AgentEU AI Act Enforcement Begins 2 August 2026: What Actually Changes for AI Agents
As of today, 2 August 2026, the European Commission can compel, evaluate and fine. Most of what you have read about what this means for AI agents is wrong in one specific, expensive way: it attaches the headline 7% penalty to obligations that do not carry it. Here is the accurate version, the part that is genuinely delayed, and what an agent operator should actually have in place.
What Changed on 2 August
Nothing new becomes illegal on 2 August 2026. What changes is who can do something about it.
General-purpose AI obligations have applied to newly-placed models since 2 August 2025, alongside the GPAI Code of Practice. For that first year the AI Office could persuade, request and publish. From today it can compel. It can demand documentation, evaluate models directly, order corrective measures, restrict or withdraw a model from the EU market, and impose administrative fines. The obligations were already there; the teeth arrive now.
This is the distinction most coverage collapses. "The EU AI Act takes effect in August 2026" is not quite true and has not been true for a year. The enforcement architecture takes effect. If your agent sits on a general-purpose model placed on the EU market, the entity that placed it has moved from a regime of correspondence to a regime of consequences.
The Penalty Tiers, Accurately
The 7% figure is everywhere. It is also, in almost every context it gets quoted in, the wrong number.
The Act sets graduated tiers, and they are not interchangeable:
| Provision | Applies to | Maximum |
|---|---|---|
| Art 99(3) | Prohibited practices under Article 5 — and only these | €35m or 7% |
| Art 99(4) | Operator and notified-body obligations, including the high-risk requirements reached through Article 16 | €15m or 3% |
| Art 99(5) | Supplying incorrect or misleading information to authorities | €7.5m or 1% |
| Art 101 | GPAI model providers | €15m or 3% |
Article 5 covers a short, specific list: social scoring, untargeted facial-image scraping, emotion inference in workplaces and schools, certain biometric categorisation, and real-time remote biometric identification in public for law enforcement. Unless your agent is doing one of those, 7% is not your exposure.
Failing to keep adequate records is not a prohibited practice. Article 12 — the automatic logging requirement — is a design requirement for high-risk systems, enforced against providers through Article 16. That lands in the 3% / €15 million tier. Still substantial. Not 7%.
We are in a position to be blunt about this because we published the wrong figure ourselves. Until a few days ago two pages of this site attached "up to 7% of global revenue" to Article 12, and our own FAQ contradicted itself on the same page. It is corrected now. If a compliance vendor cannot get the penalty schedule right, treat everything else they tell you with corresponding caution — including us.
The Part That Is Genuinely Delayed
The Digital Omnibus pushed the high-risk obligations back, to 2027 and 2028 depending on category. So if you have been told your agent is high-risk and Article 12 compliance is due today, that is not right either.
What that delay does not do is make the record-keeping problem go away. It moves the deadline for a requirement that takes longer to satisfy than most teams assume, because of a property specific to agents.
Why Agents Make This Harder Than It Looks
Article 12 asks for logs that record the period of use, the reference database consulted, the input data, the human oversight applied, and enough of the system's operation to make post-market monitoring meaningful. For a conventional software system that is an engineering task you complete once.
Agents are not conventional software. They are non-deterministic by construction, and the model underneath them changes without your involvement. A provider ships a new checkpoint and behaviour shifts — not catastrophically, usually not visibly, but enough that a conformity assessment conducted in March describes a system that no longer exists in September.
This is why point-in-time certification sits awkwardly with agents. An annual audit tells you the system was compliant on the day someone looked. It cannot tell you the system is compliant now, and "now" is the only tense a regulator asking for records actually cares about.
The practical test: if a supervisory authority asked today what your agent did during a specific session six weeks ago — which tools it called, what data it touched, where a human intervened — could you produce that record, and could you demonstrate it had not been edited since?
What Evidence Should Look Like
The useful shape is continuous rather than periodic, and verifiable rather than asserted. Concretely, that means three properties:
Captured at runtime, not reconstructed. Evidence assembled after the fact from application logs is a narrative about what happened. Evidence emitted by the agent as it acts is a record of what happened. Only one of those survives scrutiny.
Tamper-evident. Hash-chain the events so each one carries the hash of its predecessor. Rewriting any entry forces a re-chain from the beginning, which is detectable by anyone holding a later hash. This does not require a blockchain; it requires SHA-256 and discipline.
Independently verifiable. Sign the resulting attestation with a public-key scheme so a third party can check it without asking you, and without trusting the party that issued it. If verification requires an account with the vendor, the vendor is the trust anchor rather than the cryptography.
How We Do It
AgentApproved issues Ed25519-signed attestation certificates generated from an agent's runtime evidence, hash-chained with SHA-256, mapped against EU AI Act Article 12 and Singapore's Model AI Governance Framework for Agentic AI. Certificates expire after 24 hours, deliberately: a certificate that outlives the evidence behind it is a claim, not a proof.
Verification needs no account, no API key, and no trust in us. The public key is served at /api/v1/attest/keys/public. Reconstruct the canonical payload, SHA-256 it, check the signature. If our service disappeared tomorrow, every certificate we have ever issued would remain verifiable.
The first 1,000 distinct agents attest free; the promotion is still open. After that it is $0.01 in USDC per attestation over x402, which is priced to be beneath the threshold at which anyone needs to think about it.
What To Do This Week
If your agent is built on a general-purpose model placed on the EU market, the enforcement question is live now and belongs to whoever placed that model. Your own exposure depends on classification, and high-risk obligations have moved to 2027–2028.
That is more time than the headlines suggest and less time than it sounds, because the thing being asked for — a continuous, tamper-evident record of what an autonomous system actually did — is not something you can retrofit in the last quarter before a deadline. The evidence has to exist while the agent is running, or it does not exist at all.
Start generating it now, while the stakes are still low and nobody is asking.
Read the Article 12 requirement breakdown →
What is agent attestation? →
Why annual audits fail for non-deterministic systems →
Independent attestation for the MCP servers AWS won't cover →
Questions about attestation for agents or MCP servers: hello@agentapproved.ai