Agentic AI vs Generative AI: What Changes for Your Compliance

Last updated: November 2026 · Reading time: 6 minutes

---

In short. A classic generative AI produces content, then a human decides what to do with it. An agentic AI pursues a goal and carries out actions itself in your tools. The AI Act creates no "agent" category, but this autonomy of action changes how risk is classified, what transparency requires and how human oversight must be organised.

Two different logics

With a generative assistant, you ask a question and get a text, an image or a summary. The AI touches nothing. You copy, send or decide.

An agent receives a goal, for example "chase unpaid invoices older than 30 days." It plans the steps, queries your accounting software, writes the e-mails and sends them. It acts in your environment through tool, API or browser calls.

Criterion	Classic generative AI	Agentic AI
Starting point	A request	A goal
Output	A piece of content	A series of actions
Access to your systems	None or read-only	Read and write (e-mail, CRM, payments, files)
Human oversight	Before any use of the output	During execution, sometimes only afterwards
Typical error	A hallucination in a text	A wrong action already executed (send, delete, transfer)
Traceability	One question, one answer	Dozens of chained steps

The term "agentic AI" often refers to more ambitious architectures where several agents cooperate. The boundary between the two notions remains fluid.

What the AI Act says

The European Commission clarified this in the FAQ of its AI Act Service Desk. Agents do not form a separate category, but the definitions of AI system and general-purpose model are enough to cover them. All the rules applicable to AI systems therefore apply to agents.

In other words, an agent is classified like any other system, according to your role and the use made of it.

Five points where the agent changes the game

1. Risk is determined by what the agent actually does

An assistant that rewords a job posting remains an aid. An agent that analyses applications, shortlists candidates and sends rejections falls under Annex III, point 4, and becomes a high-risk system. The corresponding obligations will apply on 2 December 2027.

General-purpose agents complicate the exercise, because their intended purpose is broad. If you steer a general-purpose agent toward a use listed in Annex III, you may become the provider of a high-risk system within the meaning of Article 25.

2. Transparency applies to every interaction

The Commission's final guidelines on Article 50, published on 20 July 2026, devote a full section to agents. An agent interacting with a person must disclose its artificial nature and the identity of the person on whose behalf it acts.

This information must be built in from the architecture stage, whenever direct interaction with a person is reasonably likely. In multi-agent systems, it occurs at key steps such as authorisation, reporting or validation. An agent that writes to your suppliers or calls your customers is directly concerned.

3. Human oversight must be designed, not assumed

From 2 December 2027, for a high-risk system, Article 14 requires that a human be able to understand, monitor, disregard or interrupt the system. Article 26 requires the deployer to assign this oversight to competent people. With an agent, validating every response no longer makes sense. You need validation points before any irreversible action, minimal access rights and an emergency stop.

This is the principle adopted for the DILAIG AI Agents module. A connected agent reads your internal documents and pre-fills the audit questionnaire, but it does not see the score and can neither submit the audit nor generate the documents. Every justified answer is reviewed and validated by a human.

4. Logging becomes central

From 2 December 2027, high-risk systems will have to record their events automatically (Article 12), and the deployer will have to keep the logs under its control for at least six months (Article 26). For an agent chaining dozens of steps, these traces are the only way to reconstruct a decision or an error.

5. The chain of responsibility lengthens

An agent often draws on a model from a first provider, a framework from a second, an integrator and finally you. Each contract must specify who provides the documentation, who defines the purpose and who answers in case of an incident. The Digital Omnibus also gives the AI Office oversight of systems built by a provider on its own general-purpose model.

Beyond the AI Act

An agent that alone takes a decision producing legal effects on a person also falls under Article 22 of the GDPR on automated decisions. The new EU directive on liability for defective products, which covers software, must be transposed by 9 December 2026 and will apply to products placed on the market after that date. Finally, an agent that reads external content is exposed to prompt injection, a cybersecurity risk before it is a legal one.

Before deploying an agent

• Describe its purpose precisely and check it does not fall under Annex III
• List the tools and data it accesses, and cut its rights to the strict minimum
• Identify irreversible actions and place a human validation before each one
• Plan for announcing its artificial nature on every channel where it talks to people
• Enable and keep execution logs
• Clarify in contracts the roles of the model provider, the integrator and yourself
• Train the people in charge of supervising it

FAQ

Is an AI agent automatically high-risk?

No. Like any AI system, it is high-risk only if its use appears in Annex I or III. An agent that sorts your e-mails remains minimal risk.

Must I tell a customer they are dealing with an agent?

Yes, unless it is obvious to a reasonably well-informed and attentive person. The agent must also state on whose behalf it acts, according to the Commission's guidelines.

Was the AI Act amended for agents?

No, the text does not mention them expressly. It is the Commission's guidelines and FAQ that clarify how the existing rules apply.

Who is responsible if an agent makes a mistake?

It depends on the roles. The provider answers for the design, the deployer for the use and the supervision. Hence the importance of precise contracts.

Read also

• Am I Covered by the AI Act? The Four-Question Test
• OCR, LLMs and the AI Act: Must You Tell Your Client?
• Shadow AI: The Compliance Risk Your Organisation Doesn't See

What now?

Before automating a process with an agent, the free DILAIG audit helps you check whether the intended use falls into high-risk and which transparency obligations apply. If your agent relies on a model you have adapted, the free tool Am I a General-Purpose AI Model Provider? clarifies your role in three steps.

Have you already handed a complete task to an agent, or do you keep control of every action?

Sources

• AI Act Service Desk, how AI agents are addressed
• Reed Smith, final guidelines on Article 50
• White & Case, EU AI Omnibus enters into force