There’s a lot of confusion about what the EU AI Act means for firms deploying AI agents (software that takes actions, not just answers questions). The Digital Omnibus delay made it worse, because delayed gets read as nothing applies. Here’s my attempt at a map of what applies now and what doesn’t.

Already applying

• AI Act, Art. 4 (AI literacy): firms must take measures to support the AI literacy of staff who work with AI systems. The Omnibus softened this in July from “ensure a sufficient level” to “support the development of”.
• AI Act, Art. 50 (transparency), since 2 Aug 2026: if an agent talks to customers, they must be told it’s an AI (unless that’s obvious). This is about disclosure, not oversight or logging.
• GDPR, Art. 22: individuals have rights around solely automated decisions with legal or similarly significant effects (e.g. a loan refusal), including human intervention and the ability to contest. GDPR Art. 30 (records of processing) also applies as before.
• DORA, since Jan 2025: financial entities must manage ICT risk, report major incidents, test resilience and manage third-party ICT providers. An agent running on a third party’s cloud or model API is within the third-party part.

Not yet applying

• AI Act high-risk obligations (risk management, logging under Art. 12, human oversight under Art. 14, deployer duties). The Digital Omnibus moved the Annex III date to 2 December 2027. Credit scoring of individuals and life and health insurance pricing are in that category. Many agent use cases (support, internal automation, fraud detection) are probably not high-risk at all, so check classification before assuming the heavy rules apply.

The gap that matters in practice

No EU rule yet requires general technical controls that block agent actions before they execute. The Art. 14 oversight and intervention requirements for high-risk systems arrive in December 2027, and until then GDPR Art. 22 gives customers rights over solely automated decisions. But DORA and GDPR already mean that if something goes wrong, you may need to show what happened, why, and who was responsible. Firms that wait for the AI Act deadline may find they have to retrofit controls onto systems already in production.

The sovereignty question I’d like opinions on

Many agent stacks depend on US-hosted model APIs and cloud platforms. For EU financial firms, DORA’s third-party and concentration-risk rules, plus GDPR’s limits on data transfers, are real constraints. I think they push toward options that run inside the firm’s own infrastructure or at least with a European provider, but I’m not sure how many firms treat this as a hard requirement versus a nice-to-have.

Questions:

1. If you work in EU finance or compliance, are agents already being classified under the AI Act, or is it still on the backlog?
2. Is “data stays in our own infrastructure” a hard requirement in your procurement, or negotiable?
3. Have I got anything wrong or missed an obligation?

This is my reading, not legal advice, so please correct me where I’m off. I work on tooling in this area, so I have a bias.

Hi everyone!

We’re a French tech company building Pixxle, a European ecosystem of digital applications.

We’ve just launched Echo Talks, a new feature inside our voice-based social app, Pixxle Echo.

The idea started with a simple question:

What if online communities could have conversations without typing?

With Echo Talks, users can start a discussion by recording a voice message, and others can listen, react, and reply using their own voices.

You can also reply directly to someone’s response, allowing conversations to develop naturally.

Think of the structure of an online forum, but designed entirely around voice instead of text.

We’re exploring whether voice can bring something different to online discussions: more personality, spontaneity, and a stronger sense of human connection.

As a European tech company, we’re also interested in building alternatives to established digital platforms, with our own approach to how people communicate.

We’ve just released Echo Talks, and we’d genuinely appreciate some feedback from the European tech community.

Would you participate in voice-based discussions, or do you think text is still essential for online communities?

And more broadly, do you think there’s room for new European social platforms?

I've been talking to a few EU-facing SaaS teams about the AI Act, and the same problem keeps coming up before anyone gets to classification or documentation: nobody has a complete list of the AI they use or ship.

It's usually spread across:

- AI features in the product (chatbot, recommendations, summarization)

- Third-party APIs and models someone integrated months ago

- Internal tools (HR screening, support triage, code assistants)

- SaaS products that quietly added AI features

The fields that seem useful to record for each system:

1. What it does and who it affects (users, employees, applicants)
2. Provider vs. deployer role (built in-house or bought)
3. Which model or vendor is behind it
4. Whether people interact with it directly
5. Whether it generates or alters content
6. Rough risk tier under the Act, plus an owner and a review date

Open questions I'd like input on:

- Do you track AI features inside third-party SaaS, or only what you build/integrate yourself?

- Who owns the inventory at your company: legal, security, engineering?

- What did you find hardest to classify?

Disclosure: I'm working on a small tool for this (an AI inventory with risk classification), so I'm partly asking to learn what's actually useful.

Happy to share the field template as a spreadsheet if it helps, no signup.

Hi everyone, I work on Proxima.
AI can help with a lot of daily work, but putting it all together often means juggling different tools.
We’re building Proxima to bring those needs into one place: working with documents, drafting content, turning meetings into useful notes, and connecting AI to the applications you already use.
Think of a typical working day: understand a lengthy report, prepare a meeting, review the discussion afterwards, and draft the follow-up. That’s the kind of everyday work we want Proxima to help with.
Alongside that practical focus, privacy and European infrastructure are central to our approach. You should be able to use AI at work while keeping control over your organisation’s data.
Developers can also connect their own workflows through our API.
If you’re looking for a European AI workspace for your organisation, take a look at Proxima.
What would it need to handle for you to use it every day?