What Legal Obligations Apply to AI Agents? A US and EU Overview

Start with what the agent does

Regulators generally do not care whether a product is called an "agent." They care about what it does and who it affects. The same software can be lightly regulated in one use case and heavily regulated in another.

Three facts usually decide the analysis:

• What the agent does. Answering shipping questions is very different from screening job applicants or approving insurance claims.
• Who it affects. Consumers, employees, patients and children often receive extra protection under certain rules.
• Where those people are. Laws generally follow the people affected, not the address of the company.

A useful rule of thumb: an agent that acts (books something, approves something, pays someone, or makes a decision) usually carries more obligations than one that only answers questions. If an agent is about to move from giving advice to taking action, that is a good moment to revisit the legal position.

EU rules that may apply

The EU has the most detailed framework, and it can reach companies anywhere in the world if their agent is used in the EU.

The EU AI Act

The AI Act groups AI systems by risk and phases in obligations over several years. As of October 2026:

• The bans on prohibited practices, such as manipulation and social scoring, and the AI literacy duty have applied since February 2025.
• Rules for general-purpose AI models have applied since August 2025.
• Transparency duties under Article 50 started on 2 August 2026. These include telling people when they are interacting with an AI system. Providers of some systems already on the market have until 2 December 2026 to comply with certain marking and detection duties.
• The high-risk rules covering uses such as hiring, credit scoring and education were pushed back to 2 December 2027. Rules for high-risk AI embedded in regulated products apply from 2 August 2028.

Maximum penalties are steep: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches, whichever is higher. Smaller businesses may face the lower of the two amounts.

The high-risk delay is not a reason to wait. The bans, AI literacy duties and chatbot disclosure rules already apply.

The GDPR

If an agent handles personal data, the GDPR applies in full. For agents that make decisions about people, Article 22 is often the most important provision. It gives people the right not to be subject to decisions based solely on automated processing where those decisions have legal or similarly significant effects. There are narrow exceptions. Where they apply, safeguards are generally needed, such as meaningful human review and a way for people to contest the outcome.

Product liability

The revised Product Liability Directive treats software, including AI, as a product. EU countries must bring it into national law by 9 December 2026, and it covers products placed on the market after that date. If a defective agent causes damage, the injured person may be able to claim compensation without proving negligence. They still need to show that the product was defective and that the defect caused the harm.

Sector and consumer rules

AI-specific laws do not replace everything else. Financial services, insurance, healthcare, medical devices, employment and consumer protection law can all still apply on top of the AI Act and GDPR.

US rules that may apply

The US has no comprehensive federal AI law. Obligations usually come from three layers stacked on top of each other.

State AI laws

These are changing quickly, so check the current status before relying on any particular rule.

• Texas. The Texas Responsible AI Governance Act has been in force since 1 January 2026. It prohibits developing or using AI with certain harmful intent, such as unlawful discrimination or intentionally causing harm, and requires disclosure in some settings.
• Colorado. The original 2024 AI Act never took effect. Colorado replaced it with a narrower, notice-based law, SB 26-189, which takes effect on 1 January 2027. It applies to automated decision-making technology used in consequential decisions and includes consumer notice and explanation requirements.
• California. Privacy rules on automated decision-making are reported to apply to significant decisions from 1 January 2027. California also has separate transparency laws for AI developers.
• Other states and cities. Illinois regulates AI in employment, Utah requires certain AI disclosures, and New York City requires bias audits for automated hiring tools.

Federal enforcement under older laws

Federal agencies often use laws written long before AI agents existed. The FTC has pursued deceptive AI claims, including in its DoNotPay order. The EEOC treats discriminatory automated hiring as employment discrimination, as shown by its iTutorGroup settlement.

Sector regulators

Insurance, banking, lending, healthcare, securities and employment regulators each apply their own conduct, licensing and record-keeping requirements to AI used in their fields.

A December 2025 executive order started a push to challenge state AI laws, but no federal law has overridden them. Until that changes, the state rules that apply still need to be followed.

EU and US obligations compared

Area	EU	US
Banned uses	AI Act prohibited practices, since February 2025	Texas bans certain intentional harmful uses; no federal list
Telling people it's AI	AI Act Article 50, from August 2026	Some state laws, including Utah and Texas in certain settings
Automated decisions about people	GDPR Article 22 now; AI Act high-risk rules from December 2027	Colorado SB 26-189 and California rules from 2027; NYC and Illinois hiring rules
Personal data	GDPR, in full	State privacy laws plus sector rules; no single federal privacy law
Liability for harm	Revised Product Liability Directive, for products placed on the market after 9 December 2026	State tort and product liability law; no AI-specific federal liability law
Who enforces	National authorities and the EU AI Office	State attorneys general, FTC, EEOC and sector regulators

For organizations selling in both markets, it often makes sense to treat the EU rules as the stricter baseline. Controls built for the EU will often cover much of what US state laws require, though not all of it.

Separate likelihood, severity, uncertainty and mitigation

Only the points below come from the sections above; they are an organizing aid, not a scoring model.

Dimension	What the sources above indicate
Likelihood that a rule applies	Depends on what the agent does, who it affects, and where those people are
Severity if a rule is breached	Varies by regime, for example the EU AI Act penalty ceilings above, and compensation claims under the revised Product Liability Directive
Uncertainty	State laws are changing quickly, the federal push against them has not taken legal effect, and several EU dates have moved
Mitigation	Controls tied to each rule, such as a disclosure message, a human review step, or a log, each with an owner and a test

Work out which obligations apply

Start with facts, not laws. Write down what the agent actually does, then check each rule against that description. The companion checklist, "Is My AI Agent Legal? A Practical Checklist for 2026," has the full list of questions.

1. Describe the agent. What can it do? Which tools and data does it use? Who uses it? What can it decide or spend without a person?
2. List where it operates. Include every EU country, US state and city where users or affected people are located.
3. Name the activity. Does it touch a regulated field such as insurance, lending, hiring, healthcare or legal services?
4. Match rules to facts. For each law that might apply, record why it does, why it doesn't, or what still needs checking.
5. Turn each rule into a control. That might be a disclosure message, a human review step, or a log. Give each control an owner and a test.
6. Keep the evidence. Record what was decided, who signed off, and when to look again.

If the answer depends on how a law is interpreted, take it to a lawyer.

Common questions

Is there a federal AI law in the US?

Not a comprehensive one. US obligations come from state AI laws, federal agencies using existing laws, and sector regulators. A federal push to override state AI laws has not taken legal effect.

Does the EU AI Act apply to a US company?

Yes, if the AI system is placed on the EU market or its output is used in the EU. What matters is where the users are, not where the company is based.

What parts of the EU AI Act already apply?

The bans, AI literacy duties, general-purpose AI model rules and Article 50 transparency duties already apply. The high-risk rules were pushed to December 2027 and August 2028.

How can I check which laws apply to my agent?

Go to ismyagentlegal.com and describe what the agent does. The result is a preliminary assessment of the legal instruments and obligations that may apply, the facts to verify, and the likely gaps. It is a starting point for a team and its counsel, not a legal opinion.

What is Carver Agents and how does it help?

Carver Agents provides Legal Engineering as a Service for AI agents. It maps the legal obligations that apply to an agent, helps close engineering and documentation gaps, prepares evidence for legal review, and helps keep deployed agents legally ready as requirements change. Carver works alongside counsel and governance tools rather than replacing them, and does not guarantee approval or legal outcomes.

Is your agent legally ready?

For one agent that is heading toward customer or legal review, Carver can prepare a preliminary, source-linked assessment: the obligations that may apply, the questions to check, the likely gaps, and the changes that would mean reassessing. Start at ismyagentlegal.com or write to support@carveragents.ai.