Agents and automation · Layer 4
AI agent
An AI given a goal rather than a question: it plans, uses your tools and chains actions together until the job is done.
A way to picture itA new assistant handed a badge and an assignment: they organise the work themselves, but can only open the doors their badge allows.
A procurement department asks an agent to follow up on late orders. The agent checks the purchasing system, spots overdue deliveries, drafts one reminder per supplier and prepares a summary table. Reminders only go out once the responsible buyer has approved them. The agent has read-only access to orders: it can neither change nor cancel them.
The AI Act has no regime specific to agents (EU · AI Act): whether an agent is high-risk depends on its use, for instance if it screens job applications (EU · AI Act, Annex III). Every action the agent takes on personal data remains processing your organisation is accountable for (EU · GDPR, art. 5); if it alone takes a decision that significantly affects a person, the rules on automated decisions apply (EU · GDPR, art. 22). On 20 July 2026, an exploratory note (France · CNIL and CIANum) confirmed that the GDPR fully applies to agents, pointing to their memory, their autonomy and a blurrier allocation of responsibilities.
“Which tools can your agent call, with exactly which permissions and under which identity, and which actions need human approval before they run?”
An assistant answers a question; an agent pursues a goal and acts in your tools, over several steps it chooses itself. The more it acts, the more permissions and approval matter.
Not by nature: it depends on the use. An agent that screens job applications or assesses individuals’ creditworthiness falls under Annex III, whose obligations will apply from 2 December 2027 (EU · AI Act).
Its own identity with minimal permissions, rather than an employee’s account. Otherwise the logs attribute its actions to that person and nobody can tell who did what.
Educational explainer, not legal advice. Up to date as of 29 October 2026.