AI agents that autonomously call APIs, query databases or operate internal business tools are increasingly treated under the EU AI Act (Regulation (EU) 2024/1689) as actors whose actions must be reconstructable and attributable after the fact. The core of the discussion is no longer abstract: from 2 August 2026 the obligations for high-risk AI systems become enforceable, and those obligations directly affect the way organisations design agents that have access to sensitive information.
Why attention on agents is increasing
The OWASP GenAI Exploit Round-up Report Q1 2026 describes concrete incidents in which generative AI agents were able to expose sensitive business data or could be steered via prompt injection. Such exploit paths illustrate what goes wrong when an agent acts with elevated privileges without it being clear afterwards which action was carried out by which agent. Precisely for that reason the report emphasises the importance of strict logging, traceability and containment for high-risk AI agents.
These incident accounts align with what the legislator had already set out earlier. They make tangible why the regulation imposes certain design obligations: not as a bureaucratic formality, but because making agent actions reconstructable is a precondition for being able to identify and contain risks.
What the regulation concretely requires
Article 12 (Record-Keeping) requires providers of high-risk AI systems to automatically record events over the lifetime of the system. Those logs must make it possible to recognise risks, carry out post-market monitoring and maintain operational oversight. In an agentic environment, "automatic recording of events" concretely means: every tool call, every API call and every action on an internal system should be traceable.
On the user side, Article 26 (Obligations of Deployers) complements this. Deployers of high-risk AI systems must retain the automatically generated logs for at least six months, and logging and oversight thereby form a core obligation for systems that influence high-risk decisions. Responsibility therefore does not lie only with whoever builds the system, but also with whoever deploys it.
From legal text to architecture
The practical translation emerges in recent analyses. The publication EU AI Act Compliance 2026 by Salt Security states that AI agents that call internal and external APIs fall within the scope of Articles 12 and 15. According to that analysis, the high-risk obligations — including tamper-evident logging and cybersecurity for the action-layer of agents — become enforceable on 2 August 2026, and logs must be retained for at least six months.
Kakunin goes a step further in its implementation update of May 2026. That publication describes EU AI Office guidelines around Article 12 logging in which per-agent identity in audit logs is expected, and outlines expectations from draft versions of harmonised standards, such as time-bound credentials and revocation procedures. The common thread: shared keys and anonymous service accounts are no longer sufficient when you must be able to demonstrate afterwards which agent did what.
In summary, several concrete design patterns are emerging for organisations that deploy agents on sensitive workflows:
- Per-agent identity instead of shared credentials, so that actions remain attributable;
- Tamper-evident, structured logs for every tool call and API call;
- Retention period of at least six months for automatically generated logs;
- Documented revocation and containment procedures, informed by real exploit paths such as those OWASP describes;
- Time-bound credentials that expire and can be revoked.
What this means for working with confidential information
For professionals who work with confidential files — lawyers, notaries, occupational physicians, journalists, researchers and compliance teams — the playing field is shifting. Under the EU AI Act, verifiable audit trails and controllable, inspectable agent behaviour are no longer merely a matter of good practice, but will soon become enforceable requirements for those who let agentic AI loose on sensitive information.
This touches on what IamVera is focused on. Vera is not a chatbot and not a language model of its own, but a verification layer that makes verification steps visible. The Semantic Privacy Shield is designed so that pre-processing and anonymisation take place on EU infrastructure, and so that only anonymised content is sent to the selected AI models; when a privacy check fails, nothing is forwarded. That approach aligns with the thinking behind the regulation: retaining insight into what happens with sensitive content, and making that reviewable.
Multi-model verification can additionally help to scrutinise AI answers rather than adopting them uncritically. Vera supports checking by making verification steps visible, but gives more insight into how an answer comes about rather than removing errors. The professional final judgement remains with the user.
The message from the sources is sober but clear: those who think about per-agent identity, tamper-evident logging and containment paths before 2 August 2026 will be in less of a bind later than those who have to arrange it after the fact. AI agents with access to internal systems are becoming auditable actors — and that calls for an architecture designed accordingly.