AI Act Readiness for Routed Agent Actions

How AgentVeil can support evidence, oversight, and review for configured AI-agent action paths.

Last updated: July 2026. Based on Regulation (EU) 2024/1689 and the European Commission's published AI Act implementation overview.

AgentVeil does not make your system EU AI Act compliant. Compliance depends on your role, use case, risk classification, model provider, data processing, deployment context, documentation, and organizational controls. AgentVeil provides technical readiness support for configured routed actions only; it does not provide legal advice, conformity assessment, CE marking, or compliance certification.

Readiness Workflow

Configured Route
MCP proxy / connector

→

Risk Decision
classify / redirect / block

→

Human Gate
approve / deny / timeout

→

Bounded Evidence
hashes / timestamps / outcome

→

Review Pack

AgentVeil focuses on one narrow but important compliance-support surface: actions that pass through a configured AgentVeil route. On that path, risky actions can be classified, redirected, approved, blocked, and recorded with bounded evidence. Actions outside that route remain outside AgentVeil's control.

Article 9 — Risk Management Support

High-risk AI systems require risk management processes. AgentVeil can support the technical control of risky routed actions, but it does not classify your system's legal risk category.

Readiness need	AgentVeil support
Identify risky action paths	Public`doctor` surfaces generic checks such as route completeness, bypass flags, unpinned install or clone sources, and MCP tool-name collisions.
Reduce uncontrolled execution	PublicConfigured MCP proxy and connector routes can put write, shell, package, deploy, send, or spend-style actions behind a control boundary.
Guide safer next steps	PublicRedirect guidance can point operators or agents toward a safer routed action instead of silently allowing risky execution.
Workflow-specific policy depth	Paid/privateCustomer-specific policy packs, provenance rules, and action families can be added where configured.

$ agentveil-mcp-proxy doctor — inspect route, approval, proof, and bounded risk-check readiness

Article 12 — Record-Keeping Support

Record keeping requires enough evidence to understand what happened. AgentVeil records bounded action facts for routed actions, not full raw prompts or source code by default.

Readiness need	AgentVeil support
Action timeline	PublicLocal evidence can show requested action, approval state, final decision, and target-reached outcome for routed actions.
Decision context	PublicRecords can include action type, policy or reason family, target references, timestamps, and bounded hashes.
Proof review	Public`local_proof`, export, and verify flows help distinguish signed evidence, chain-only evidence, and empty evidence.
Hosted records	Paid/privateHosted usage and proof records should remain bounded and visible/exportable to the customer where configured.

$ agentveil-mcp-proxy events — inspect local routed-action evidence

$ agentveil-mcp-proxy verify <bundle> — verify exported evidence without treating empty bundles as proof

Data boundary. AgentVeil is designed to avoid sending raw prompts, full source code, secret values, full MCP payloads, and private logs unless a configured feature or support process requires it and the customer chooses to provide it. See the Privacy Policy for the data boundary.

Article 13 — Transparency Support

Deployers need information that helps them understand system capabilities, limits, and outputs. AgentVeil can make the action-control boundary easier to inspect.

Readiness need	AgentVeil support
Boundary transparency	Public`launch status` and `launch doctor` report route state, approval center state, local proof state, and trust boundary notes.
Action explanation	PublicHuman-readable decisions and proof summaries explain whether a routed action was approved, denied, blocked, redirected, or reached its target.
Limits and non-coverage	PublicThe product explicitly states that raw shell, direct credentials, unmanaged APIs, and misconfigured routes can bypass AgentVeil.
Customer documentation	CustomerYour team still writes system instructions, user-facing disclosures, model/provider documentation, and risk-management records.

$ agentveil-mcp-proxy launch status --project-dir . — inspect route, approval, proof, and boundary state

Article 14 — Human Oversight Support

Human oversight requires meaningful opportunities to intervene. AgentVeil can add approval gates for configured routed actions.

Readiness need	AgentVeil support
Pre-action intervention	PublicRisky routed actions can require approval before execution instead of being recorded only afterward.
Approve / deny / timeout	PublicApproval decisions are bound to the routed action context; denied or expired approvals should not claim target completion.
Operator visibility	PublicThe Approval Center gives a local operator a concrete decision point for routed actions.
Team oversight	Paid/privateShared approval, RBAC, centralized proof, and customer-specific approval workflows belong to paid/private deployment where configured.

$ agentveil-mcp-proxy demo — see a bounded redirect, approval, and proof loop

Article 50 — Disclosure Support

Some AI systems must disclose AI interaction. AgentVeil can support evidence around routed agent actions, but customer-facing disclosure remains the deployer's responsibility.

Readiness need	AgentVeil support
Action source context	PublicRouted evidence can help show which agent/tool path attempted a controlled action.
AI disclosure copy	CustomerYou decide how and where to tell end users that they are interacting with AI.
End-user interface	CustomerAgentVeil does not provide the full user-facing disclosure UI for your product.

AI Act Timeline

Date	Milestone
Aug 1, 2024	The EU AI Act entered into force.
Feb 2, 2025	Prohibited-practice and AI-literacy obligations began applying.
Aug 2, 2025	GPAI-related obligations and AI Office governance provisions began applying in phases.
Aug 2, 2026	Many remaining obligations begin applying, with some high-risk system obligations applying later.
2027+	Additional high-risk system obligations apply according to the regulation and any subsequent EU implementation changes.

Timeline note: this page is a technical readiness map, not a final legal deadline analysis for any specific deployer. Check the official European Commission AI Act materials and get legal advice for your exact role and system.

What AgentVeil Does Not Cover

Legal advice, compliance certification, CE marking, or conformity assessment
Risk classification of your AI system under the EU AI Act
GDPR, privacy impact assessments, bias testing, or fairness audits
Model-provider documentation, training-data documentation, or GPAI provider obligations
Host-wide sandboxing, EDR, endpoint protection, or complete agent safety
Actions outside configured AgentVeil routes
Customer-facing Article 50 disclosure UI

Start with the public routed-action path

pip install agentveil-mcp-proxy
agentveil-mcp-proxy doctor
agentveil-mcp-proxy demo

For real workflows, configure a routed MCP or connector path first. AgentVeil can only classify, redirect, approve, block, and record actions that pass through the configured route.