EU AI Act and AI Agent Security: What Changes

Does the AI Act apply to my AI agent?

It depends on what the agent is used for; the underlying technology does not matter. The regulation sorts systems by use: prohibited practices, high risk, transparency obligations, and everything else. An agent is caught by the Article 15 requirements only if it is a high-risk AI system.

It is in two cases. First, if it falls under Annex III, which groups eight areas: biometrics, critical infrastructure, education and vocational training, employment, essential services (public benefits, creditworthiness, life and health insurance pricing, emergency call triage), law enforcement, migration and border control, and justice and democratic processes. Second, if it is a safety component of a product covered by Annex I legislation and subject to third-party conformity assessment.

Article 6(3) provides an exception for some Annex III systems that pose no significant risk, for example a narrow procedural task or preparatory work, but the exception never applies when the system profiles natural persons. A provider that considers its system not high-risk must document that assessment before placing it on the market. An agent that screens job applications falls under employment; an agent answering customer support questions is not, at first sight, in Annex III, which only an analysis of your case can confirm.

What does Article 15 say about robustness and cybersecurity?

It requires high-risk systems to reach an appropriate level of accuracy, robustness and cybersecurity, consistently throughout their lifecycle. The text contains several requirements useful for an agent.

• Resilience to errors and inconsistencies (Art. 15(4)): the system must be as resilient as possible regarding errors, faults or inconsistencies, in particular from its interaction with people or other systems, with technical and organisational measures. Systems that keep learning must address the risk of feedback loops.
• Resilience against unauthorised third parties (Art. 15(5)): the system must resist attempts by unauthorised third parties to alter its use, outputs or performance by exploiting its vulnerabilities.
• AI-specific vulnerabilities (Art. 15(5)): measures must include, where appropriate, preventing, detecting, responding to, resolving and controlling attacks that manipulate the training data set (data poisoning), pre-trained components (model poisoning), inputs designed to cause a mistake (adversarial examples or model evasion), as well as confidentiality attacks and model flaws.

The text does not name prompt injection. In our reading, the requirement to resist third parties who alter outputs by exploiting vulnerabilities covers this kind of attack, but the precise interpretation belongs to legal scholarship, harmonised standards and the authorities.

Which other articles matter for an agent’s security?

Three other articles read alongside Article 15.

Note the last row: if you build a large provider’s model into your agent, the Article 55 obligations fall on that provider. They say nothing about the security of your agent, meaning how your tools, data and permissions are wired together.

What is the application timetable today?

Regulation (EU) 2024/1689 provides for general application on 2 August 2026, with staggered dates. Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, signed on 8 July 2026 and published in the Official Journal on 24 July 2026 according to the European Parliament’s legislative tracker, pushed back the high-risk obligations.

The dates come from the consolidated text of Article 113 published by the European Commission’s AI Act Service Desk and from the European Parliament’s legislative tracker. The official text in the Official Journal on EUR-Lex prevails: check it before any decision.

What already applies to an agent that talks to the public?

Article 50(1): providers must design AI systems intended to interact directly with people so that those people are informed they are dealing with an AI, unless that is obvious to a reasonably well-informed person given the context. According to the Commission’s AI Act Service Desk, this paragraph 1 duty does not fall on deployers. The rule applies to a chatbot whatever its risk level.

What penalties are provided?

For non-compliance with the obligations of providers, authorised representatives, importers, distributors, deployers and notified bodies, or with the Article 50 transparency duties, the cap is EUR 15 million or 3% of worldwide annual turnover, whichever is higher. For prohibited practices, the cap rises to EUR 35 million or 7%. For SMEs, including start-ups, the cap is the lower of the two amounts.

How can you prepare an agent’s security without waiting for 2027?

By treating Article 15 as a test specification. Even if your agent is not high-risk, these requirements describe a reasonable baseline.

1. Qualify the use: does the agent touch an Annex III area? Document the answer.
2. Map the surfaces: untrusted inputs, tools, memory, secrets, identities.
3. Test prompt injection, tool abuse, data leakage and memory or RAG poisoning, with success criteria defined in advance, as Article 9 asks.
4. Plan human oversight for irreversible actions (human approval).
5. Log so you can investigate.
6. Keep the evidence of tests and fixes, without unnecessary personal data. A dated record of what was tested, what was found and what was corrected is the kind of material a risk management system under Article 9 would draw on, whatever your final classification turns out to be.

What role can CleanIssue play?

An agent red team produces technical, reproducible findings. It is neither a certification nor legal advice. In the Agent Red Team Express, we test one agent for 5 days on your development or staging environment, starting within 48 hours of signing the quote and the authorisation; the report follows the format of the sample report. For several agents or a white-label practice, the Custom Red Team is quoted on request. The AI agent security page gives the technical framework, and the method details the approach.

The first conversation is a free 30-minute discovery call.