Agentic AI governance: which laws already reach AI agents

Which laws already apply to AI agents?

The laws that apply to AI agents are the laws that apply to any AI system, plus the laws that apply to the act the agent performs. An agent built to interact directly with people in the EU must, under Article 50(1) of the EU AI Act, be designed by its provider so that the people it contacts are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the context of use; an order an agent places may not be denied legal effect under E-SIGN solely because an electronic agent placed it, so long as the agent’s action is legally attributable to the company that deployed it; an agent that denies a Colorado consumer a loan on or after January 1, 2027 triggers notice and explanation duties under SB 26-189. No US or EU statute in force as of October 2026 regulates “agentic AI” as a category.

What counts as an AI agent under current definitions?

No US or EU statute in force as of October 2026 defines “AI agent,” and none of the state laws in this guide does. The definitions that matter are broader, and an agent falls inside them. The EU AI Act defines an AI system in Article 3(1) as “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” An agent that plans and executes tasks is the high end of that autonomy range, not a separate category. Texas uses nearly the same words in Sec. 551.001(1).

Two US statutes describe agents by what they do. UETA defines an “electronic agent” as a computer program or other automated means “used independently to initiate an action or respond to electronic records or performances, in whole or in part, without review or action by an individual” (Minn. Stat. 325L.02). E-SIGN’s definition at 15 U.S.C. 7006(3) is the same, with the addition “at the time of the action or response.”

Who is liable when an agent acts?

The company that deployed the agent, in most cases. The statutes that address software acting without human review give an agent’s action legal effect when it is attributable to the person to be bound, and attribution can be shown through the security procedure that ties the action to that person.

In transactions, E-SIGN provides that a contract “may not be denied legal effect, validity, or enforceability solely because its formation, creation, or delivery involved the action of one or more electronic agents so long as the action of any such electronic agent is legally attributable to the person to be bound” (15 U.S.C. 7001(h)). UETA Section 14 says a contract may be formed by the interaction of electronic agents “even if no individual was aware of or reviewed the electronic agents’ actions or the resulting terms and agreements,” and UETA Section 9 attributes an electronic record to a person “if it was the act of the person,” which may be shown in any manner, including the efficacy of a security procedure (Minn. Stat. 325L.09, 325L.14). Two limits apply: UETA reaches only transactions between parties that have agreed to conduct transactions by electronic means, which can be shown by their conduct, and the terms of a contract an agent forms are still determined by the substantive law that applies to it, including the law of mistake (Minn. Stat. 325L.05(b), 325L.14(3)). Subject to those limits, an agent that orders ten times the intended quantity has, in the ordinary case, bound the company that gave it the credentials.

In regulation, the split between builder and user is statutory. The EU AI Act places most duties on the provider and a shorter list on the deployer; under Article 25 a deployer is treated as the provider of a high-risk system if it puts its name or trademark on one already on the market, makes a substantial modification to one so that it remains high-risk, or modifies the intended purpose of a system that is not high-risk, including a general-purpose AI system, so that it becomes high-risk. Colorado SB 26-189 divides duties between developers and deployers. Texas HB 149 provides that a defendant may not be found liable if “another person uses the artificial intelligence system affiliated with the defendant in a manner prohibited by this chapter” (Sec. 552.105(e)(1)).

The FTC puts responsibility in the same place. When it set aside the Rytr order on December 22, 2025, by a 2-0 vote, its release quoted the director of its Bureau of Consumer Protection saying that “condemning a technology or service simply because it potentially could be used in a problematic manner is inconsistent with the law and ordered liberty,” and stated that the FTC “will continue to hold accountable actors that use AI to violate the law or deceive consumers about the capabilities of their generative AI.” Reuters reported that Chairman Andrew Ferguson told an event it hosted in Austin on September 25, 2026 that he would “continue as long as I am chairman to resist this anthropomorphizing of these tools,” and that reviews of audit trails showed AI systems carrying out instructions they had been given. Those are remarks, not a rule. They do say where the agency looks: at the people who instruct the agent and at the record of what they told it to do.

What does human oversight mean in practice?

It means a named person with the training, authority, and tools to understand, override, and stop the system, and a record that they can do so. For an agent, the practical place for that control is before the action, because an email already sent or a payment already made may not be reversible.

Article 14 of the EU AI Act requires high-risk systems to be designed so that natural persons can oversee them while in use, with measures that match the system’s risks, level of autonomy, and context of use. Article 14(4) requires the system to be provided so that the people assigned to oversee it are enabled, as appropriate and proportionate, to: understand the system’s capacities and limitations and monitor its operation; stay aware of automation bias; interpret the output correctly; decide not to use the system in a particular situation, or override or reverse its output; and intervene in its operation or interrupt it through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state. Article 26(2) adds the deployer’s side: assign oversight to natural persons “who have the necessary competence, training and authority, as well as the necessary support.” These duties apply to stand-alone Annex III systems from December 2, 2027, under the Digital Omnibus.

US bank model risk guidance says less. SR 26-2 and its OCC and FDIC versions replaced SR 11-7 on April 17, 2026. The OCC states that generative and agentic AI models are not within the guidance’s scope, and the agencies plan a request for information on model risk management that considers banks’ use of AI. No such request had been published as of October 21, 2026. A generative AI tool outside the guidance is not outside supervision: third-party risk guidance and information security, fair lending, and UDAAP requirements still reach it.

What records should an agent deployment keep?

Keep the records that reconstruct what the agent did, under whose authority, and why, for as long as the longest rule you face requires.

• Action logs. Article 12 requires high-risk systems to record events automatically over the system’s lifetime, at a level of traceability suited to the intended purpose, and Article 26(6) requires deployers to keep the logs under their control for at least six months unless other law provides otherwise. For an agent, the events worth logging include each tool call, outbound communication, and transaction, with the inputs behind them.
• Authority. The instructions the agent was given, the credentials it held, and any spend or scope limits. Under UETA Section 9 this is the kind of evidence that can tie an electronic record to the company, or show that it was not the company’s act.
• Human review and decisions. Who was assigned oversight, and when a person approved, overrode, or stopped the agent. Colorado requires records for at least 3 years; California’s employment rules require automated-decision data to be kept at least four years.
• Testing and security. Red-team results. In a Texas Attorney General action, a defendant that discovers a violation through testing, including adversarial or red-team testing, may not be found liable (Sec. 552.105(e)(2)(B)). NIST’s January 8, 2026 request for information names hijacking and backdoor attacks as threats to agent systems, and the NCCoE’s February 5, 2026 concept paper considers applying identity standards to agents. Record how the agent authenticates, what it may access, and how prompt injection is tested.

Mapped to the NIST AI RMF, authority and oversight records are Govern, the inventory is Govern and Map, testing is Measure, and logs and incidents are Manage.

What belongs in a contract for an agent platform?

The terms that let you meet the duties that stay with you. None of the laws above relieves a deployer of its own notice, oversight, or attribution duties because a vendor built the agent.

• The scope of actions the agent may take, the systems it may reach, and the limits you can set on both
• Logs of every action, exportable and kept for your own retention period
• Identity and credentials: how the agent authenticates to your systems and to third parties, and how a compromised agent is revoked
• Notice of material model or tool changes, with version identifiers, before they take effect
• Permitted uses of your data and your customers’ data, including whether the vendor may train on it
• Incident notice fast enough to meet your own deadlines
• Testing results for prompt injection and unauthorized actions, and the right to run your own

What changes for AI agents in 2027?

• January 1, 2027: Colorado SB 26-189 applies to ADMT in consequential decisions, with developer documentation, deployer notice, adverse-decision explanations, and human review on request. A federal court order in X.AI LLC v. Weiser bars the Attorney General from enforcing the law, including by investigation, for violations occurring on or before 14 days after the court rules on xAI’s preliminary injunction motion; xAI had not filed that motion as of October 25, 2026.
• January 1, 2027: California’s CCPA automated decisionmaking rules apply to significant decisions, with pre-use notice, access, and opt-out rights.
• December 2, 2027: EU high-risk duties for stand-alone Annex III systems, including Articles 12, 14, and 26.

Federal agent-specific rules remain prospective. NIST’s AI Agent Standards Initiative works through industry-led standards, open source protocols, and research on agent security and identity, and NIST describes its outputs as voluntary guidelines. Its request for information closed March 9, 2026 and its concept paper comments closed April 2, 2026; NIST published a summary of the request for information responses on May 18, 2026 (NIST AI 800-5) and had published no agent guideline or standard as of October 25, 2026.

How should a company govern agents in the first 90 days?

• Inventory every agent, including agent features inside licensed software, with the actions each can take and the credentials it holds
• Mark which agents act on people in the EU, Colorado, or California, and which touch consequential decisions
• Put an approval gate, spend limit, or permission boundary in front of every irreversible action
• Name the person who oversees each agent, train them on its limits, and test that they can stop it
• Add the AI disclosure to every channel an agent uses to reach a natural person
• Run a prompt injection and unauthorized-action test before launch and after each material change
• Draft the Colorado notice and adverse-decision explanation before January 1, 2027

How this fits the other guides

This guide is a spoke of the governance frameworks guide, which maps NIST and ISO/IEC 42001 to legal duties. Articles 12, 14, 26, and 50 are covered in the EU AI Act guide, Colorado, California, and Texas in the state law guide, and SR 26-2 and the bank vendor rules on the banks and credit unions page.

This guide is general information as of October 2026, not legal advice. Statutes, rules, and court orders in this area change often; confirm current text with counsel or the regulator.