What is EU AI Act?
Governance & ControlThe EU's binding AI regulation. Two articles matter most for agents: Article 14 requires human oversight capability designed into the system, and Article 12 requires logging sufficient to reconstruct what the system did.
Why It Matters
The EU AI Act is the first binding regulation whose requirements map directly onto agent architecture. For high-risk systems it does not ask whether you have oversight or logs; it specifies the capabilities each must provide, and both obligations take effect for most systems in August 2026. A team that treats compliance as a policy document discovers that the articles describe technical properties: oversight that can interrupt safely, logging that can reconstruct what happened. Those are build requirements, not paperwork.
The Two Articles That Matter
Article 14: human oversight. The article requires high-risk systems to support effective oversight during operation, and it defines what effective means: the overseer must be able to understand and monitor the system, remain aware of automation bias, interpret the output, override or reverse decisions, and interrupt operation safely. The operative word is effective. A user clicking accept on every prompt is not effective oversight, and an interface where accepting is one click and rejecting is three forms is not either. The capability must be designed in before deployment. The engineering translation lives in human-in-the-loop.
Article 12: record-keeping. The article requires logging sufficient to reconstruct the system’s operation over its lifecycle. For agents, that is the decision record requirement in regulatory language: enough context preserved to explain why a specific output was produced, written by the runtime rather than self-reported by the agent.
Where It Breaks
Teams retrofit. The Act’s oversight and logging requirements are cheap to design in and expensive to bolt on, because both touch the run’s data model: retrofitting reconstruction means re-instrumenting every step after the system is already in production. The second break is scope confusion: teams argue about whether their system is high-risk while the oversight and logging patterns are good engineering for any agent that can spend money or touch data.
How Flytebit Handles It
We build the Article 14 oversight capabilities and Article 12 logging into the runtime layer of every governed deployment, so the compliance evidence is a property of the system rather than a document written about it. The article-by-article mapping is in Governing Agentic AI, and the engagement version is our AI governance and risk work.