If your team runs AI agents that people in the European Union interact with — or that produce content EU users will read, hear, or see — the EU AI Act has things to say to you, and some of them are specifically about transparency: telling people when they are dealing with an AI system and marking content that a machine made or altered. This guide covers the transparency duties in plain language, the record-keeping and oversight duties that sit next to them, and a working checklist for an agent team. It is a summary for orientation, not legal advice — for obligations that carry fines, have your reading checked by counsel who know your exact use case.
Who the Act applies to¶
The Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages, with different duties switching on at different dates through 2026 and 2027. It distinguishes providers — those who develop an AI system or put it on the market under their own name — from deployers, who use a system under their own authority. Most teams running agents are deployers of someone else's model and providers of their own agent product at the same time, so both columns of duties can apply. The Act reaches companies outside the EU when the system's output is used in the EU, which means a support agent answering EU customers from another continent is not out of scope merely because of where the servers sit.
The core transparency duty: say when it is AI¶
Article 50 sets the transparency floor for systems that interact with people:
- Interaction disclosure. Where an AI system is designed to interact directly with a person — a chat agent, a voice agent, an automated assistant — the person must be informed they are interacting with AI, unless that is already obvious from the circumstances or the system is authorised by law for specific tasks. "The user probably figured it out" is a weak position; a plain statement in the interface is a strong one.
- Marking generated content. Providers of systems that generate synthetic audio, image, video, or text must ensure outputs are marked in a machine-readable format as artificially generated or manipulated, where technically feasible. If your agent publishes content, that marking duty follows the content.
- Deep fakes and manipulated media. Deployers of systems that generate or manipulate image, audio, or video content resembling real people, places, or events must disclose that the content was artificially generated or manipulated, with narrow exceptions for law enforcement and authorised uses.
- Emotion and biometric systems. People exposed to emotion-recognition or biometric categorisation systems must be informed of the operation of the system.
- AI-generated text on matters of public interest. Where AI-generated text is published to inform the public, disclosure applies unless the content has passed human review with editorial responsibility taken by a person or organisation.
For an agent team, the practical translation is short: label the agent as an agent everywhere it speaks, and carry a machine-readable mark on what it generates. Both are cheapest when designed in from the start — retrofitting disclosure onto a fleet of customer-facing agents is a project; building it into the template is an afternoon.
Record-keeping: the transparency duty pointed inward¶
Transparency under the Act is not only outward-facing. For high-risk systems — the category that covers uses such as certain employment, education, credit, and law-enforcement applications — Article 12 requires record-keeping: the system must be designed to log events over its lifetime so its operation can be traced. Deployers of high-risk systems must keep the logs under their control for at least six months, longer where other law requires it. Even outside the high-risk category, the pattern is worth copying for any agent that acts on your behalf: if you cannot show what the agent did, you cannot show that your disclosures, approvals, and safeguards actually happened. An audit trail is the evidence that turns "we have a transparency policy" from an assertion into a demonstration.
Human oversight and the deployer duties around it¶
High-risk systems must be designed so they can be effectively overseen by people while in use (Article 14) — the humans must be able to understand the system's outputs, intervene, and stop it. Deployers, for their part, must use systems according to the provider's instructions, assign oversight to people with the competence and authority to actually exercise it, monitor operation, and act when something looks wrong. For agent operators this lands as concrete design work: an approval gate that a named person can genuinely decide at, a kill switch that actually halts the agent, and staff who know both exist. Oversight that is nominal — a dashboard nobody watches, an approver with no time to read — does not meet the spirit of the duty, and it is the first thing an incident will expose.
Serious incident reporting¶
Providers of high-risk systems must report serious incidents to the market surveillance authorities of the member states where they occurred (Article 73), within strict statutory deadlines that start when the provider becomes aware of the incident — generally no later than fifteen days, with shorter windows for the gravest cases such as widespread infringements or incidents involving a death. Two operational consequences follow. First, your incident process needs a clock and an owner from the moment an incident is suspected, not after the investigation concludes. Second, you can only report accurately if your records can reconstruct what the system did — another reason the audit trail is load-bearing. Deployers have their own duty to inform providers and authorities when they identify a serious incident or a risk the system presents, so the reporting path has to exist in both directions.
A working transparency checklist for agent teams¶
- Inventory every agent and touchpoint where a person interacts with it or consumes its output.
- Add a plain AI disclosure at every interaction surface, in the interface itself rather than buried in terms.
- Mark generated content in machine-readable form where the system produces public-facing text, audio, image, or video.
- Classify your use cases honestly: does any agent operate in a high-risk area such as hiring, credit, education, or essential services?
- For high-risk uses, confirm logging exists, retention meets the six-month floor, and named humans hold real oversight and stop authority.
- Write the serious-incident path down: who is told, in what order, on what clock — and keep the evidence that would support a report.
- Revisit the inventory whenever an agent gains a new tool, a new audience, or a new region.
The through-line of the Act's transparency rules is simple enough to state in one sentence: people affected by an AI system should be able to tell that it is one, find a human answerable for it, and trust that a record exists of what it did. A team that builds those three things for its own reasons will find most of the formal duties already handled.