Guide

AI Act and AI Agents Guide: Timeline, Duties, GDPR and Security

The AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus (Regulation (EU) 2026/1744), applies in stages. For most companies using AI today the relevant duties are AI literacy and transparency; the GDPR and security rules apply to AI agents in full.

At a glance

2 February 2025	Prohibited practices and AI literacy (Art. 4, rewritten in July 2026)
2 August 2026	Transparency duties of Article 50 and the general date of application
2 December 2026	Marking duty for generative systems already on the market; new prohibitions
2 December 2027	High-risk obligations for Annex III uses such as recruitment and credit scoring
2 August 2028	High-risk obligations for AI in products covered by Annex I

Each point is explained, with its legal source, in the guides below.

The AI Act

EU AI Act Timeline After the 2026 Digital Omnibus: What Applies When

The dates in force since 2025, what changed on 27 July 2026, the transparency rules that apply now, and the high-risk deadlines moved to December 2027 and August 2028.

8 min read

AI Literacy Under the AI Act: What Article 4 Requires After the 2026 Omnibus

Who must act, what changed when the Digital Omnibus replaced Article 4 in July 2026, how the duty is enforced, and a proportionate AI literacy programme you can document.

8 min read

AI Act Transparency Rules (Article 50): Chatbots, Deepfakes and AI-Generated Content

Who must tell people they are dealing with AI, who must mark generated content and by when (2 December 2026 for older systems), deepfake and AI text disclosure, the exceptions, and the code of practice.

8 min read

AI agents in practice

AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs

Roles, legal basis, Article 22 after the SCHUFA and Dun & Bradstreet rulings, DPIAs, logs and retention, and the checks EDPB Opinion 28/2024 expects before you deploy someone else's model.

10 min read

Assessing AI Agent Providers: A Questionnaire for NIS2, DORA and GDPR Article 28

What GDPR Article 28, NIS2 Article 21 and DORA Articles 28 and 30 require before you let a provider's agent touch your data and systems, and the questions to ask.

9 min read

Incident Response for AI Agents: Prompt Injection, Rogue Actions and Reporting

What an agent incident looks like, how to contain it in the first hour, which reports may be due under GDPR, NIS2, DORA, the CRA and the AI Act, and a scenario to rehearse.

9 min read

Agent security

OWASP Top 10 for Agentic Applications (2026) Explained, With Controls

ASI01 to ASI10 in plain English: what each agentic AI risk means for a company that uses agents, an example, and the first controls to put in place.

12 min read

Securing MCP Servers and AI Agent Tools: A Practical Checklist

The attacks the MCP specification and OWASP name, the controls that stop them, and how they map to NIS2 Article 21, DORA and GDPR Article 32.

10 min read

How to Audit an MCP Server: A Step-by-Step Security Review

Eight steps to review the MCP servers your company uses or builds, based on the MCP specification and the OWASP MCP Top 10, with what evidence to collect at each step.

11 min read

AI Agent Identity and Delegated Permissions: Who Is the Agent Acting As?

Shared accounts and borrowed tokens make agents impossible to control or audit. How to give each agent its own identity, delegate only what a task needs, and prove it to an auditor.

10 min read

A2A Security: Securing Agent-to-Agent Communication (Protocol 1.0)

What the A2A 1.0 specification requires for authentication, agent card signing, task access and push notifications, the attacks OWASP describes, and a checklist for teams connecting agents.

10 min read

ClevSec in your AI assistant

EU Compliance Questions in Your AI Assistant: Five Worked Examples With an MCP Server

NIS2 scope, a DORA major incident, a stolen laptop, a data broker privacy notice and an exploited vulnerability: what an assistant gets back from deterministic tools.

7 min read