The EU AI Act Is Missing the Real Threat: Agents Change Faster Than Rules

Jan de Vries · 2026-08-10

There are more than 7 million AI agents running inside businesses right now. But a growing number aren't doing what they were built for. Not because someone reprogrammed them, but because someone gave them a new permission, a new tool, or a new database to access. The risk categories regulators assign to agents are fixed. The agents, however, are not. That's the core problem with the EU AI Act, which came into force two years ago and goes fully live this August. The heaviest obligations arrive in waves through 2027 and 2028, but the architecture for policing how companies build and use AI is already here. It follows a run of headline-grabbing incidents, including the recent breach of Hugging Face by OpenAI's models. I've been warning businesses about this risk for months, and it's certainly true that we collectively need real guardrails to match. But I'm not convinced this regulation hits the mark. ### Why Fixed Risk Tiers Don't Work for Dynamic Agents The prevailing regulatory impulse is to treat AI like any other industrial asset, sorting models and agents into tier-based buckets. The EU AI Act tries to neatly divide these systems into "Prohibited," "High-Risk," and so on. But this creates a dangerous illusion of safety. These frameworks are blind to the dynamic nature of the agentic era. We're dealing with non-human identities that act with real autonomy, calling external APIs, chaining tools together, and evolving their execution paths on the fly. Legislation better suited to governing the production of tin cans doesn't work effectively for such dynamic, evolving systems. Consider this: a low-risk tool, deployed without governance, can quickly become high-risk. It's the equivalent of an intern waking up one morning with sign-off authority on six-figure contracts, with no interview, no manager sign-off, and no one noticing the job description changed. These are not static systems. Their behavior is self-directed, and their execution paths are non-deterministic. The same agent, given the same task, won't necessarily take the same route twice. ### The Accountability Gap Nobody's Talking About Beyond safety controls, there's a gaping hole in the current regulatory conversation that we urgently need to address: agent accountability. Every agent needs a human who is accountable for what it does. That's not a new idea. Workplaces have run on some version of this philosophy for hundreds of years, holding senior people responsible for the actions of their teams, juniors, and trainees. If an agent is making active business decisions, executing contracts, or moving data, it cannot exist in an anonymous legal vacuum. An enterprise must have a direct, traceable line connecting the agent back to a human. Without an ironclad system of agent accountability, the entire corporate adoption of autonomous networks collapses under the weight of unmanaged liability. ### The Good News: Compliance and Good Business Align The good news for firms is that, done right, the same controls that satisfy a regulator are the ones that let you run AI at scale with confidence. In this case, what is good for security is good for business. Take token spend, data access, and resource usage. A business needs visibility into all three to run agents at scale without costs or risks spiraling. It turns out that's largely the same visibility a regulator wants to see for a "high-risk" system. The infrastructure is the same. Only the reason for building it changes. - Real-time monitoring of agent actions - Clear audit trails for every decision - Granular permission controls that can be revoked instantly - Human oversight checkpoints for high-stakes actions Adopting a high-risk framework isn't simply about pleasing an auditor. It's about establishing the foundational stability required to trust your own systems enough to actually use them. Done well, this means turning complex, daunting regulatory requirements into practical safeguards that give businesses the confidence to deploy and scale AI responsibly. ### A Better Path Forward Agents represent a significant productivity opportunity for businesses. The question for regulators and businesses alike is whether we can build the conditions for humans and agents to work together effectively over the long term. Regulation doesn't need to be an obstacle. It can be the foundation that makes responsible AI adoption possible at scale. The smartest companies won't wait for regulators to figure out the nuances of agentic systems. They'll build accountability frameworks now, treating every agent like an employee with a clear reporting line. That's not just compliance. That's good management in the age of autonomous software.