AI Act oversight

Art. 26: what deployers of high-risk AI actually owe

Art. 26 of the AI Act obliges deployers, among other things, to use systems as intended, to ensure human oversight by competent persons and to cooperate on record-keeping. For agentic systems this means: the agent's limits of authority are part of intended use — and must be provable.

Arts. 12/19: record-keeping that withstands scrutiny

High-risk systems must record events automatically (Art. 12); deployers must retain the logs (Art. 19). The open question is never whether, but quality: are the records complete, unaltered and attributable?

Are shopping and admin agents high-risk AI?

The honest answer: it depends on the use — the Annex III areas (employment, essential services, law enforcement and others) decide, not the technology. But the smart strategy does not hinge on the classification: whoever has oversight mechanics is well positioned in every scenario.

AI Act readiness for SMEs: the pragmatic path

SMEs do not need a compliance department to be agent-ready and regulation-proof — they need three decisions: which actions agents may perform (choose the taxonomy), from when a human decides (set thresholds), and where the proof lives (establish an export routine).

Oversight is not monitoring: the governance split

Two terms, two systems: monitoring observes what agents do (discovery, telemetry, anomalies — the Okta/AgentryGov world); oversight determines what they may do and intervenes (mandates, escalation, revocation). Confusing them costs either control or freedom.