Agent Compliance

Agent compliance is the regulatory and operational framework that determines what organizations must do before and while deploying autonomous AI agents. The landscape operates on three layers, and since mid-2026 a fourth conversation has opened around payments.

Layer 1: Comprehensive AI regulation

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive AI legal framework. It uses a risk-based classification system, and most enterprise AI agents land in the high-risk bucket because they take autonomous actions with real-world consequences: transactions, workflow triggers, approvals. Deployer obligations under Article 26 include assigning human oversight, monitoring operations, retaining logs for at least six months, and reporting serious incidents. Timelines have moved more than once. General-purpose AI model obligations have applied since 2 August 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744, 8 July 2026) then set the high-risk requirements to apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The Act’s conformity-assessment taxonomy now names Agentic AI explicitly, under emerging AI technologies (Annex XIV code AIH 0401).

Layer 2: US state patchwork

Colorado’s SB 26-189 (signed May 14, 2026, effective January 1, 2027) regulates automated decision-making technology in consequential decisions across education, employment, housing, financial services, insurance, healthcare, and government services. Deployers must provide pre-interaction notice, post-adverse-outcome explanations within 30 days, and honor consumer rights to access, correct, and request human review.

Layer 3: Sector-specific regulation

Existing frameworks-HIPAA for healthcare, FinCEN for financial services, EEOC for employment, FTC consumer protection-already constrain how agents can operate in regulated domains.

Payments rules are being rewritten with agents in mind

Since mid-2026, payments regulation has started catching up with agent-initiated transactions. The FCA’s Payments Regulatory Priorities Report (March 2026) says the regulator will consider “whether change or development of regulation is needed to support agentic AI payments.” HM Treasury’s consultation on modernising payment services regulation (July 2026, closed 6 October 2026, outcome pending) asked how the framework should account for “agentic payments.” In the United States, Treasury’s GENIUS Act rulemaking (proposed 18 August 2026, comments closing 19 October 2026) and the Stablecoin Certification Review Committee’s interim procedures (30 September 2026) are building the payment-stablecoin layer agents will transact on. One vocabulary trap for researchers: FinCEN’s October 2026 proposal involving “sub-agents” targets the A7 Network’s front companies in a sanctions-evasion case. Those are not AI agents.

The agent-shaped gap

The Congressional Research Service confirmed in July 2026 that there was still “no known US government guidance specifically on agentic AI,” and no jurisdiction has yet issued binding rules written specifically for autonomous, payment-initiating agents. What changed in the second half of 2026 is that framework-making began naming agentic AI explicitly. Expect the gap to close at the rule layer rather than the guidance layer.

The compliance toolkit

The NIST AI Risk Management Framework (AI RMF 1.0) and its generative AI companion profile AI 600-1 (July 2024) provide voluntary risk-management structures that most agent compliance programs build on. A recurring pattern across the emerging frameworks: primary obligations land on the organization deploying the agent, not the model provider, closer to how an employer is responsible for an employee’s actions within the scope of their role.