Regulating AI Agents

INTRODUCTION

• AI agents can perform tasks competently yet fail unpredictably, exceed their capabilities, mislead users, and remain vulnerable to manipulation.The vending-machine experiments illustrate autonomous systems that could neither reliably accomplish assigned purposes nor recognize the limits of their artificial agency.Source: INTRODUCTION · pp. 3–4
• The EU AI Act’s risk-tiering, conformity assessments, standards, and codes of practice assume systems are bounded at deployment, stable over time, and governed through clearly delineated human roles.Those premises become brittle when applied to agents capable of autonomous action and adaptation.Source: INTRODUCTION · pp. 6–7

A. Definitions

• Most AI agents qualify as AI systems, but high-risk classification depends on intended use, creating uncertainty for general-purpose and adaptable agents whose real-world uses are difficult to determine ex ante.This uncertainty raises the risk that systems with significant real-world impact fall outside the Act’s core obligations.Source: A. Definitions · pp. 9–10
• Draft Commission guidelines would generally classify GPAI systems as high-risk unless providers explicitly exclude high-risk uses across relevant materials and those exclusions are credible given foreseeable capabilities.A disclaimer alone does not prevent high-risk classification when high-risk uses remain feasible and reasonably foreseeable.Source: A. Definitions · p. 10

B. Value Chain Governance

• The Act distributes governance across GPAI model providers, AI system providers, and deployers, but effective risk management depends on coordination despite persistent expertise, resource, and deployment-context asymmetries.Model providers generally hold greater technical expertise and resources, while system providers and deployers better understand specific downstream contexts.Source: B. Value Chain Governance · p. 11
• AI-agent risk management must be refined during deployment because providers cannot anticipate risks arising from particular architectures, tools, and operating environments; Article 25(2) partially addresses this through downstream-provider cooperation.When downstream modifications turn a GPAI system into a high-risk system, the downstream actor becomes the provider, while the initial provider must facilitate compliance.Source: B. Value Chain Governance · p. 12

C. The GPAI Code of Practice

• The GPAI Code of Practice uses two tracks to identify systemic risks: deployment-informed capability assessment and mandatory assessment of CBRN, loss-of-control, cyber-offense, and harmful-manipulation risks.The criteria include specificity to high-impact capabilities, significant EU-market impact, and propagation at scale across the value chain.Source: C. The GPAI Code of Practice · p. 13
• The Code of Practice requires open-ended evaluations of GPAISR models in broader systems, including agents using tools and action sequences, while addressing adaptive learning and coordination failures.This approach is designed to surface capability boundaries and emergent properties rather than testing only isolated requests.Source: C. The GPAI Code of Practice · pp. 13–14
• The Code of Practice combines evaluation, scenario-based modeling, harm estimation, postmarket monitoring, external evaluators, and incident or user feedback to determine whether systemic risks are acceptable.Unacceptable or foreseeably unacceptable risks require deployment restriction or refusal, reassessment after safeguards, and proportionate measures ranging from data curation to staged deployment and agent-level safeguards.Source: C. The GPAI Code of Practice · pp. 14–15

a. Article 15’s Conception of Performance

• Article 15’s performance framework relies on accuracy, robustness, and consistency, making its application to AI agents difficult because agentic tasks often lack predetermined standards.Accuracy and consistency are more suitable for systems such as image recognition or credit scoring, where outputs can be evaluated against fixed benchmarks.Source: a. Article 15’s Conception of… · pp. 17–18
• AI-agent competence remains difficult to evaluate because output metrics may miss how systems operate, while explanations of internal reasoning may not reflect the reasoning driving behavior.This limits the reliability of assessments based on either observed outputs or elicited reasoning explanations.Source: a. Article 15’s Conception of… · p. 18
• Robustness is the Article 15 metric best suited to agents because it can address behavioral stability across changing conditions, interactions, and environmental feedback.The provision’s emphasis on resilience to errors, faults, and inconsistencies could support requirements that agents withstand failures in multi-agent settings.Source: a. Article 15’s Conception of… · pp. 18–19
• Article 15 operationalizes robustness mainly through technical-fault resilience, redundancy, fail-safe measures, confidence thresholds, and shutdown mechanisms.For post-deployment systems, it focuses especially on feedback loops in which biased outputs compound over time.Source: a. Article 15’s Conception of… · pp. 17, 19
• This narrow conception leaves changes in agent objectives, unintended goal pursuit, and harms from extended real-world interactions largely outside the Act’s scope.Those omissions are especially significant for agents whose behavior can change after deployment.Source: a. Article 15’s Conception of… · p. 19

Risk management system

• Article 9 requires providers to identify and manage health, safety, and fundamental-rights risks through a continuous, iterative process across the system’s lifecycle.This lifecycle orientation is more compatible with AI-agent failures that emerge during deployment and interaction, and may capture failures that performance metrics miss.Source: b. Article 9’s Risk Management System · p. 20
• Article 9’s risk-management obligations cover only risks reasonably mitigable or eliminable through system design, development, or technical information.This boundary may leave harms from unforeseen emergent behavior and real-world interactions outside the provision’s effective reach.Source: b. Article 9’s Risk Management System · p. 20
• Deployers’ relevant performance obligations are limited to logging and monitoring, despite deployment choices such as tool access, permissions, and operating environment shaping AI-agent performance.The comparatively light regulatory demand on deployers is concerning because they may have the greatest ability to control agents during deployment.Source: b. Article 9’s Risk Management System · p. 21

c. Model Provider Obligations

• Providers of general-purpose AI models with systemic risk must conduct state-of-the-art evaluations, adversarial testing, and Union-level systemic-risk assessment and mitigation.These obligations appear in Article 55(1), while the Code of Practice operationalizes them through its Safety and Security chapter.Source: c. Model Provider Obligations · p. 21
• The Code of Practice combines evaluation, scenario modeling, external oversight, and iterative reassessment to identify agent capabilities, emergent behaviors, and deployment failures.Its adaptive structure is comparatively comprehensive for performance-related governance, although agent behavior may remain opaque and failures may arise through novel or multi-agent interactions.Source: c. Model Provider Obligations · pp. 21–22
• Provider safeguards can adjust training, limit system actions, slow deployment, improve interpretability, or prevent safeguard bypasses, but they are less effective against gradual misalignment during complex autonomous tasks.The framework better addresses harmful responses to particular inputs or isolated actions than problematic strategies that emerge as agents pursue objectives over time.Source: c. Model Provider Obligations · p. 22
• Information obligations require providers to support understanding of model capabilities and limitations, but their underspecified content may leave downstream actors without granular, context-specific disclosures.High-level claims of broad task performance paired with general caveats can limit the practical scrutiny of uneven and brittle agent capabilities.Source: c. Model Provider Obligations · pp. 22–23

B. Misuse

• AI-agent misuse has two forms: malicious actors deploying agents for nefarious purposes and hijacking others’ agents to access valuable resources.These categories include offensive cyber operations and attacks that exploit agents operated by others.Source: B. Misuse · p. 23
• Advanced agents lower barriers to offensive cyber operations, enabling less technically skilled organizations and individuals to conduct previously inaccessible attacks.A reported campaign used Anthropic’s Claude-based agents for cyber-espionage. 92Source: B. Misuse · p. 23
• Attackers can hijack agents through hidden instructions to steal credentials and code, with risks increasing as agents improve and enter safety-critical domains.Attackers reportedly used website instructions to induce Google’s Antigravity agent to exfiltrate user data. 94Source: B. Misuse · p. 23
• Hijacked internal AI-company agents could act as trusted insiders, exposing models and code while interconnected systems allow misuse to cascade across agents.These compromises could provide access to state-of-the-art AI systems for further malicious adaptation.Source: B. Misuse · p. 24
• GPAI model providers have greater leverage than deployers to prevent misuse because they control capability releases, access, and security measures.Deployers can mitigate misuse to some degree, but model providers determine key upstream safeguards.Source: B. Misuse · p. 24
• The AI Act assigns its most specific and demanding misuse-prevention obligations to providers of GPAISR models, while downstream actors mainly face general robustness, cybersecurity, and risk-management duties.Those downstream duties are oriented toward traditional product and security risks rather than distinctive autonomous-agent exploitation.Source: B. Misuse · p. 24

a. Model Provider Obligations

• Article 55(1)(d) requires providers of general-purpose AI models with systemic risk to ensure adequate cybersecurity for the model and its physical infrastructure.The Act addresses misuse primarily through systemic-risk governance at the underlying GPAISR-model level.Source: a. Model Provider Obligations · p. 24
• Unauthorized access to model parameters can bypass downstream safeguards and enable unsafe redeployment, prompting the Code of Practice to emphasize preventing their extraction or copying.Model parameters are the weights that determine how the model behaves.Source: a. Model Provider Obligations · p. 25

i. Systemic Risk Identification and Assessment

• Article 55(1)(a)–(b) obligations and specified systemic risks cover agent misuse involving cyber offenses, CBRN threats, harmful manipulation, scams, disinformation, and prohibited materials.99 100These provisions address misuse scenarios associated with AI agents, including large-scale scams and coordinated disinformation campaigns.Source: i. Systemic Risk Identification and… · p. 25
• The framework requires providers to assess risks throughout the model lifecycle, consider real-world misuse in complex software and multi-agent systems, and apply a safety margin for rare but severe harms.101 102 103This extends assessment beyond development to risks that materialize after deployment as autonomous agents.Source: i. Systemic Risk Identification and… · p. 25
• Because misuse is intentional and designed to evade detection, development and deployment reviews may miss harmful steering, repurposing through benign task sequences, or agent combinations producing harmful outcomes.Mandatory external evaluations occur only at set intervals, making them poorly suited to detecting misuse that unfolds over extended periods.Source: i. Systemic Risk Identification and… · pp. 25–26

ii. Misuse Risk Mitigation

• Conventional safeguards such as content filters, refusal mechanisms, and robustness testing are poorly suited to harms emerging through lengthy agentic actions, tool use, or coordination among agents.A hijacked advice agent could subtly steer users over multiple seemingly benign exchanges, while single-exchange safeguards remain inadequate.Source: ii. Misuse Risk Mitigation · p. 26
• Access controls and staged release may reduce malicious access to powerful agents, but provide little leverage over downstream incorporation or real-world behavior, leaving much to post-deployment monitoring and governance.The Code of Practice offers limited concrete guidance for safeguards after access is granted.Source: ii. Misuse Risk Mitigation · pp. 26–27

iii. Model Theft Prevention

• The Code of Practice requires risk-based model security against unauthorized access, copying, theft, and self-exfiltration through controls, encryption, hardened interfaces, testing, attack exercises, and incident response.These measures aim to preserve provider control before public release or secure deletion.Source: iii. Model Theft Prevention · p. 27

b. High-Risk AI System Provider Obligations

• Article 15 requires high-risk systems to resist adversarial manipulation, but its vulnerability-focused approach does not adequately address agents that autonomously execute malicious plans or combine innocuous actions into harm.The broader risk-management and information-disclosure framework depends on GPAI providers supplying relevant information to system providers and deployers.Source: b. High-Risk AI System Provider… · pp. 28–29

c. (High-Risk) AI System Deployer Obligations

• High-risk-system deployers must take appropriate technical and organizational measures and comply with narrow prohibitions and transparency duties, but need not anticipate or mitigate novel hijacking and repurposing of autonomous agents.The Act addresses deployment-stage misuse only indirectly.Source: c. (High-Risk) AI System Deployer… · p. 29

C. Privacy

• AI agents amplify conventional language-model privacy risks by actively collecting and sharing sensitive information, rather than merely reproducing data embedded in training sets.An agent disclosed confidential acquisition information after accessing it directly, illustrating this distinct risk.Source: C. Privacy · pp. 29–30
• Agents that operate across personal, professional, or multiple-agent contexts may violate contextual integrity by transferring information beyond its appropriate purpose or combining data across systems.Even individually appropriate access by scheduling, financial, and browsing agents can create inappropriate aggregation or exposure through shared infrastructure or a single breach.Source: C. Privacy · pp. 30–31
• The AI Act leaves comprehensive personal-data regulation to the GDPR and instead supports data-subject rights and enforcement by allocating responsibilities across the AI value chain.The analysis therefore examines whether this supporting role remains effective when agents transfer and use information across diverse contexts.Source: C. Privacy · p. 31

a. High-Risk AI System Deployer Obligations

• AI agents undermine DPIAs and Article 10 data-governance rules because their data processing, purposes, and behavior may evolve after deployment without a single identifiable original purpose.The Act’s continuous risk management requirement does not provide corresponding continuous data governance, leaving privacy harms from unexpected reuse or sharing insufficiently addressed.Source: a. High-Risk AI System Deployer… · pp. 32–34
• GPAI model providers face continuous lifecycle duties, while deployers and high-risk system providers lack a clearly allocated responsibility for contextual privacy harms arising during use.Relevant training-data provenance and purpose information may be available in principle, but API-controlled models may require ongoing tracking that the AI Act does not clearly mandate.Source: a. High-Risk AI System Deployer… · pp. 35–36

D. Equity

• AI agents may compound inequality because resource-rich, digitally literate users can capture productivity gains while others face exclusion, including through language and modality disparities.Agents may also intensify discriminatory outcomes by exercising broad discretion across consequential processes such as recruitment with limited human oversight.Source: D. Equity · pp. 36–37

a. Equitable Access

• The AI Act addresses equitable access mainly through non-binding encouragements for accessibility, open-source development, SME participation, and socially beneficial investment, which may not overcome structural barriers.These provisions include accessible design, regulatory-sandbox preferences, reduced microenterprise obligations, and equality-oriented investment guidance.Source: D. Equity · p. 37, a. Equitable Access · p. 38

b. Fair Decisions

• The Act uses binding prohibitions and high-risk classifications to address fairness in decisions affecting education, employment, essential services, public functions, biometrics, and emotion recognition.These classifications trigger heightened provider obligations and target risks including misidentification, profiling, and disproportionate harm.Source: D. Equity · p. 37, b. Fair Decisions · pp. 38–39
• Fundamental Rights Impact Assessments require deployers to identify affected groups, assess harms, and plan safeguards, but their scope excludes many consequential private-sector deployments.Excluded examples include employment management, private educational AI, commercial biometrics, and privately operated critical infrastructure.Source: b. Fair Decisions · pp. 39–40
• FRIAs and related deployer controls poorly fit AI agents because periodic assessments, high-level oversight, provider-dependent monitoring, logging, and static representativeness checks do not ensure adaptive equity monitoring.Transparency duties inform affected people about certain systems but impose no substantive fairness or equity requirements.Source: b. Fair Decisions · p. 40
• Deployers must assign monitoring to competent personnel, monitor systems based on instructions for use, and ensure input data are sufficiently representative for the intended purpose.These requirements may be static or depend substantially on how providers formulate instructions.Source: b. Fair Decisions · p. 40

d. High-Risk AI System Provider Obligations

• Provider obligations support equity by requiring staff AI literacy, comprehensible instructions, performance disclosures across relevant groups, and high-risk-system registration, although non-public uses limit scrutiny.These measures can affect whether equity impacts are recognized, understood, and addressed in practice.176 177 178 179Source: d. High-Risk AI System Provider… · p. 41
• Article 95 enables voluntary codes of conduct to address equity concerns beyond the Act’s prescriptive requirements, but these codes are non-binding.The codes apply across AI systems and actors, including providers and deployers.Source: d. High-Risk AI System Provider… · p. 41
• Providers must assess dataset availability, quantity, suitability, and bias risks, with special-category data permitted for bias detection and correction.180 181Special categories include racial or ethnic background, beliefs, health information, biometric identifiers, and sexual orientation.182Source: d. High-Risk AI System Provider… · pp. 41–42
• For adaptive AI agents, bias detection and correction must be ongoing and iterative, making the Act’s conventional order of testing, measuring, and removing sensitive data difficult to operationalize.183 184Agents change over time and across tasks, undermining assumptions that sensitive data are only briefly introduced for correction.Source: d. High-Risk AI System Provider… · p. 42

e. Model Provider Obligations

• The Act’s model-level equity obligations apply mainly to GPAI systemic risks, potentially excluding discriminatory harms from non-frontier models or downstream deployments.This uncertainty may prevent intervention at the model stage, where it could be most effective.Source: e. Model Provider Obligations · pp. 42–43
• Downstream information duties partly compensate for weak model-level equity regulation, requiring model providers to support system providers and deployers’ compliance assessments.Deployers’ fundamental-rights impact assessments depend on information passed through system providers from model providers.Source: e. Model Provider Obligations · p. 43
• The Act is effectively silent on equitable access to AI-agent benefits, with transparency disclosures offering little scrutiny of access or power concentration.Model-level transparency focuses on safety frameworks and systemic-risk assessments rather than distributional consequences.Source: e. Model Provider Obligations · p. 43

E. Oversight

• Effective human oversight is difficult because agents operate at superhuman speed and scale, interact through multiple agents or subagents, and remain difficult to understand.Meaningful oversight requires real-time monitoring and the ability to override actions.Source: E. Oversight · p. 44
• Traditional safeguards may fail for agents: kill-switches require foreseeable triggers, while rollbacks require safe states that consequential actions may eliminate.Oversight can also impose costs that undermine agents’ value proposition of autonomous operation.Source: E. Oversight · p. 44

a. High-Risk AI System Provider and Deployer Obligations

• Article 14 requires high-risk systems to enable human oversight, but deployers are not clearly required to implement providers’ specified measures beyond passive monitoring and risk-based suspension.The framework therefore places design and instruction duties on providers while leaving practical implementation largely unmandated for deployers.Source: a. High-Risk AI System Provider and… · p. 45
• The Act requires competent overseers with technical knowledge, training, authority, and AI literacy, but its light-touch approach is questionable because deployers are closest to real-world system activity.Provider obligations include supporting staff understanding, monitoring, interpretation, override, intervention, and safe interruption.Source: a. High-Risk AI System Provider and… · pp. 45–46
• Article 14(4) presupposes real-time legibility and technically feasible interruption or reversal, a control framework that is difficult to establish for autonomous AI agents.The requirements assume overseers can understand capacities, detect anomalies, interpret outputs, override decisions, and halt systems safely.Source: a. High-Risk AI System Provider and… · p. 46

b. Model Provider Obligations

• The AI Act and Code of Practice impose few specific oversight requirements on GPAISR model providers, offering no concrete mitigation guidance such as model-level oversight protocols or emergency stops.The Code recognizes loss of control as a systemic risk207 and identifies capabilities to evade human oversight208 and inadequate oversight generally209 as risk sources, but does not specify interventions.Source: b. Model Provider Obligations · p. 46
• Beyond a brief reference to transparency into model reasoning, the framework remains largely silent on agent-specific oversight measures.Source: b. Model Provider Obligations · p. 47
• Article 14 oversight duties are difficult to fulfill because model-provider disclosures do not give system providers the granular behavioral information needed to interpret outputs, detect failures, and understand limitations.The framework therefore expects robust system-provider oversight while leaving providers without the information needed to perform it effectively.211Source: b. Model Provider Obligations · p. 47
• These gaps reflect the broader difficulty of applying the AI Act’s conventional risk, substantive, and information mechanisms to agents whose behavior changes across environments and system interactions.The Act’s effectiveness depends not only on substantive requirements but also on the institutions administering and enforcing them.Source: b. Model Provider Obligations · p. 47

III. INSTITUTIONAL IMPLEMENTATION

• Implementation relies on industry-led self-regulation and public enforcement by designated authorities, while governance resources shape both elements.The section examines self-regulation and public enforcement in turn.Source: §III · p. 47

A. Self-Regulation

• Industry-shaped standards and Codes of Practice are central to translating the AI Act’s high-level requirements into concrete obligations, but existing instruments inadequately reflect AI-agent characteristics and multipurpose adaptability.Providers therefore retain significant discretion in interpreting and implementing obligations, including how agent-specific risks should be classified.Source: A. Self-Regulation · p. 48
• The high-risk standards process is industry-dominated, with limited academic and civil-society participation, and the standards were expected only by the fourth quarter of 2026.The Commission may issue binding common specifications if standardization fails, while the delay contributed to postponing high-risk obligations.Source: A. Self-Regulation · p. 48
• The GPAI Code of Practice gives model providers a leading role after a broad stakeholder process, raising concerns about disproportionate influence by leading U.S.-based providers.Published in July 2025, the Code had been signed by 24 model providers, while Meta remained opposed.Source: A. Self-Regulation · p. 49
• The standards and Code of Practice generally provide guidance rather than concrete compliance thresholds or mandatory safeguards, leaving providers to select and justify what they deem appropriate or suitable.This flexibility may support adaptation over time but also invites divergent interpretations and complicates enforcement; for example, standards do not specify accuracy benchmarks for market placement, and the Code does not mandate listed agent-ecosystem safeguards.Source: A. Self-Regulation · pp. 49–50
• Nearly 40 percent of 106 examined AI use cases could not be conclusively classified under existing risk categories, illustrating the ambiguity providers face when classifying AI agents.Examples include workplace training agents whose institutional status is unclear and legal agents analyzing leases that may perform litigation-related evidentiary functions.Source: A. Self-Regulation · pp. 50–51

Authority allocation

• Enforcement authority is divided between national Market Surveillance Authorities for high-risk systems and the AI Office for GPAI models, with national coordination still required for EU-wide measures.When the same entity develops the GPAI model underlying an AI system, responsibility shifts to the AI Office, which receives some MSA powers.Source: B. Enforcement · p. 51

Incident reporting

• Agent incidents are difficult to attribute because harms can arise from interactions among models, external tools, deployment settings, and multiple responsible actors.This complicates determining what went wrong, who is responsible, and which data support root-cause analysis, despite mandatory serious-incident reporting.Source: B. Enforcement · p. 52

Regulatory response

• After serious incidents, authorities must respond explicitly for high-risk systems, while intervention for GPAI models remains discretionary and providers must propose regulatory actions.Providers must investigate incidents, but AI system providers need not report investigation results; the Code of Practice imposes more structured reporting on GPAI providers.Source: B. Enforcement · p. 53

Investigative and corrective powers

• The regime supplies extensive investigative and corrective powers, including documentation demands, inspections, access restrictions, recalls, withdrawals, corrective action, warnings, and fines.Similar investigative powers apply to the AI Office when monitoring GPAI model providers whose models underlie AI agents.Source: B. Enforcement · p. 54

Public enforcement dependence

• Because the AI Act provides no EU private right of action and information about high-risk systems and GPAI models is limited, supervision and enforcement fall almost entirely on the AI Office and MSAs.Individuals may still sue under other applicable EU law when their rights are violated.Source: B. Enforcement · pp. 54–55

C. Resourcing

• Institutional capacity is essential to AI Act enforcement, but EU authorities face shortages of technical expertise and intense competition for AI talent.Effective rule-making and enforcement require expertise in both the AI Office and Member State authorities, while governments struggle to recruit specialists.Source: C. Resourcing · p. 55
• As of late 2025, the EU AI Office employed 125 staff, falling just short of its 140-FTE goal, while AI-agent-rule enforcement’s precise division remained unclear.277 278Enforcement fell within the “AI Regulation and Compliance” and “AI Safety” units.Source: C. Resourcing · pp. 55–56
• A 30-person METR focused almost exclusively on frontier-model agentic risks, highlighting the AI Office’s difficulty overseeing the full spectrum of agent risks [279, 280].The comparison suggests a stark resource disparity between a specialized private evaluator and the public office’s broader remit.Source: C. Resourcing · p. 56
• Independent experts proposed 100 FTE for the AI safety unit and 200 FTE for the full implementation team, while Germany proposed 100 FTE for its national body.Expanded responsibilities would also include regulatory sandboxes and a compliance service desk; Member States were still finalizing their authorities’ staffing structures.Source: C. Resourcing · p. 56
• EU AI Office technical salaries of $52k to $109k trail UK AI Security Institute salaries of $126k to $175k and METR salaries of $200k to $340k.Leading AI companies offer European-office senior technical salaries of $241k to $422k, with some roles exceeding $724k, excluding equity compensation [282, 283].Source: C. Resourcing · p. 57
• The AI Office’s compute strategy is unclear, although frontier-model evaluations require substantial computing and may create security and data-protection risks.The AI Act gives no clear guidance on obtaining the necessary infrastructure, unlike the UK AI Security Institute’s dedicated priority access to national supercomputing resources [286].Source: C. Resourcing · pp. 57–58

IV. LESSONS LEARNED

• The paper identifies three cross-cutting lessons: artifact-centric regulation, the many-hands problem, and institutional capacity constraints that impede monitoring agents and preventing harm.These themes are presented as lessons for lawmakers and technologists in the EU and other jurisdictions.Source: §IV · p. 58

A. Artifact-Centric Governance

• AI agents’ actions and risks depend on their operating environments, accessible tools, and granted permissions, rather than on discrete technical artifacts alone.287, 288Source: A. Artifact-Centric Governance · p. 58
• The AI Act’s intended-use and compute-threshold classifications are inappropriate because agent risks can emerge after deployment or when new affordances are granted, without triggering stronger obligations.289, 290Source: A. Artifact-Centric Governance · pp. 58–59
• California’s and New York’s developer-focused laws avoid some artifact-classification problems but may miss risks from highly capable agents developed or deployed by smaller organizations.291, 292Source: A. Artifact-Centric Governance · p. 59
• Artifact-exclusive regulation misses institutional, organizational, and environmental conditions, making the AI-agent problem part of a broader challenge in governing complex distributed technologies.293Source: A. Artifact-Centric Governance · p. 59
• Governance should look outward to agents’ sociotechnical environments and use existing law governing those environments and resources, including contract, tort, and financial regulation.294, 295Source: A. Artifact-Centric Governance · pp. 59–60

• AI agents create a “many-hands problem” in which fragmented responsibility, control, and knowledge leave no participant with a complete view of resulting risks.Their development, deployment, and operation are distributed across multiple actors and resources.Source: B. The Many-Hands Problem · p. 60
• The Act’s value-chain approach may fail when downstream actors lack timely, granular information and technical resources to monitor or override agents’ actions.Downstream compliance depends on upstream assurances and disclosures that may not provide the practical tools needed to manage agent-specific risks.Source: B. The Many-Hands Problem · p. 60
• Multi-agent interactions require ecosystem-level information unavailable to individual actors, but the Act’s narrowly scoped role-based approach does not provide it.Pooling information already collected under the Act into the EU AI Office or another centralized body is proposed as a starting point.Source: B. The Many-Hands Problem · p. 60
• Third-party providers of tools central to agents’ capabilities and risks often fall outside the Act’s core categories, leaving governance highly limited.The Act relies mainly on contracts between high-risk system providers and component suppliers, while voluntary model terms from the AI Office may not ensure necessary information exchange or technical cooperation.Source: B. The Many-Hands Problem · p. 61

C. Institutional Monitoring

• Pre-market reporting may miss agents’ most consequential real-world impacts because deployment-specific risks emerge and change as systems adapt to new tasks and environments.The Act may receive information accurate at reporting time without capturing later behavior.Source: C. Institutional Monitoring · p. 61
• Periodic updates to risk assessments and technical documentation may not provide the timely information needed to enforce evaluations against the “state of the art.”Limited monitoring particularly weakens requirements that depend on current technical judgments.Source: C. Institutional Monitoring · p. 61
• A stronger monitoring approach would maintain ongoing visibility into agents’ practical behavior rather than rely primarily on one-off reporting requirements.301The approach could also leverage ongoing research into technical monitoring methods.302Source: C. Institutional Monitoring · pp. 61–62
• Addressing AI-agent monitoring is not solely a legislative drafting problem; it also requires institutional capacity, resourcing, and technical infrastructure.302Technical monitoring research is identified as part of this broader institutional response.Source: C. Institutional Monitoring · p. 62

CONCLUSION

• The EU AI Act applies to AI agents in principle but falls short in practice because its regulatory assumptions do not fit their governance challenges.The central problem is regulatory fit rather than regulatory scope.Source: CONCLUSION · p. 62
• The Act’s assumption that societal risks can be traced to one technical artifact, fixed point in time, and predefined actors is misguided for agents operating across tools, actors, and environments.Agent risks arise through interactions with a growing array of complex systems and contexts.Source: CONCLUSION · p. 62
• EU and other lawmakers should expand regulators’ technical expertise and operational capacity rather than merely refine existing legislative instruments.AI agents invite a reimagining of regulation for a rapidly evolving class of autonomous systems.Source: CONCLUSION · p. 62