The EU AI Act Can't Keep Up With Agent Risk

Jan de Vries · 2026-08-10

There are more than 7 million AI agents running inside businesses right now. But a growing number of them aren't doing what they were built for. Not because someone reprogrammed them, but because someone gave an agent a new permission, a new tool, or a new database to access. That's the problem with the EU AI Act. The risk categories regulators assign to agents are fixed. The agents, however, are not. ### Why the EU AI Act Falls Short The EU AI Act, which came into force two years ago, goes fully live this August. The heaviest obligations arrive in waves through 2027 and 2028, but the architecture for policing how companies build and use AI is already here. It follows a run of headline-grabbing incidents, including the recent breach of Hugging Face by OpenAI's models. I've been warning businesses about this risk for months, and it's certainly true that we collectively need real guardrails. But I'm not convinced this regulation hits the mark. The prevailing regulatory impulse is to treat AI like any other industrial asset, sorting models and agents into tier-based buckets. The EU AI Act tries to neatly divide these systems into "Prohibited," "High-Risk," and so on. But this is a dangerous illusion of safety. These frameworks are blind to the dynamic nature of the agentic era. We're dealing with non-human identities that act with real autonomy, calling external APIs, chaining tools together, and evolving their execution paths on the fly. Legislation better suited to governing the production of tin cans doesn't work for such dynamic, evolving systems. ### The Intern Problem Think of it this way: a low-risk tool, deployed without governance, can quickly become high-risk. It's the equivalent of an intern waking up one morning with sign-off authority on six-figure contracts. No interview, no manager sign-off, no one noticing the job description changed. These are not static systems. Their behavior is self-directed and their execution paths are non-deterministic. The same agent, given the same task, won't necessarily take the same route twice. That makes fixed regulatory categories almost meaningless. ### The Missing Piece: Agent Accountability Beyond just safety controls, there's a gaping hole in the current regulatory conversation that we urgently need to address: agent accountability. Every agent needs a human who is accountable for what it does. That's not a new idea. Workplaces have run on some version of this philosophy for hundreds of years, holding senior people responsible for the actions of their teams, juniors, and trainees. If an agent is making active business decisions, executing contracts, or moving data, it cannot exist in an anonymous legal vacuum. An enterprise must have a direct, traceable line connecting the agent back to a human. Without an ironclad system of agent accountability, the entire corporate adoption of autonomous networks collapses under the weight of unmanaged liability. ### The Good News for Businesses Here's the silver lining: done right, the same controls that satisfy a regulator are the ones that let you run AI at scale with confidence. In this case, what is good for security is good for business. Take token spend, data access, and resource usage. A business needs visibility into all three to run agents at scale without costs or risks spiraling. It turns out that's largely the same visibility a regulator wants to see for a "high-risk" system. The infrastructure is the same. Only the reason for building it changes. - Track every agent's permissions and access levels - Monitor token spend and data usage in real time - Maintain a clear chain of human accountability - Document changes to agent capabilities - Audit execution paths regularly Adopting a high-risk framework isn't simply about pleasing an auditor. It's about establishing the foundational stability required to trust your own systems enough to actually use them. Done well, this means turning complex, daunting regulatory requirements into practical safeguards that give businesses the confidence to deploy and scale AI responsibly. Agents represent a significant productivity opportunity for businesses. The question for regulators and businesses alike is whether we can build the conditions for humans and agents to work together effectively over the long term. Regulation doesn't need to be an obstacle. It needs to be a foundation.