The EU AI Act and Agentic Workflows: A Practical Guide for European Enterprises

The EU AI Act is the first comprehensive legal framework for artificial intelligence in any major jurisdiction. For European enterprises putting agents to work, it is also the first time that deploying an AI system carries legal obligations of its own, beyond the general data-protection rules. This piece is a practical orientation: not legal advice, but a frame for thinking about it.

What the AI Act actually requires

The Act sorts AI systems by risk. Most of the work enterprises hand to agents will fall into the limited-risk or high-risk tiers, depending on the use.

Limited-risk systems (agents that interact with people, generate content or assist decisions) carry transparency obligations. People must know they are dealing with an AI, AI-generated content must be marked as such, and emotion recognition or biometric categorisation requires explicit notice.

High-risk systems (agents used in hiring, credit scoring, critical infrastructure, access to education, law enforcement, justice, migration or essential public services) face substantive obligations: risk management, data governance, technical documentation, human oversight, accuracy and robustness, and monitoring after deployment.

The general-purpose AI models that agents rely on have obligations of their own: transparency about the model, a summary of its training data, and copyright-respecting sourcing.

What this means in practice

If your agents make or assist hiring, lending or eligibility decisions, you are in the high-risk tier and need documented risk management before you deploy. If they produce content your customers see, you need transparency notices. If they assist internal operations and a person takes the consequential decision, you have transparency obligations but not the high-risk overhead.

Three practical points matter most:

1. The record should already exist when you are asked. The Act asks you to show that the system behaves as intended. If every action your agents take is already on a record you can export, that demonstration costs you nothing extra. If not, you assemble it by hand, after the fact.

2. Human oversight has to be real. People must be able to see what the system is doing, step in, and stop it. That depends on deciding up front what agents may do on their own and what waits for a person. It cannot be added later.

3. Your data stays under your rules. Where data rests, how long it is kept and who may use it are decisions you need to be able to make, see and prove.

What you get with Myrmid

• The record, ready for an auditor. Every action is recorded as it happens and cannot be quietly changed. Any outcome exports as a file an auditor can read: who acted, under which rule, on what information. It is written against Articles 12 and 13 from the first line.
• Oversight you can use. You see what your workforce is doing and can stop it. Anything that changes a team, spends beyond a budget or reaches outside your organisation waits for the person who owns that decision.
• Your rules, in your words. What your agents may reach, which models they may use and who signs off are settings in Cockpit, and every change carries a name.

We are not your AI Act compliance officer. But with Myrmid, the documentation, oversight and governance the Act asks for come from running your work, not from a separate project you have to assemble by hand.

Read what Myrmid guarantees your organisation, and the manifesto for the commitments behind it.