"Can we let AI handle supplier emails, the calendar and payment reminders?" The question comes up more and more since generative assistants became agents: they don't just answer, they act — they open the mailbox, update the ERP, book, sometimes pay. The short answer: there is no law "on agents", but the rules that apply already exist. And precisely because an agent acts, mistakes cost more.

The European Commission's AI Office addressed the topic in the AI Act Service Desk FAQs. Three fixed points:

  • an AI agent is a system able to receive and process input from its environment and to execute actions that affect that environment (for example by calling functions or other software);
  • it contains at least one general-purpose AI model and usually constitutes an AI system;
  • it is not a separate category: the definitions in Art. 3(1) (AI system) and Art. 3(63) (GPAI model) of Regulation (EU) 2024/1689 are sufficient to cover it.

The Commission notes that its position is still preliminary, because the field is evolving fast. For a company the practical consequence is clear: an agent is classified like any other AI system, based on what it does and for whom.

Three questions to classify your agent

1. Are you a provider or a deployer?

If you buy a "ready-made" agent and use it in your company, you are normally a deployer. If instead you build your own system on top of a third-party model (via API) and put it into service under your own name — the website assistant, the customer bot — you may become the provider of that system. The role determines which obligations are yours.

2. In which area do you use it?

An agent that sorts emails is limited-risk. The same agent screening candidates or assessing creditworthiness falls into an Annex III high-risk area. After the Digital Omnibus (Regulation EU 2026/1744), the obligations for these systems apply from 2 December 2027. Until then the GDPR and, in Italy, employment rules remain fully applicable.

3. Does it interact with people?

If the agent writes to customers, suppliers or candidates, transparency comes into play.

Transparency: the agent must disclose itself

From 2 August 2026, Article 50(1) requires systems intended to interact with natural persons to be designed so that people know they are dealing with an AI, unless this is obvious. The obligation lies with the system's provider.

The Commission's Article 50 guidelines (final version of 20 July 2026) expressly name agents. The principle: if it cannot be determined in advance whether the agent will interact with a person, it should be instructed to disclose itself in every situation where such interaction is likely. For an agent sending emails on the company's behalf, the prudent solution is an explicit statement in the message itself.

Breaches of Article 50 are punishable by up to EUR 15 million or 3% of worldwide annual turnover (Art. 99); for SMEs the lower of the two amounts applies.

GDPR: memory, tools, decisions

An agent with access to email, CRM and documents processes personal data extensively and with little visibility. The Spanish data protection authority (AEPD) published an 81-page guidance document on agents on 18 February 2026. Its most useful recommendations also hold in Italy, because they derive from the GDPR:

  • memory: strict retention periods, disabling unnecessary memory, periodic cleansing of long-term memory;
  • tool access: clear rules on which services and repositories the agent may touch, with effective restrictions (minimisation, Art. 5 GDPR);
  • human oversight at every stage, by trained people with the authority to intervene.

Two GDPR rules weigh particularly heavily. If the agent takes decisions with legal or similarly significant effects on people without meaningful human involvement, Article 22 is triggered. And if the processing is high-risk — extensive data, new technologies, evaluation of people — you need a DPIA (Art. 35) before going live.

Operational controls before connecting it to data

Treat an agent like a new colleague holding the office keys. Before putting it into production:

  1. Inventory — record it among the AI systems in use, with its role (provider/deployer) and risk classification.
  2. Least privilege — only the accounts, folders and functions it truly needs; no administrative credentials.
  3. Human approval for irreversible actions — payments, bulk sends, deletions, signatures: the agent proposes, a person confirms.
  4. Activity logs — keep logs of what the agent did and why. For high-risk systems Art. 26(6) requires deployers to keep them for at least six months; for the others they are still the evidence you will need when something goes wrong.
  5. Kill switch — a simple, documented way to suspend it.
  6. Contract with the vendor — where the data runs, whether it is used for training, who the processor is (Art. 28 GDPR).
  7. Policy and training — whoever uses or supervises the agent must know what it may and may not do (AI literacy, Art. 4).

Where to start

Many companies already run agents without calling them that: an automation linked to a generative model, an assistant with mailbox access, a CRM plugin. The first step is to surface and classify them. An independent gap assessment maps the agents in use, the data they access and the actions they can take, and shows where transparency, DPIAs and human checkpoints are needed — before an automated mistake becomes a legal problem.