the AI Act does not require it.

5. 05

   Check the GDPR

   Personal data in conversations still falls under the GDPR, including a data processing agreement with every supplier that processes personal data on your behalf.

• Human in the loop: which agent actions need approval