Classifying Agentic AI Under the EU AI Act

"Agentic AI" — tool-using, multi-step systems that plan and act with limited human input — is the question every AI team is now asking the compliance function about. Here is the answer that surprises people: the EU AI Act has no separate tier for autonomy. An agent is classified exactly like any other AI system — by its intended purpose under Article 6 and Annex III. Autonomy does not raise the risk tier; it raises the bar within whatever tier the use lands in, principally through Article 9 risk management and Article 14 human oversight. This page sets out how to classify an agent and what its autonomy actually changes.

The one-line verdict: classify the agent by what it is used for, not by how autonomous it is. An agent doing an Annex III job is high-risk; an agent doing a minimal-risk job is minimal-risk — and in both cases its autonomy reshapes the oversight and risk obligations, not the classification.

"Agentic AI" is not a statutory category

Regulation (EU) 2024/1689 says nothing about "agents", "autonomy levels", or "agentic AI". These are engineering terms, not legal tiers. The Act has four risk buckets — prohibited (Article 5), high-risk (Article 6 + Annex I/III), limited (Article 50), minimal — and a cross-cutting GPAI-model layer (Chapter V). An agent built on a GPAI model is still a system you classify by use; the GPAI model underneath is a separate Chapter V question.

So the first move is the same one you make for any system: write the intended purpose (Article 3(12)) — the specific use, context and conditions for which the agent is supplied — and run it through the ordinary sequence: Article 5 prohibited screen, then Article 6 and Annex III, then the Article 6(3) filter, then Article 50, otherwise minimal.

An agent that books travel, reconciles invoices, or triages a support queue is doing a minimal- or limited-risk job and is classified accordingly. The fact that it chains tool calls and runs unattended does not move it into high-risk.

Where the agent acts decides the tier

The decisive question is the domain the agent operates in:

• An agent acting in an Annex III domain is high-risk. If the agent's intended purpose falls within one of the eight Annex III areas — for example screening job candidates (point 4, employment), making creditworthiness decisions (point 5, essential services), or operating as a safety component of critical infrastructure (point 2) — it is high-risk under Article 6(2), exactly as a non-agentic tool doing the same job would be. Autonomy does not exempt it; if anything, an agent that acts rather than merely recommends is less likely to qualify for the Article 6(3) "no significant risk" filter, because that filter turns partly on the system not replacing or influencing the human assessment.
• An agent in a non-Annex-III domain is not high-risk on the autonomy ground. A coding agent, a research assistant, a scheduling agent — minimal or limited depending on whether it hits an Article 50 trigger.

The high-risk deadline for stand-alone Annex III systems is 2 December 2027 (originally 2 August 2026; moved by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026).

What autonomy actually changes

Autonomy does not change the tier, but it sharpens three things within a high-risk classification:

• Article 14 human oversight. High-risk systems must be designed so humans can effectively oversee them — including the ability to intervene or interrupt. The more autonomously an agent acts across multiple steps, the harder this is to engineer, and the more deliberately you must build in stop controls, review gates, and the means for a human to understand and override the agent's actions. Autonomy raises the Article 14 design burden.
• Article 9 risk management. The continuous risk-management system must address risks across the system's lifecycle. A multi-step agent has a larger action surface — it can take consequential steps an operator did not foresee — so the Article 9 analysis has to reason about chains of actions, not single outputs.
• Reasonably foreseeable misuse. Both Article 9 and the broader high-risk requirements are framed around the intended purpose and reasonably foreseeable misuse. An agent with tool access (sending emails, moving money, changing records) widens the misuse surface materially; your risk analysis must cover the ways autonomy could be turned to unintended ends.

For customer-facing agents, Article 50(1) also applies regardless of tier: if the agent interacts with people who might not realise they are dealing with AI, its provider must design it to disclose that — the same chatbot-style transparency duty, applicable since 2 August 2026 and owed even when the agent is otherwise minimal-risk.

Worked example: Helvetia Ledger, ~60 employees, ~€11M turnover

Helvetia Ledger, a Zurich-headquartered fintech with EU customers, builds two agents.

• Agent A — an internal "ops agent" that reconciles invoices, chases overdue payments by drafting emails for a human to send, and reorganises spreadsheets. Intended purpose: back-office automation. Not prohibited, not Annex III, no Article 50 trigger (no external human interaction) → minimal risk. Its autonomy is real, but the use is minimal — so only Article 4 AI literacy applies. Helvetia still documents stop controls as good practice, but owes no high-risk stack.
• Agent B — a "credit-decision agent" that autonomously evaluates loan applications and issues approve/decline outcomes to consumers. Intended purpose falls within Annex III point 5 (creditworthiness assessment). Because the agent makes the decision rather than assisting a human, the Article 6(3) filter does not rescue it, and it profiles natural persons → high-risk under Article 6(2). Now autonomy bites: Helvetia must engineer Article 14 oversight (a human able to review and override decisions, with the agent designed to support that), run a full Article 9 risk-management system covering the agent's action chains and reasonably foreseeable misuse, and — because the agent talks to applicants — provide the Article 50(1) disclosure. As the developer placing it on the market under its name, Helvetia is the provider (Article 16).

Verdict: same company, same agentic architecture, two completely different obligation sets — decided by use, with autonomy raising the oversight and risk bar inside the high-risk one.

How Confir helps

Confir's rule-based engine classifies an agent the way it classifies anything else — intended purpose, Article 5, Annex III, the Article 6(3) filter, Article 50 — and then surfaces the Article 9 and Article 14 obligations the agent's autonomy makes load-bearing, plus the Article 50(1) disclosure where it is customer-facing. The logic is deterministic: the same intake returns the same tier and obligation list, so "it's an agent" never becomes an excuse to over- or under-classify, and the rule that fired is recorded for audit.

Frequently Asked Questions

Does the EU AI Act have a special category for agentic AI?

No. There is no tier or definition for "agents", "autonomy", or "agentic AI" in Regulation (EU) 2024/1689. An agent is classified like any other AI system, by its intended purpose under Article 6 and Annex III. Autonomy is an engineering property, not a legal risk category — it affects how heavily Article 9 and Article 14 apply within a tier, not which tier you land in.

Is an autonomous agent automatically high-risk?

No. Autonomy does not raise the tier. An agent is high-risk only if its intended purpose falls within Annex III (or the Article 6(1) product route) — for example credit decisions or candidate screening. An agent doing a minimal-risk job, however autonomously, stays minimal-risk. Classify by where the agent acts, then let its autonomy shape the oversight and risk-management obligations within that classification.

How does autonomy affect human oversight obligations?

Through Article 14. High-risk systems must be designed so humans can effectively oversee them, including intervening or interrupting. The more autonomously an agent acts across multiple steps, the more deliberately you must engineer stop controls, review gates and override mechanisms so a person can understand and halt its actions. Autonomy raises the Article 14 design burden but does not change the tier that triggers it.

Why does an acting agent often fail the Article 6(3) exemption?

The Article 6(3) filter can exempt an Annex III system that poses no significant risk — for instance because it only does a narrow procedural task or does not replace or influence the human assessment. An agent that autonomously makes or executes the consequential decision generally does replace or influence that human assessment, so it tends not to qualify. And any system that profiles natural persons is always high-risk, with no exemption.

Do customer-facing agents need a transparency disclosure?

Yes, if they interact with people who might not realise they are dealing with AI. Article 50(1), applicable since 2 August 2026, requires the agent's provider to build that disclosure in regardless of the system's risk tier, unless it is obvious from the context. A customer-facing agent that is otherwise minimal-risk still owes the disclosure; a high-risk agent owes it in addition to its high-risk obligations.

How do I classify an agent built on a GPAI model?

In two layers. The agent (the system) is classified by intended purpose under Article 6 and Annex III, the same as any system. The GPAI model underneath is a separate Chapter V question that binds the model's provider, not you as the system builder — unless you fine-tune it significantly or place it on the market under your name. Do not let "it uses a large model" pull the system into high-risk by itself; the use decides the tier.

Related guides

• How to classify your AI system
• The risk classification decision tree
• The Article 6(3) exemption explained
• Reasonably foreseeable misuse
• Intended purpose
• Article 14 — human oversight
• Article 9 — risk management
• Annex III high-risk use cases