Related papers: AI Agents Under EU Law

AI Agents Under EU Law

URL: http://arxiv.org/abs/2604.04604v1
Date: Mon, 06 Apr 2026 11:47:38 GMT
Title: AI Agents Under EU Law
Abstract summary: We present a practical taxonomy of nine agent deployment categories mapping concrete actions to regulatory triggers.<n>We propose a twelve-step compliance architecture and a regulatory trigger mapping connecting agent actions to applicable legislation.<n>We conclude that high-risk agentic systems with untraceable behavioral drift cannot currently satisfy the AI Act's essential requirements.
Score: 31.882541856960888
License: http://creativecommons.org/licenses/by/4.0/
Abstract: AI agents - i.e. AI systems that autonomously plan, invoke external tools, and execute multi-step action chains with reduced human involvement - are being deployed at scale across enterprise functions ranging from customer service and recruitment to clinical decision support and critical infrastructure management. The EU AI Act (Regulation 2024/1689) regulates these systems through a risk-based framework, but it does not operate in isolation: providers face simultaneous obligations under the GDPR, the Cyber Resilience Act, the Digital Services Act, the Data Act, the Data Governance Act, sector-specific legislation, the NIS2 Directive, and the revised Product Liability Directive. This paper provides the first systematic regulatory mapping for AI agent providers integrating (a) draft harmonised standards under Standardisation Request M/613 to CEN/CENELEC JTC 21 as of January 2026, (b) the GPAI Code of Practice published in July 2025, (c) the CRA harmonised standards programme under Mandate M/606 accepted in April 2025, and (d) the Digital Omnibus proposals of November 2025. We present a practical taxonomy of nine agent deployment categories mapping concrete actions to regulatory triggers, identify agent-specific compliance challenges in cybersecurity, human oversight, transparency across multi-party action chains, and runtime behavioral drift. We propose a twelve-step compliance architecture and a regulatory trigger mapping connecting agent actions to applicable legislation. We conclude that high-risk agentic systems with untraceable behavioral drift cannot currently satisfy the AI Act's essential requirements, and that the provider's foundational compliance task is an exhaustive inventory of the agent's external actions, data flows, connected systems, and affected persons.

Related papers

Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems [0.0]
Large language model agents are entering regulated financial systems.<n>Security literature characterizing their attack surface is almost entirely laboratory-based.<n> practitioner guidance on deployment is neither peer-reviewed nor connected to a formal threat model.
arXiv Detail & Related papers (2026-06-28T01:11:00Z)
A pragmatic approach to regulating AI agents [0.7276372008305616]
We argue that the unique capacity of agents to autonomously reason, plan, and execute tasks requires a shift in oversight toward the orchestration layer.<n>Our proposals highlight the need for robust accountability mechanisms to manage this heightened autonomy.<n>We advocate for a "traffic light" system of staggered task authorization based on operational risk and the creation of a statutory list of non-delegable legal acts.
arXiv Detail & Related papers (2026-04-16T13:04:52Z)
Regulating AI Agents [1.3705312744613967]
We argue that the European Union's AI Act faces significant obstacles in confronting the governance challenges arising from AI technology.<n>These include performance failures in autonomous task execution, the risk of misuse of agents by malicious actors, and unequal access to the economic opportunities afforded by AI agents.<n>We argue that policymakers in the EU and beyond will need to change course, and soon, if they are to effectively govern the next generation of AI technology.
arXiv Detail & Related papers (2026-03-24T17:38:27Z)
Security, privacy, and agentic AI in a regulatory view: From definitions and distinctions to provisions and reflections [53.468443050795344]
The rapid proliferation of artificial intelligence (AI) technologies has led to a dynamic regulatory landscape.<n>As AI paradigms shift towards greater autonomy, specifically in the form of agentic AI, it becomes increasingly challenging to articulate regulatory stipulations.<n>This paper reviews the evolving European Union (EU) AI regulatory provisions via analyzing 24 relevant documents published between 2024 and 2025.
arXiv Detail & Related papers (2026-03-19T13:50:52Z)
On the Regulatory Potential of User Interfaces for AI Agent Governance [27.951021158233587]
We propose regulating user interfaces of AI agents as a way of enforcing transparency and behavioral requirements.<n>We analyze 22 existing agentic systems to identify UI elements that play key roles in human-agent interaction and communication.<n>Our work exposes a new surface for regulatory action that supplements previous proposals for practical AI agent governance.
arXiv Detail & Related papers (2025-11-30T05:32:13Z)
International AI Safety Report 2025: Second Key Update: Technical Safeguards and Risk Management [115.92752850425272]
Second update to the 2025 International AI Safety Report assesses new developments in general-purpose AI risk management over the past year.<n> examines how researchers, public institutions, and AI developers are approaching risk management for general-purpose AI.
arXiv Detail & Related papers (2025-11-25T03:12:56Z)
Subject Roles in the EU AI Act: Mapping and Regulatory Implications [0.0]
The European Union's Artificial Intelligence Act (Regulation) 2024/1689) establishes the world's first comprehensive regulatory framework for AI systems.<n>This paper provides a structured examination of the six main categories of actors - providers, deployers, authorized representatives, importers, distributors, and product manufacturers.<n>We map the complete governance structure and analyze how the AI Act regulates these subjects.
arXiv Detail & Related papers (2025-10-15T14:21:30Z)
Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition [101.86739402748995]
We run the largest public red-teaming competition to date, targeting 22 frontier AI agents across 44 realistic deployment scenarios.<n>We build the Agent Red Teaming benchmark and evaluate it across 19 state-of-the-art models.<n>Our findings highlight critical and persistent vulnerabilities in today's AI agents.
arXiv Detail & Related papers (2025-07-28T05:13:04Z)
RIRAG: Regulatory Information Retrieval and Answer Generation [51.998738311700095]
We introduce a task of generating question-passages pairs, where questions are automatically created and paired with relevant regulatory passages.<n>We create the ObliQA dataset, containing 27,869 questions derived from the collection of Abu Dhabi Global Markets (ADGM) financial regulation documents.<n>We design a baseline Regulatory Information Retrieval and Answer Generation (RIRAG) system and evaluate it with RePASs, a novel evaluation metric.
arXiv Detail & Related papers (2024-09-09T14:44:19Z)
Governing Through the Cloud: The Intermediary Role of Compute Providers in AI Regulation [14.704747149179047]
We argue that compute providers should have legal obligations and ethical responsibilities associated with AI development and deployment. Compute providers can play an essential role in a regulatory ecosystem via four key capacities.
arXiv Detail & Related papers (2024-03-13T13:08:16Z)
The risks of risk-based AI regulation: taking liability seriously [46.90451304069951]
The development and regulation of AI seems to have reached a critical stage. Some experts are calling for a moratorium on the training of AI systems more powerful than GPT-4. This paper analyses the most advanced legal proposal, the European Union's AI Act.
arXiv Detail & Related papers (2023-11-03T12:51:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.