Does the EU AI Act Apply to Your Company's AI Agents?

It can, even if your company is outside the EU. The EU AI Act looks at what each AI system does, who it affects and what role your company plays, not at where your office is or how large you are. Most business agents fall into lower risk tiers with light duties, but a few uses, such as screening job candidates or assessing creditworthiness, carry heavy obligations.

This article is general information for business owners and operations leaders, not legal advice. It shows you how to check scope and risk category yourself, so that when you speak to a lawyer you arrive with facts instead of guesses.

Key takeaways

• The Act can reach you if you offer AI to people in the EU, use it with EU staff or customers, or if the output of your system is used in the EU.
• Your obligations depend on your role (provider or deployer) and on the use of each agent, not on the underlying model alone.
• Risk is assessed per use case. One company can run a minimal-risk meeting summarizer and a high-risk candidate screener side by side.
• A written inventory of agents, their purpose, their data and their human oversight answers most of the scoping question.
• Seek legal advice when an agent touches hiring, credit, insurance, education, health, public services, biometrics or anything that decides things about people.

Who can the EU AI Act reach?

The Act has a wide territorial reach. It is aimed at companies that place AI systems on the EU market, companies established in the EU that use AI systems, and, in some cases, companies outside the EU whose system output is used in the EU. A company based in Brazil, the United States or anywhere else can therefore be in scope if its agents serve people in the EU.

The Act also sorts companies into roles, and the role decides the duties:

• Provider: the organization that develops an AI system, or has one developed, and puts it on the market or into service under its own name.
• Deployer: the organization that uses an AI system under its own authority in a professional setting.
• Importer and distributor: organizations that bring a system into the EU market or make it available there.

Most companies running agents for their own operations are deployers. The common surprise is the shift to provider. If you build an agent on top of a third-party model and then offer it to customers under your brand, or you modify an agent so that its purpose changes into a higher-risk use, you may take on provider duties. The model vendor having its own obligations does not remove yours for the system you assemble and operate.

There is also a general duty around AI literacy: people who operate or oversee AI systems for your company should have enough understanding to do that responsibly. This applies even to low-risk agents, and it is usually met through training and clear internal rules. A written AI acceptable use policy for employees is a sensible place to anchor it.

What are the risk levels, in plain terms?

The Act works in tiers. Each tier has a different weight of obligation, and the tier is set by the use, not by how advanced the technology is.

• Prohibited practices: a short list of uses considered unacceptable, such as manipulative techniques that distort people's decisions, social scoring, and inferring emotions of people in workplaces or schools in most cases. If an agent does anything close to these, stop and get advice before continuing.
• High-risk systems: uses in defined areas where decisions can significantly affect people's lives or rights. These include employment and worker management, access to education, access to essential private and public services such as credit and insurance, biometric identification, critical infrastructure, law enforcement, migration and the administration of justice. Duties here include risk management, data governance, logging, human oversight, accuracy and documentation, and they differ for providers and deployers.
• Transparency risk: systems that interact directly with people, generate synthetic content or recognize emotions. The core duty is to make sure people know they are dealing with AI, and that generated content can be identified as such where required.
• Minimal risk: most internal productivity uses, such as drafting, summarizing, searching documents or preparing reports. No specific duties beyond general law, plus the literacy expectation above.

General-purpose AI models have their own set of obligations, which sit mainly with the companies that develop and release those models. As a business using an agent, you generally inherit information from your model vendor rather than carrying those duties yourself, which is one reason to ask for it. The questions to ask an AI agent vendor cover what documentation to request.

The official [overview of the EU Artificial Intelligence Act](https://artificialintelligenceact.eu/) is a useful place to read the structure and the annexes yourself.

A five-step scope check you can run this week

You do not need a legal team to start. You need a clear list of what your agents do. Work through these steps in order and write down each answer.

• Step 1, inventory every agent and AI tool. Include the ones teams adopted on their own. If you suspect there are some you have not seen, the method in shadow AI at work helps you find them without blame.
• Step 2, write one sentence per agent about its purpose. Use the form: this agent does X for Y, using data Z, and a human does W. Vague purposes produce vague risk assessments.
• Step 3, map the people affected. Are they EU residents, EU employees or EU customers? Is the output of the agent used in the EU, even if the agent runs elsewhere?
• Step 4, check each purpose against the tiers. Ask in order: is it close to a prohibited practice, does it fall in a high-risk area, does it talk directly to people or generate content they will see, or is it purely internal assistance?
• Step 5, record your role and the oversight. For each agent, note whether you are a provider or a deployer, who owns it internally, where a human approves or can intervene, and what logs exist.

The result is a simple table you can keep current. For the oversight column, deciding where your AI agent should stop and ask gives a practical way to define approval points. Treat the table as a living record: when an agent gains a new tool, a new data source or a new audience, repeat steps 2 to 5 for that agent.

A frequent mistake is classifying by the tool name instead of the use. The same agent that summarizes sales calls is minimal risk. Connect it to a process that ranks applicants or sets who gets an offer, and the use has changed even if the software has not.

Illustrative scenario: one company, three agents

This scenario is illustrative, not a real case. Imagine a company outside the EU that sells online to customers in several European countries and employs a few people in an EU office.

• Agent one answers customer questions on the website and drafts replies for the support team. It talks directly to people, so the transparency duty matters: customers should know it is an AI agent unless that is obvious. See whether to tell customers they are talking to an AI agent for how to word this.
• Agent two summarizes internal meetings and prepares weekly reports. It is internal assistance with no decisions about people, so it is most likely minimal risk. AI literacy and ordinary data protection still apply.
• Agent three reads CVs and produces a ranked shortlist for the EU office. Employment is a listed high-risk area. This is where the company should pause, get legal advice and decide whether the agent should only prepare information while people make every decision, or whether to avoid the use entirely.

Three agents, one company, three different answers. That is why the inventory comes first and the category comes second.

How Be Human's managed approach handles this

Be Human designs and operates AI agents for companies with identity, memory, tools and permissions under human control. In a first engagement we define one useful role, the data and tools it needs, its approval boundaries and an observable success criterion. That written definition is the same material a scope check needs: purpose, affected people, data, oversight and logs. In managed operations we keep that record current as the agent changes, review permissions, and flag when a requested change moves an agent toward a more sensitive use so that your decision-makers and counsel can review it first. We do not provide legal advice or certify compliance. Your lawyer decides how the Act applies to you, and we supply the facts they need.

Frameworks outside the Act can help structure the internal work. The [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) and the [OECD AI Principles](https://oecd.ai/en/ai-principles) both give practical vocabulary for mapping, measuring and governing AI risk, and they pair well with a regulatory checklist.

When should you seek legal advice?

A lawyer with experience in EU technology regulation is worth involving early in these situations:

• An agent influences decisions about hiring, promotion, pay, task allocation or termination.
• An agent plays a part in credit, insurance, benefits, housing, education admissions or similar access decisions.
• An agent processes biometric data, infers emotions or categorizes people by sensitive traits.
• You offer an agent under your own brand to customers or other businesses in the EU, which may make you a provider.
• You have substantially changed a third-party system or its intended purpose.
• Your agents handle health, safety or critical infrastructure information.
• You operate across several countries and need to understand how national authorities and other laws, such as data protection rules, fit together. Brazilian teams can start with LGPD and AI agents, then compare the overlap with EU requirements.

Bring your inventory table, vendor documentation, a description of human oversight and examples of agent output. Good preparation shortens the engagement and sharpens the advice.

Frequently asked questions

Does the EU AI Act apply if my company is outside the EU? It can. The Act reaches companies that place AI systems on the EU market and, in some cases, those whose system output is used in the EU. Check whether your agents serve, assess or affect people in the EU.

If I use a third-party model such as a commercial chatbot service, am I responsible? Probably as a deployer, yes, for how you use it. The model vendor has its own obligations, but you remain responsible for the purpose you give the agent, the people it affects and the oversight you put around it. If you package it as your own product for others, you may be a provider.

Are internal agents for drafting and summarizing regulated? Generally they sit in the minimal-risk tier, with no specific duties beyond the AI literacy expectation and other laws such as data protection. The classification can change if the output feeds decisions about people, so recheck when the use changes.

Do I need a lawyer for every agent? No. Most low-risk internal agents can be handled with an inventory, a clear policy and basic training. Bring in a lawyer when an agent falls in or near a high-risk area, when you act as a provider, or when your own scope check leaves you unsure.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.