AI agents do not comply with rules. The companies that build and deploy them do. For agents, the main references are the EU AI Act, the voluntary NIST AI Risk Management Framework, the EU Cyber Resilience Act for products with digital elements, and emerging guidance on agent identity. Which apply depends on where you operate and what the agent does.
Is there a law written for agents?
Not that we found. The EU AI Act regulates AI systems by risk tier, not by whether a system is agentic. An agent that screens job applicants is a high-risk use. An agent that summarizes meeting notes likely is not. Classification follows the purpose.
What does the EU AI Act require and when?
The European Commission lists these dates: entry into force on 1 August 2024, prohibitions and AI literacy from 2 February 2025, governance and general-purpose model obligations from 2 August 2025, and general application from 2 August 2026, with transparency rules arriving in August 2026.
The AI Omnibus, in force from 27 July 2026 per the Commission, extended high-risk deadlines: Annex III systems to 2 December 2027 and systems embedded in regulated products to 2 August 2028.
Transparency matters to agents in a practical way. The Commission page says people must be told when they are talking to a machine. An agent that emails customers on your behalf touches this.
What does NIST add?
NIST released the AI RMF 1.0 on January 26, 2023, for voluntary use, built around Govern, Map, Measure and Manage. A Generative AI Profile, NIST-AI-600-1, followed on July 26, 2024. NIST says the AI RMF is being revised.
It is not a compliance regime with auditors by default, but contracts and customers often ask for alignment, so it works as a shared vocabulary.
What about security law for products?
If you sell software with digital elements in the EU, the Cyber Resilience Act applies to the product, including any agent features inside it. Reporting obligations for actively exploited vulnerabilities start 11 September 2026, and main obligations on 11 December 2027.
Is agent identity regulated?
Not directly. NIST's NCCoE released a concept paper on February 5, 2026, proposing to apply existing identity and authorization standards to software and AI agents, treating them as identifiable entities in enterprise identity systems rather than anonymous automation under shared credentials. It is a concept paper with a comment period, not a requirement.
A constructed example
A retailer deploys an agent that answers customer questions in the EU and can issue small refunds. The retailer checks: customers are told it is an AI system (transparency), refunds are limited to its own scoped service account (identity), a named owner reviews logs monthly (governance), and the vendor's product notes cover vulnerability reporting (CRA). No single rule covered all four.
How to check or apply this
- List each agent, its purpose, the data it touches and the markets it serves.
- Classify each use under the EU AI Act tiers with counsel, if it touches the EU.
- Add disclosure wherever an agent talks to the public.
- Give each agent its own credentials with minimum scope, and log its actions.
- Map your controls to AI RMF functions to keep one story for customers.
- Track CRA dates if you ship products with digital elements.
- Re-check dates every quarter. They have moved before.
Safeguard offers compliance automation and agent identity controls that can help you gather evidence. It does not certify you under any regulation.
What about other countries?
This post covers the EU and US references we could confirm from primary pages. Other jurisdictions have their own AI and security rules, and we did not fetch them, so we do not summarize them. If you operate in several regions, build one internal control set from the common threads of risk classification, transparency, human oversight, logging and security. Then ask counsel what each market adds on top.
Quick check
Is the NIST AI RMF legally required?
No. NIST describes it as intended for voluntary use, though contracts may reference it.
Do high-risk AI Act rules apply now?
Per the Commission, Annex III high-risk rules apply from 2 December 2027 after the AI Omnibus. Confirm with counsel for your case.
Sources
- European Commission, AI Act
- NIST, AI Risk Management Framework
- European Commission, Cyber Resilience Act
- NIST NCCoE, Software and AI Agent Identity and Authorization
Last reviewed: 18 October 2026.
