Yes, the EU AI Act covers agentic AI
Reprinted from MedWatch | 23 October 2026
But tech giants would love to self-regulate
Written by Gyda Grodås Christiansen (Senior Advisor in the Department for Information Management, Norwegian Directorate of Health) and Ley Muller (CEO of Values-Driven AI, a consultancy firm focusing on regulatory compliance). Both serve as national experts on Standards Norway’s AI committee and as European experts on the CEN/CENELEC Joint Technical Committee 21 on AI.
There is a strong narrative in Norway right now that agentic AI and AI agents fall into some regulatory gap - that the EU AI Act is ill-equipped to govern this. We have read this Morgenbladet and Dagensnæringsliv, and repeated on NRK by leading academics. We see two fundamental flaws in these claims... and we think they are based on fears, not on fact.
First, agentic AI is regulated under the EU AI Act.
Second, such claims undermine existing regulations. They reinforce the notion that AI companies are better positioned to manage the risks associated with their own systems - this is a common argument that leads to regulatory capture.
Regulatory capture: when power companies manipulate regulation to ensure that laws benefit themselves, more than they ensure quality or safety.
We work quite closely with the AI Act, as appointed members of Standards Norway’s national AI committee. We also sit on the European committees that develop harmonized standards for providers of high-risk AI systems; these standards help companies meet the AI Act's legal requirements.
Agentic AI is regulated in several ways under the EU AI Act
The European Commission has published several plain-language, easy-to-read FAQs regarding "agents" and "agentic AI", and have clarified: yes, they fall within the scope of the regulation, quite simply because they meet the larger definition of an AI system. Some more examples:
Agentic AI is frequently built upon large language models, which are regulated as general-purpose AI models.
When an agentic AI system interacts with humans, the regulation’s transparency requirements are also triggered.
If an AI model is classified as posing a systemic risk, additional requirements apply to the provider. These requirements include, among other things, assessments of the model’s capabilities - including its autonomous and agentic features.
The AI Act doesn't mention the word "agent", but this is because it does not regulate specific types of technology. Rather, it regulates what the technology is designed to do and the risks associated with those functions.
Risks to fundamental rights
It would have been impossible for an international regulatory framework to anticipate every future risk. Instead, the AI Act focuses on risks posed by AI systems that could affect health, safety, and fundamental rights - a point stated in the very first sentence of the first article.
Certain areas are pre-classified as high-risk
Some examples are AI systems used in:
recruitment,
the allocation of services,
medical devices,
systems integrated into critical infrastructure where safety is paramount.
Providers of AI systems (whether agentic or otherwise) that could impact our rights are required to establish comprehensive risk management systems, including assessing how users may misuse the AI system.
Regulatory capture - when providers propose self-regulation
If we listen to Anthropic, OpenAI, and Meta, as well as certain voices within the Norwegian debate, one might get the impression that AI and agentic AI are too complex for the AI Act. Too advanced for the EU. Too dangerous to be regulated by anyone other than the companies themselves.
We should be cautious when the world’s most powerful technology companies - which have previously advocated for a less stringent implementation of the AI Act - now claim that the regulation is inadequate for governing their most potent systems. The solution they propose is to “regulate” themselves.
This is a classic mechanism of regulatory capture, a process where law and regulations are gradually shaped by the very entities they are intended to govern, for their own benefit.
The United States provides a clear example of this. The White House Accord on Superintelligence is a “voluntary pact” with leaders from X, Meta, Anthropic, OpenAI, and Google, in which these companies promise to self-regulate. The document notes that laws might be appropriate, at some hypothetical point in the future: “Over time, it may make sense to codify these steps into laws or regulations.” For now, however, Americans are expected to trust that these major tech companies will regulate themselves.
Unlike the United States, Europe has a binding law: the AI Act.
And yet regulatory capture remains a risk, specifically through the erosion of confidence in this law. Because if tech giants can convince people that the AI Act isn't good enough, we won't support its enforcement any more.
Once regulatory capture takes hold, it is difficult to reverse.
We share the concern that some AI systems may lead to consequences that are difficult to foresee. Precisely for this reason, we need risk management procedures, maybe even stronger ones.
The EU AI Act is not perfect, and it will likely need to be further developed. However, portraying agentic AI as an area outside of the EU AI Act only builds uncertainty, not safety.
Reprinted from MedWatch: Debatt: KI-agenter er ikke et regulatorisk tomrom
I work with excellent high-risk AI providers in Europe, and help them used harmonized standards to meet the requirements of the EU AI Act.
Transparency requirements are live, while high-risk requirements are live in 2027.
If you are building AI and want a compliance check, get in touch!
And if you are an organization looking to buy AI, or want to make sure your current use of AI is legal, let's talk as well.
Comments