Most of the Act does not concern a team shipping an agent. Article 50 and Article 12 do, and only one of them is still in the future.
Quoted from the published text rather than paraphrased into something more alarming.
Any provider of a system that interacts with people
Systems that interact with natural persons must disclose that fact, unless it is obvious to a reasonably observant person. Synthetic audio, image, video and text must be marked as artificially generated in a machine-readable form. The duty is on disclosure — and proving a disclosure was actually made on a particular call is a records problem, not a UI problem.
High-risk systems, per Annex III
High-risk systems must technically allow the automatic recording of events over their lifetime. The logs must let you identify situations where the system presents a risk, and support post-market monitoring. Annex III includes employment and worker management, access to essential private and public services including creditworthiness, and law enforcement — which is where most agent deployments in finance and HR land.
Everyone in scope
Penalties run to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, for breaches of most operator obligations. Prohibited-practice breaches carry a higher ceiling of €35,000,000 or 7%. Member States set the detail, and enforcement is national.
The obligation in plain words on the left; the row in the record that satisfies it on the right.
Every event recorded over the system's lifetime, in an order nobody can quietly rearrange, kept as long as the obligation — years, not the vendor's default.
Each event is chained to the one before it on a store that only appends; seals are signed and countersigned; retention is a setting you choose, not an upsell. The compliance file for the Act is read off the same record.
A person you name can stop, hold or override a consequential decision, and the record shows they did — under their name.
The EU AI Act rule pack holds consequential decisions until a named person answers; the halt switch is the Article 14 stop; both are recorded. Installed in watch-only mode, armed by you.
Proof that the “you are talking to a machine” line was played on this call, not a policy saying it should be.
A disclosure event is recorded per call from the voice platform, and the Compliance page answers Article 50 from the record.
Including whether the dates are actually final, where the honest answer is that they may not be.
It can. The Act reaches providers placing systems on the EU market and deployers established in the EU, and it also reaches providers outside the EU where the output is used in the EU. An Indian company serving an EU customer is frequently in scope through that route or through its customer's contract, whichever bites first.
That depends on what it decides, not on how it is built. Annex III lists the areas — employment and worker management, creditworthiness and essential services, education, law enforcement, migration, justice. An agent that screens CVs or scores a loan is a much easier call than a support bot, and if you are genuinely unsure that is a question for counsel rather than for a vendor page.
The Act requires the technical capability for automatic recording of events over the lifetime, sufficient to identify risk situations and support post-market monitoring. It does not prescribe a format. What it plainly does not contemplate is a log that expires in fourteen days, or one whose contents can be revised without trace.
The staged application is set in the Act. There has been active discussion in 2025 and 2026 about simplifying or delaying parts of the high-risk regime, and it would be dishonest to tell you 2 December 2027 is beyond revision. It is the date on the books, and building a record now costs nothing if it moves.