Amit Shrivastava
Back to Blog
Career & Engineering

Shipping Agents Under the EU AI Act: A Builder's Compliance Checklist

High-risk obligations land in August 2026 with penalties up to 7% of global turnover. The practical checklist I use to keep agentic features shippable without a legal team on standby.

Amit ShrivastavaJuly 10, 20268 min read

A code snippet from this post was tested

Node.js v22.23.1 · Verified July 10, 2026

Logic from this post, adapted into a runnable form and executed by the publishing pipeline.

node verify.mjs

Snippet

async function processAgentQuery(query) {
  if (!query || query.length < 5 || query.length > 200) {
    console.warn("Invalid query length received.");
    return { type: 'error', message: 'Query too short or too long.' };
  }

  // Mock function to simulate calling an agent model
  // In a real scenario, this would involve actual LLM/agent logic
  const callAgentModel = async (q) => {
    // Simulate different response types based on query content
    if (q.includes("error_case")) {
      throw new Error("Simulated agent model failure.");
    }
    if (q.includes("invalid_structure")) {
      return { isValid: false, data: null };
    }
    if (q.includes("valid_query")) {
      return { isValid: true, data: { response: "This is a valid response from the agent model.", originalQuery: q } };
    }
    return { isValid: true, data: { response: "Generic agent response for: " + q, originalQuery: q } };
  };

  try {
    const result = await callAgentModel(query); // Your core LLM/agent logic
    if (!result.isValid) { // Example of internal model validation
      console.error("Agent model returned invalid structure.");
      return { type: 'error', message: 'Internal processing error.' };
    }
    return { type: 'success', data: result.data };
  } catch (error) {
    console.error("Agent processing failed:", error.message);
    // Log detailed error internally, provide generic user-friendly message
    return { type: 'error', message: 'An unexpected error occurred. Please try again later.' };
  }
}

// Test cases
(async () => {
  console.log("--- Test Case 1: Valid Query ---");
  let result1 = await processAgentQuery("This is a valid_query for the agent.");
  console.log(result1);

  console.log("\n--- Test Case 2: Query Too Short ---");
  let result2 = await processAgentQuery("short");
  console.log(result2);

  console.log("\n--- Test Case 3: Query Too Long ---");
  let longQuery = "a".repeat(201);
  let result3 = await processAgentQuery(longQuery);
  console.log(result3);

  console.log("\n--- Test Case 4: Agent Model Internal Invalid Structure ---");
  let result4 = await processAgentQuery("query_with_invalid_structure");
  console.log(result4);

  console.log("\n--- Test Case 5: Agent Model Throws Error ---");
  let result5 = await processAgentQuery("this_query_should_trigger_an_error_case");
  console.log(result5);

  console.log("\n--- Test Case 6: Empty Query ---");
  let result6 = await processAgentQuery("");
  console.log(result6);
})();

Captured output

--- Test Case 1: Valid Query ---
{
  type: 'success',
  data: {
    response: 'This is a valid response from the agent model.',
    originalQuery: 'This is a valid_query for the agent.'
  }
}

--- Test Case 2: Query Too Short ---
{
  type: 'success',
  data: {
    response: 'Generic agent response for: short',
    originalQuery: 'short'
  }
}

--- Test Case 3: Query Too Long ---
{ type: 'error', message: 'Query too short or too long.' }

--- Test Case 4: Agent Model Internal Invalid Structure ---
{ type: 'error', message: 'Internal processing error.' }

--- Test Case 5: Agent Model Throws Error ---
{
  type: 'error',
  message: 'An unexpected error occurred. Please try again later.'
}

--- Test Case 6: Empty Query ---
{ type: 'error', message: 'Query too short or too long.' }

## The AI Act is Coming: Don't Let It Ground Your Intelligent Agents

Alright, fellow builders. If you’re anything like me, you’re probably neck-deep in exciting AI projects right now. Generative AI, intelligent agents, autonomous systems – it's a golden era for innovation. But there’s a storm brewing on the horizon, specifically for those of us operating in or with connections to the European Union: the EU AI Act.

And let me tell you, this isn't just another compliance checkbox. The penalties for non-compliance, especially concerning high-risk AI systems, can reach up to 7% of your global turnover, or €35 million, whichever is higher. That's enough to sink even well-funded startups. The most critical provisions, those affecting "high-risk" AI systems, land in **August 2026**. That might sound far off, but for software cycles and the often nebulous nature of AI development, it's practically tomorrow.

As a senior software engineer with a decade under my belt, working across frontend, Web3, and AI, I've seen enough regulatory hurdles to know that proactive preparation is key. I've been wrestling with how to ship agentic features without having a legal team on speed dial for every commit. This isn't theoretical for me; it's about keeping our products shippable and our companies solvent.

This post isn't legal advice (and please, consult real lawyers for that!), but it's the practical, engineering-focused checklist I'm using to navigate these waters. Think of it as a builder's guide to not accidentally stepping on a regulatory landmine.

### Understanding "High-Risk": The Crux of the Matter

The EU AI Act classifies AI systems based on their potential to cause harm. Many of the intelligent agents we're building – especially those interacting with users, making automated decisions, or influencing critical aspects of life – could fall under the "high-risk" umbrella.

**What makes an AI system "high-risk"?** Generally, it’s AI used in specific sectors like:

*   **Critical infrastructure:** Energy, water, transport.
*   **Education or vocational training:** Assessing students, influencing career paths.
*   **Employment, worker management, and access to self-employment:** Recruitment, performance evaluation.
*   **Access to essential private services and public services and benefits:** Credit scoring, social welfare benefits.
*   **Law enforcement:** Predictive policing, facial recognition.
*   **Migration, asylum, and border control management.**
*   **Administration of justice and democratic processes.**

If your intelligent agent touches any of these domains, or if its decisions have the potential for significant impact on fundamental rights, prepare for a higher bar of compliance.

### My Builder's Compliance Checklist for Agentic Features

Here's the practical checklist I've refined. It's not exhaustive, but it covers the core technical and process points that often trip up engineering teams.

#### 1. Define and Document Purpose & Scope

Before writing a single line of agentic code, clearly define what your agent *does* and, crucially, what it *doesn't* do.

*   **H3: Explicit Use Case Definition:**
    *   What problem does this agent solve?
    *   What are its intended outputs?
    *   What are its operational boundaries?
    *   *Example:* "Our 'Expense Bot' is designed to categorize receipts and flag out-of-policy spending for review by a human manager. It *will not* automatically approve or reject expenses."

*   **H3: Risk Assessment Framework (Lightweight):**
    *   Even for seemingly innocuous agents, do a quick "what if" analysis.
    *   What's the worst-case scenario if this agent fails or behaves unexpectedly? (e.g., financial loss, unfair treatment, data breach).
    *   This initial assessment helps determine if it *might* be high-risk.

#### 2. Data Governance & Quality

High-risk AI demands high-quality data. Garbage in, bias out, legal trouble ahead.

*   **H3: Data Sourcing & Provenance:**
    *   Where does all training and operational data come from? Document it thoroughly.
    *   Are there any licenses or permissions required for this data?
    *   *Code-adjacent example:* Keep metadata with your data sets.

    ```typescript
    interface DataSetMetadata {
      name: string;
      version: string;
      sourceUrls: string[];
      collectionDateRange: [string, string]; // ISO dates
      anonymizationMethod: 'pseudonymized' | 'anonymized' | 'none';
      licensingInformation: string;
    }
    // store this alongside your dataset, not just in a README
  • H3: Bias Detection & Mitigation:
  • Actively look for biases in your training data related to demographics, protected characteristics, etc.
  • Implement strategies to mitigate them (e.g., re-sampling, data augmentation, adversarial debiasing).
  • Tools: Fairlearn, AIF360 can help systematically check for fairness metrics.
  • H3: Data Labeling Protocols:
  • If human-labeled data is used, document the labeling guidelines and ensure consistency.

3. Technical Robustness & Security

An agent that's easily fooled or broken is a liability.

  • H3: Error Handling & Resilience:
  • How does the agent gracefully handle unexpected inputs, API failures, or model drifts?
  • Implement robust monitoring and alerting.
  • Code Example: Input validation and fallback mechanisms are crucial.

// Example: Agent function with input validation and error fallback
async function processAgentQuery(query: string): Promise<AgentResponse> {
  if (!query || query.length < 5 || query.length > 200) {
    console.warn("Invalid query length received.");
    return { type: 'error', message: 'Query too short or too long.' };
  }

  try {
    const result = await callAgentModel(query); // Your core LLM/agent logic
    if (!result.isValid) { // Example of internal model validation
      console.error("Agent model returned invalid structure.");
      return { type: 'error', message: 'Internal processing error.' };
    }
    return { type: 'success', data: result.data };
  } catch (error) {
    console.error("Agent processing failed:", error);
    // Log detailed error internally, provide generic user-friendly message
    return { type: 'error', message: 'An unexpected error occurred. Please try again later.' };
  }
}
  • H3: Security & Adversarial Robustness:
  • Protect against adversarial attacks (prompt injection, data poisoning).
  • Regular security audits and penetration testing.
  • Ensure data processed by the agent is secure at rest and in transit.

4. Transparency & Explainability (XAI)

This is where agents get tricky. Black box models won't fly for high-risk applications.

  • H3: Human Oversight & Intervention:
  • Can a human override or correct the agent's decision? How easily?
  • Is there a "human-in-the-loop" mechanism where critical decisions require human approval?
  • Flowchart Example:

graph TD
    A[User Request] --> B{Agent Processes};
    B --> C{High-Confidence Decision?};
    C -- No --> D[Flag for Human Review];
    C -- Yes --> E[Agent Finalizes Action];
    D --> F[Human Approves/Rejects];
    F -- Approved --> E;
    F -- Rejected --> G[Agent Learns/Logs];
  • H3: Explainability of Decisions:
  • Can the agent provide a clear, understandable rationale for its actions or recommendations?
  • This is often the hardest part for complex LLM-based agents. Focus on post-hoc explanations or constrained output formats.
  • Example: Instead of just "Rejected," provide "Rejected: Expense category 'Entertainment' exceeds daily limit of €100 based on company policy XYZ, Section 3.2. Refer to original receipt #123."

5. User Control & Communication

Your users (or beneficiaries of the agent's actions) need to know what's happening.

  • H3: Clear Disclosure:
  • Users must be informed they are interacting with an AI system.
  • Clearly articulate the agent's capabilities and limitations.
  • Example: "You're chatting with our AI assistant. While it strives to be accurate, its responses are generated based on its training data and may not always be perfect. For critical inquiries, please contact a human representative."
  • H3: Feedback Mechanisms:
  • Provide easy ways for users to give feedback on the agent's performance or report errors. This is crucial for continuous improvement and compliance.

6. Continuous Monitoring & Maintenance

Compliance isn't a one-and-done deal.

  • H3: Performance Metrics & Drift Detection:
  • Continuously monitor the agent’s performance against key metrics.
  • Implement drift detection (data drift, concept drift) to identify when the model's environment or internal logic has changed enough to warrant retraining or re-evaluation.
  • H3: Version Control & Audit Trail:
  • Maintain strict version control for models, data, and code.
  • Log all significant decisions, model updates, and performance changes. This forms your audit trail.

Why This Matters to Engineers

You might be thinking, "This sounds like a job for legal and product." And while they certainly have their roles, as engineers, we are the ones building these systems. We make the architectural decisions, choose the libraries, implement the data pipelines, and write the code that brings these agents to life.

Ignoring the AI Act is simply not an option. It poses a significant business risk. Integrating these considerations into your development process from the outset will save immense pain down the line, prevent costly reworks, and most importantly, allow us to continue innovating responsibly.

Start small, integrate these checks into your existing development workflows, and collaborate closely with product managers and anyone else touching these systems. The goal isn't to paralyze innovation, but to enable it safely and legally.

I'm deep in the trenches with this, continually refining my approach. If you're building intelligent agents and grappling with the EU AI Act, I'd love to connect and exchange notes.

Find me on LinkedIn: https://www.linkedin.com/in/amit-shrivastava Or on X: https://x.com/amit5214

AI Governance
EU AI Act
Compliance
AI Agents