---
description: "EU AI Act compliance for LLM apps and agents: the 2026 timeline after the Digital Omnibus, the obligations engineers own, and what an AI gateway can cover."
title: EU AI Act Compliance for LLM Applications and Agents
image: https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/10/eu-ai-act-compliance-for-llm-applications-and-agents-bifrost-1920x1080.png
---

Try Bifrost Enterprise free for 14 days. [Request access](https://www.getmaxim.ai/#enterprise-trial)

**TL;DR**

- EU AI Act compliance for an LLM application depends on its risk category and on whether your team is the provider or the deployer of the AI system.
- The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028; Article 50 transparency duties have applied since 2 August 2026.
- High-risk systems must log events automatically, and providers and deployers must keep those logs for at least six months unless other law says otherwise.
- An AI gateway can produce logs, audit trails, redaction, and access controls as compliance evidence; it cannot classify your system, write your risk assessment, or make it compliant.
- Agentic systems need agent, model, and tool calls joined in one record, which is simplest when every hop passes through one gateway.

The EU AI Act (Regulation (EU) 2024/1689) has applied in most of its parts since 2 August 2026, so teams shipping LLM features or agents into the EU need an EU AI Act compliance plan that engineering can execute. [Bifrost](https://www.getmaxim.ai/bifrost), the [open-source AI gateway](https://github.com/maximhq/bifrost) built by Maxim AI for enterprise AI workloads, sits on the request path for model, tool, and agent traffic, where the logs, audit trails, and access controls the Act asks for are produced. This guide maps the obligations that reach engineering, the current timeline, and what a gateway can and cannot cover. It is not legal advice: confirm your classification and duties with counsel.

## What Is the EU AI Act?

The EU AI Act is a European Union regulation that sets risk-based obligations for AI systems and general-purpose AI models placed on the EU market or whose output is used in the EU. It reaches providers and deployers outside the EU, and duties scale with each use case's risk category.

The Act sorts uses into prohibited practices (Article 5), high-risk systems (Article 6 with Annexes I and III), systems with transparency duties (Article 50), and minimal risk. A separate chapter governs general-purpose AI (GPAI) models. The full text is on [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj).

A **provider** develops an AI system and places it on the market under its own name; a **deployer** uses one under its authority. A team building a hiring assistant on a hosted model is usually its provider. Article 3 does not define "AI agent", so an agent is assessed as an AI system by what it does and where it is used.

![Decision flow for an LLM application or agent: check prohibited practices, then Annex III high-risk use, then Article 50 transparency, ending in minimal-risk duties](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/eu-ai-act-compliance-llm-applications/eu-ai-act-compliance-obligation-flow.png)

*Figure 1: Classification decides the workload: most LLM features land on Article 50, while an Annex III use case adds the full high-risk set.*

As Figure 1 shows, the categories stack: a chatbot screening job applicants carries high-risk and Article 50 duties at once. Classification is a legal call; engineering makes the evidence easy to produce, starting with an inventory of model calls from an [AI governance layer for LLM traffic](https://www.getmaxim.ai/bifrost/resources/governance).

## EU AI Act Timeline After the Digital Omnibus

The Digital Omnibus on AI, [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744), was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It delayed high-risk obligations but left Article 50 transparency on its original date.

The dates below come from the Commission's [AI Act Service Desk timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act) and the Omnibus text, checked in October 2026. Recheck before planning releases.

| Date | What applies |
| --- | --- |
| 2 February 2025 | Article 5 prohibitions and AI literacy (Article 4) |
| 2 August 2025 | GPAI model obligations and governance structures |
| 2 August 2026 | Most rules apply, enforcement starts, Article 50 transparency applies |
| 2 December 2026 | New prohibitions on non-consensual intimate imagery and CSAM; Article 50(2) marking deadline for generative systems placed on the market before 2 August 2026 |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply |
| 2 December 2027 | High-risk obligations for Annex III use cases (employment, credit, education, biometrics, and others) |
| 2 August 2028 | High-risk obligations for AI in Annex I regulated products |

The Omnibus also softened Article 4: providers and deployers must "take measures to support" AI literacy rather than guarantee a level of it. The extra 16 months before Annex III duties apply is build time for the [audit trail controls for LLM traffic](https://www.getmaxim.ai/articles/ai-audit-trail-controls-and-audit-logs-for-llm-traffic/) that high-risk systems need.

## EU AI Act Requirements That Land on Engineering

Most EU AI Act requirements for high-risk systems sit in Articles 9 to 15, with deployer duties in Article 26. Each produces an engineering artifact: a process, a log, a control, or a document. The table maps each article to what an engineering team builds or keeps, and who owns it.

| Article | Obligation | Who | Engineering artifact |
| --- | --- | --- | --- |
| 9 | Lifecycle risk management | Provider | Risk register fed by evaluations and incidents |
| 10 | Training, validation, test data governance | Provider | Dataset lineage and bias checks |
| 12 | Automatic event logs | Provider | Request, decision, and tool-call logs |
| 13 | Instructions for deployers | Provider | Docs on limits and how to read logs |
| 14 | Human oversight by design | Provider | Monitoring, override, and stop paths |
| 15 | Accuracy, robustness, cybersecurity | Provider | Defenses against adversarial inputs |
| 19, 26(6) | Keep logs at least six months | Both | Retention settings and owned storage |
| 26(2) | Assign competent overseers | Deployer | Named reviewers with authority |
| 50 | Disclose AI use, mark generated content | Both | UI disclosure, output marking |
| 73 | Report serious incidents (generally 15 days) | Provider | Runbook that pulls the relevant logs |

Article 25 adds a trap: a deployer that rebrands a high-risk system, substantially modifies one, or repurposes a general-purpose system into a high-risk use is treated as the provider. See [AI compliance platforms for LLM applications](https://www.getmaxim.ai/articles/ai-compliance-platform/) for the controls side of this table.

## Record-Keeping and Logging for High-Risk AI Systems

High-risk AI systems must "technically allow for the automatic recording of events (logs) over the lifetime of the system" under Article 12. The logs must support risk identification, post-market monitoring, and the deployer's operational monitoring. Providers (Article 19) and deployers (Article 26(6)) keep them for at least six months.

For an LLM application, a recordable event is any model call, tool call, guardrail decision, or human override that shaped an output:

- Inputs, parameters, provider, and model for each request
- Outputs, tool calls, latency, token usage, and errors
- Caller identity and the case or decision ID that ties the call to a business record
- Guardrail outcomes, including what was blocked or redacted

Agents make this harder: one request can fan out into an agent handoff, model calls, and MCP tool calls, each logged by a different service.

![An app's A2A call passes through Bifrost to an agent, whose model and MCP tool calls also pass through Bifrost and land in logs joined by session ID](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/eu-ai-act-compliance-llm-applications/eu-ai-act-compliance-agent-record-keeping.png)

*Figure 2: Record-keeping for agents works when every hop passes one gateway and carries the same session and task IDs.*

The recently launched [Agent Gateway in Bifrost](https://www.getmaxim.ai/bifrost/blog/introducing-agent-gateway-in-bifrost-one-gateway-for-models-tools-and-agents) brings A2A agent calls through the same gateway as model and MCP tool calls. In [Agent Logs](https://docs.getbifrost.ai/features/agent-gateway/observability), teams open a conversation to read messages, task updates, results, and the recorded caller.

When the agent sends `x-bf-session-id` (the A2A context ID) and `x-bf-agent-correlation-id` (the A2A task ID) on its own model and tool calls, as covered in [integrating your agent](https://docs.getbifrost.ai/features/agent-gateway/integrating-your-agent), the conversation links to the prompts, responses, and tool results behind it. That joined record supports record-keeping for agentic systems; what the logs must contain still comes from your risk assessment.

## Human Oversight, Risk Management, and Data Governance

Human oversight under Article 14 means people assigned by the deployer can monitor a high-risk system, interpret its output, override it, and stop it. Risk management (Article 9) and data governance (Article 10) are provider processes. Engineering supplies control points and evidence; trained people and documented procedures do the rest.

![A request passes a virtual key check, input guardrail, model provider, and output guardrail, with branches for stopped keys, blocked content, and held tool calls](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/eu-ai-act-compliance-llm-applications/eu-ai-act-compliance-oversight-control-points.png)

*Figure 3: The gateway supplies stop, block, and hold points; assigning trained people to use them is the deployer's job.*

Figure 3 shows the control points on the request path in [the Bifrost AI gateway](https://www.getmaxim.ai/bifrost):

- **Stop.** [Virtual keys](https://docs.getbifrost.ai/features/governance/virtual-keys) carry an active or inactive status and per-provider model allow-lists, so an operator can cut off a system's model access in one change.
- **Block or redact.** [Guardrails](https://docs.getbifrost.ai/enterprise/guardrails) (Enterprise) evaluate inputs and outputs for LLM calls and MCP tool calls, with `detect_only`, `block`, and `redact` actions.
- **Hold for approval.** Bifrost does not execute model-requested MCP tool calls by default; the application calls the [tool execution API](https://docs.getbifrost.ai/mcp/tool-execution), leaving room for a reviewer. [Agent Mode](https://docs.getbifrost.ai/mcp/agent-mode) auto-runs only tools listed in `tools_to_auto_execute`.

Request logs also feed the Article 9 monitoring loop: error rates, guardrail hits, and usage spikes are inputs to the risk register. Article 10 dataset documentation stays with whoever trains or fine-tunes the model.

## EU AI Act Article 50 Transparency Obligations

EU AI Act Article 50 has applied since 2 August 2026 and covers most LLM products. Providers must tell people they are interacting with an AI system unless that is obvious, and mark synthetic audio, image, video, and text in a machine-readable, detectable way. Deployers must disclose deepfakes and certain AI-generated public-interest text.

These are product and UI duties: a chat interface needs a visible disclosure, and generated media needs detectable marking. For generative systems on the market before 2 August 2026, Article 50(2) marking applies from 2 December 2026.

A gateway does not add disclosure banners or watermarks; it records which model and request produced each output in the [built-in request logs](https://docs.getbifrost.ai/features/observability/default). Article 50 breaches fall in the Article 99 tier of up to €15 million or 3% of worldwide annual turnover, whichever is higher.

## GPAI Obligations for Model Providers and Your Team

GPAI obligations under Article 53 apply to providers of general-purpose AI models: technical documentation, information for downstream integrators, a copyright policy, and a public training-content summary. Models trained with more than 10^25 FLOPs are presumed to carry systemic risk. Teams calling hosted models through an API are usually not GPAI providers.

Two things still reach application teams: the documentation a GPAI provider must hand downstream (Article 53(1)(b)) feeds your own risk assessment, and fine-tuning or rebranding can shift your role under Article 25. An assessor's first question is which GPAI models the system depends on. Bifrost routes to [25+ providers and 10,000+ models](https://docs.getbifrost.ai/overview) through one OpenAI-compatible API, so one gateway gives that inventory for the vendor review in [enterprise AI security and compliance](https://www.getmaxim.ai/articles/enterprise-ai-security-and-compliance/).

## What an AI Gateway Can and Cannot Cover

An AI gateway covers controls and evidence on the request path: logs of model, tool, and agent calls, audit trails of configuration changes, redaction, access control, and deployment location. It does not cover classification, conformity assessment, risk management processes, training data governance, product disclosures, or registration, which stay with your team and counsel.

| Obligation area | A gateway can provide | Your team still owns |
| --- | --- | --- |
| Record-keeping (Art. 12, 19, 26) | Logs of requests, tool calls, agent tasks; retention settings | Deciding what to log and for how long |
| Human oversight (Art. 14) | Kill switches, block and redact, tool approval holds | Trained overseers and procedures |
| Risk management (Art. 9) | Errors, guardrail hits, usage spikes | The risk management system |
| Data governance (Art. 10) | Inference-time redaction only | Training and test data documentation |
| Robustness (Art. 15) | Prompt injection and secrets checks | Model evaluation and accuracy |
| Transparency (Art. 13, 50) | Per-request output provenance | Disclosure, marking, instructions |
| Classification and conformity | Nothing | Classification, conformity assessment, registration |

A gateway turns parts of the Act into configuration you can show an auditor. See also [AI governance tools for regulatory compliance](https://www.getmaxim.ai/articles/top-5-ai-governance-tools-for-regulatory-compliance-in-2026/).

## How Bifrost Supports EU AI Act Compliance Evidence

The [Bifrost gateway](https://www.getmaxim.ai/bifrost) supports EU AI Act compliance work by producing three distinct records (request logs, log exports, and audit logs), redacting personal data before it reaches providers or logs, scoping access with RBAC and data access control, and running inside your own infrastructure. Each maps to evidence an assessor can request.

![Bifrost receives inference traffic and admin changes, writes request logs and HMAC-signed audit logs, and offloads payloads and audit archives to your S3 or GCS bucket](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/eu-ai-act-compliance-llm-applications/eu-ai-act-compliance-bifrost-log-types.png)

*Figure 4: Request logs show what the AI did, audit logs show who changed the controls, and log exports keep payloads in storage you own.*

### Request logs, log exports, and audit logs

- **Request logs** record what the AI system did. Bifrost captures inputs, parameters, provider and model, outputs, tool calls, tokens, cost, and latency per request, asynchronously, in SQLite or PostgreSQL. [Required headers](https://docs.getbifrost.ai/features/governance/required-headers) and logging headers can reject calls missing a case ID and record it on each log; `disable_content_logging` keeps metadata but skips prompt content.
- **Log exports** (Enterprise) decide where request payloads live. [Log exports](https://docs.getbifrost.ai/enterprise/log-exports) offload request and response bodies to your S3 or GCS bucket while the database keeps searchable metadata. Database retention uses `log_retention_days`; bucket objects follow lifecycle rules you set to meet a six-month minimum or a longer sector rule.
- **Audit logs** (Enterprise) record administrative activity, not inference. [Audit logs](https://docs.getbifrost.ai/enterprise/audit-logs) show who changed a guardrail, key, or role, and when, with HMAC-signed entries, configurable retention, JSON, JSON Lines, or Syslog export, and object storage archival. An `omit_ip_addresses` option supports EU works-council constraints.

### Guardrails and PII redaction

Enterprise [redaction modes](https://docs.getbifrost.ai/enterprise/guardrails/redaction) control where detected personal data is rewritten: in the live request and logs (`runtime`), in logs only (`logs_only`), or with reversible placeholders that only users with the `Logs:Reveal` permission can open. The built-in [Custom Regex PII template](https://docs.getbifrost.ai/enterprise/guardrails/custom-regex) is pattern-based and US-oriented, so EU teams should add national ID patterns or use the Presidio or Azure AI Language PII providers.

See [PII redaction at the gateway before data reaches providers](https://www.getmaxim.ai/articles/pii-redaction-at-the-gateway-before-data-reaches-providers/) for setup, and the [Bifrost guardrails overview](https://www.getmaxim.ai/bifrost/resources/guardrails) for the provider set.

### RBAC, data access control, and deployment

In Bifrost Enterprise, [role-based access control](https://docs.getbifrost.ai/enterprise/rbac) limits who can view logs, change guardrails, or download audit logs. [Data access control](https://docs.getbifrost.ai/enterprise/data-access-control) scopes which records each role sees (own, team, business unit, customer, or all), so an oversight reviewer sees only their system's logs. The [access profiles, RBAC, and DAC guide](https://www.getmaxim.ai/articles/ai-governance-guide-access-profiles-rbac-dac/) walks through setup.

For data residency, [in-VPC deployments](https://docs.getbifrost.ai/enterprise/invpc-deployments) on AWS, GCP, or Azure keep the gateway, its logs, and its audit trail inside your network and region. Residency of the model call itself depends on the provider region you route to. [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) bundles these controls with clustering and SSO, and Bifrost adds 11 microseconds of overhead per request at 5,000 RPS in [published benchmarks](https://www.getmaxim.ai/bifrost/resources/benchmarks).

## Frequently Asked Questions

### Who does the EU AI Act apply to?

The EU AI Act applies to providers placing AI systems or GPAI models on the EU market, to deployers using AI systems in the EU, and to providers and deployers outside the EU when their system's output is used in the EU. A US company serving EU users with an LLM feature is in scope. Confirm your exact role and duties with counsel.

### Was the EU AI Act delayed?

Parts of it were. The Digital Omnibus on AI, in force since 27 July 2026, moved Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and Annex I obligations to 2 August 2028. Prohibitions, GPAI obligations, and Article 50 transparency were not postponed, though Article 50(2) marking for systems already on the market applies from 2 December 2026.

### Does the EU AI Act apply to AI agents?

Yes. The Act does not define AI agents separately, so an agent is assessed as an AI system by its purpose and context. An agent that screens candidates or scores credit falls under Annex III high-risk rules; an assistant that talks to people carries Article 50 duties. Multi-agent systems need records linking each agent's actions to the model and tool calls behind them.

### How long must AI system logs be kept under the EU AI Act?

Providers and deployers of high-risk AI systems must keep automatically generated logs for a period appropriate to the system's purpose, and at least six months, unless Union or national law says otherwise. Sector rules such as financial services record-keeping can require longer. Configure database retention and object-storage lifecycle rules, as in [Bifrost log exports](https://docs.getbifrost.ai/enterprise/log-exports), so both meet the longest period that applies.

### What are the EU AI Act penalties?

Article 99 sets three tiers: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other operator obligations including Article 50, and up to €7.5 million or 1% for supplying incorrect information to authorities. The higher amount applies, except for SMEs and, for the lower two tiers, small mid-caps, where the lower amount applies.

## Getting Started with Bifrost

EU AI Act compliance for LLM applications and agents starts with knowing your risk category and role, then producing records and controls you can show an assessor. Bifrost puts model, tool, and agent traffic behind one gateway with request logs, signed audit logs, redaction, scoped access, and in-VPC deployment, so evidence comes from configuration instead of reconstruction. To see how it fits your AI governance and compliance program, [book a Bifrost demo](https://getmaxim.ai/bifrost/book-a-demo) or browse the [Bifrost governance resources](https://www.getmaxim.ai/bifrost/resources).

## Read next

[![Claude Code Hooks for Governance and Gateway Policy](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/claude-code-hooks-for-governance-and-gateway-policy-bifrost-1920x1080.png) Claude Code hooks are handlers that run at fixed points in a session and can allow, deny, or log what the agent does. This guide shows how to use Claude Code hooks for governance, how to lock them with managed settings, and where an AI gateway enforces identity, budgets, and tool access instead.](https://www.getmaxim.ai/articles/claude-code-hooks-for-governance-and-gateway-policy/)

[![Shadow AI in Coding Tools: 5 Ways to Find Unapproved Cursor, Claude Code, and Copilot Usage](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/shadow-ai-in-coding-tools-5-ways-to-find-unapproved-cursor-c-bifrost-1920x1080@2x.png) Shadow AI in coding tools is AI-assisted development that runs outside company approval, through personal plans, personal API keys, or unmanaged installs. This guide covers five ways to find unapproved Cursor, Claude Code, and Copilot usage, and how to route it through governance.](https://www.getmaxim.ai/articles/shadow-ai-coding-tools/)

[![Top 5 AI Data Governance Tools for Controlling What Data Reaches LLMs in 2026](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/top-5-ai-data-governance-tools-for-controlling-what-data-rea-bifrost-1920x1080@2x.png) AI data governance decides which data can reach a language model and what happens when sensitive data tries to. This guide compares five tools for controlling it, including Bifrost, Microsoft Purview, Google Cloud Model Armor, Nightfall, and Cyera.](https://www.getmaxim.ai/articles/ai-data-governance-tools/)

## More in AI Governance

[![Claude Code Hooks for Governance and Gateway Policy](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/claude-code-hooks-for-governance-and-gateway-policy-bifrost-1920x1080.png) Claude Code hooks are handlers that run at fixed points in a session and can allow, deny, or log what the agent does. This guide shows how to use Claude Code hooks for governance, how to lock them with managed settings, and where an AI gateway enforces identity, budgets, and tool access instead.](https://www.getmaxim.ai/articles/claude-code-hooks-for-governance-and-gateway-policy/)

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "publisher": {
        "@type": "Organization",
        "name": "Maxim Articles",
        "url": "https://www.getmaxim.ai/articles/",
        "logo": {
            "@type": "ImageObject",
            "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w256h256/2025/08/thumbnail.png",
            "width": 60,
            "height": 60
        }
    },
    "author": {
        "@type": "Person",
        "name": "Kuldeep Paul",
        "image": {
            "@type": "ImageObject",
            "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/2025/08/1727978381919.jpeg",
            "width": 800,
            "height": 800
        },
        "url": "https://www.getmaxim.ai/articles/author/kuldeep/",
        "sameAs": []
    },
    "headline": "EU AI Act Compliance for LLM Applications and Agents",
    "url": "https://www.getmaxim.ai/articles/eu-ai-act-compliance-llm-applications/",
    "datePublished": "2026-10-21T21:30:00.000Z",
    "dateModified": "2026-10-23T21:32:00.000Z",
    "image": {
        "@type": "ImageObject",
        "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/10/eu-ai-act-compliance-for-llm-applications-and-agents-bifrost-1920x1080.png",
        "width": 1200,
        "height": 675
    },
    "keywords": "AI Governance",
    "description": "EU AI Act compliance for LLM applications means mapping each feature to a risk category and producing evidence for logging, oversight, and transparency duties. This guide covers the post-Omnibus timeline, the engineering obligations, and where an AI gateway helps and where it stops.",
    "mainEntityOfPage": "https://www.getmaxim.ai/articles/eu-ai-act-compliance-llm-applications/"
}
```