Quirin Schlegel

Loading

It worked while you slept — OpenAI shipped always-on agents, and the AI Act duty that reaches them is already in force

OpenAI's DevDay on 29 September 2026 shipped dots, always-on agents on their own cloud computers reaching over 4,000 apps through plugins, alongside GPT-6.1 Sol at a fifth of Astra's token prices, Ultrafast at 300 tokens per second, and computer use in the Agents API. The launch-day framing of an agent that telephones and writes to people does not survive OpenAI's own limits page, which states that a dot cannot initiate calls at launch and confines texting to Pro users in the United States — so the transparency exposure is not the shipped consumer product but the outbound agent a developer can now build on the Agents API in an afternoon. The regulatory correction is which chapter the Digital Omnibus moved: Regulation (EU) 2026/1744, in force 27 July 2026, deferred Annex III high-risk to 2 December 2027 and Annex I to 2 August 2028, and did not touch Article 50, whose transparency duty has applied since 2 August 2026 and whose machine-readable marking limb applies from 2 December 2026, 63 days out. Article 50(1) is a design duty on the provider, Article 50(5) makes it due at the latest at the first interaction, and in Germany the KI-MIG has been in force since 29 July 2026 with the Bundesnetzagentur as central market-surveillance and coordination authority under a hybrid model that leaves fully harmonised product areas with sector regulators.

30 September 202610 verified claims6 sources

Your agent's own cloud computer was working at 3am. Nobody was watching it. That is a product now, not a thought experiment.

Yesterday at DevDay, OpenAI shipped dots: always-on agents that run on their own cloud machine, keep working while you are elsewhere, and reach over 4,000 apps through plugins.

Flat:

1. Dots run on GPT-6 Astra, rolling out to Pro and Business Premium "in eligible markets". GPT-6.1 Sol arrives at a fifth of Astra's input and output token prices with "exceptionally strong performance on agentic coding". Ultrafast tops out at 300 tokens per second — 8x in Codex, 6x in the API. The Agents API now does computer use.

2. Before you file dots under "an AI that phones people": it doesn't. OpenAI's own help page says "Your dot cannot initiate calls to you at launch" — to you, its owner. Texting is limited to Pro users in the US. The coverage is ahead of the product. The disclosure problem is not OpenAI's dot. It is the outbound voice agent you can now build in an afternoon on the Agents API.

3. And if your instinct is that the AI Act gave you until 2027 — check which chapter moved. The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, pushed Annex III high-risk to 2 December 2027 and Annex I to 2 August 2028. It did not touch Article 50. Transparency has applied since 2 August 2026, and machine-readable marking of synthetic audio, image, video and text lands 2 December 2026. That is 63 days. In Germany the KI-MIG has been in force since 29 July 2026 and the Bundesnetzagentur is the central market-surveillance and coordination authority, so the enforcer has a name.

Monday:

1. Article 50(1) is a design duty on the provider — whoever builds the system. If you built it, that is you, not your model vendor. 2. Disclosure is due "at the latest at the time of the first interaction" (Article 50(5)). First turn, not a footer. 3. "Unless this is obvious" is not a waiver you assert. Write down why, or say it. 4. Marking has a date on it. Put 2 December in the sprint that reaches it.

An always-on agent is a product decision. Disclosure is a design duty, and it is already in force.

Which of your agents tells anyone what it is?

#AgenticAI #EUAIAct #AIGovernance #DevSecOps #SoftwareEngineering

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

OpenAI announced dots on 29 September 2026: always-on agents powered by GPT-6 Astra, each working on its own cloud computer, connecting to over 4,000 apps through plugins, and looking for ways to help in the background when the user is not actively working with them. They are rolling out to Pro and Business Premium users in "eligible markets", with Enterprise, Edu and Healthcare in beta and off by default.
Why it mattersAn agent that runs continuously on infrastructure you do not own, and acts between your sessions with it, has no moment at which a human is present to caveat what it is. That is the design constraint Article 50(1) actually imposes.
openai2026devday · openai2026dots
GPT-6.1 Sol, announced 29 September 2026, delivers in OpenAI's words "near-Astra intelligence to everyone at a fifth of its standard input and output token prices", with "exceptionally strong performance on agentic coding, along with computer use, and professional work". It is available to all API, Plus, Pro, Business, Enterprise and Edu users.
Why it mattersA fifth of the token price at near-flagship agentic-coding quality moves always-on agent loops from a budget question to a design question, which is what makes the compliance date the binding constraint rather than the cost.
openai2026devday
OpenAI's Ultrafast tier, announced 29 September 2026, offers "up to 8x faster token generation (300 tokens per second) in Codex and up to 6x in the API", available as GPT-6 Astra Ultrafast in the API and in ChatGPT Work and Codex on Pro 500 and Enterprise.
Why it matters300 tokens per second is the point at which a voice agent's turn latency stops being the reason not to build one.
openai2026devday
The OpenAI Agents API, as of 29 September 2026, "supports computer use so developers can build agents that interact with software to complete tasks", alongside multi-agent capabilities and tool calling.
Why it mattersThis is the primitive that makes the reader the provider rather than a customer. Build an interacting agent on it and Article 50(1) attaches to your system, not to OpenAI's.
openai2026devday
OpenAI's own help documentation for dots states "Your dot cannot initiate calls to you at launch", limits texting to "Pro users in the US", and states that a user "cannot give your dot its own standalone email address". No capability to place calls or send messages or email to third parties is described, and the documentation contains no language about a dot identifying itself as an AI to anyone it contacts.
Why it mattersThe launch-day framing of an agent that telephones and writes to people on your behalf does not survive the vendor's own limits page. The transparency exposure is not in the shipped consumer product; it is in what a developer can build on the same day with the Agents API.
openaihelpc2026getting · openai2026dots
AI Act Article 50(1) places the duty on providers: AI systems intended to interact directly with natural persons must be designed and developed so that those persons are informed they are interacting with an AI system, "unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use".
Why it mattersIt is a design duty on whoever builds the system, not a notice duty on whoever operates it, and the "obvious" carve-out is assessed against a reasonably well-informed observer rather than asserted by the builder.
euartificia2026transpare
AI Act Article 50(2) obliges providers of AI systems generating synthetic audio, image, video or text, including general-purpose AI systems, to ensure the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated", with technical solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible".
Why it mattersMachine-readable marking is an implementation task with a shipping date, not a policy statement. It belongs in the sprint that reaches 2 December 2026.
euartificia2026transpare
AI Act Article 50(5) requires the information under Article 50(1) to (4) to be provided to the natural persons concerned "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", conforming to applicable accessibility requirements.
Why it mattersFirst turn, not a footer and not the terms of service. For an agent that opens the conversation, the disclosure has to be in its first utterance.
euartificia2026transpare
Article 50 transparency obligations have applied since 2 August 2026 and the marking-of-generated-content obligation applies from 2 December 2026, while Regulation (EU) 2026/1744, the Digital Omnibus, in force 27 July 2026, moved the Annex III high-risk chapter to 2 December 2027, the Annex I high-risk chapter to 2 August 2028 and member-state regulatory sandboxes to 2 August 2027. Article 53 general-purpose AI model obligations have been in force since August 2025.
Why it mattersThe deferral that most commentary reports covers the high-risk chapters. Article 50 was not moved, so the duty that reaches an ordinary conversational or voice agent is live now and its marking limb is 63 days away.
euartificia2026implement
The German Gesetz zur Marktueberwachung und Innovationsfoerderung von kuenstlicher Intelligenz (KI-MIG) entered into force on 29 July 2026. The Bundesnetzagentur takes the central role in implementing the AI Regulation in Germany: market surveillance for AI systems in radio equipment and in sensitive sectors including personnel management, critical infrastructure and education; central coordination and competence centre for other market surveillance authorities and notifying bodies; central contact point; complaint authority; and operator of a regulatory sandbox and AI Service Desk. Germany's model is hybrid, with established sector regulators retaining oversight in fully harmonised product areas.
Why it mattersThe enforcer has a name, an address and a complaints channel. It is also not the only one: for a fully harmonised product area the competent authority is still the sector regulator, so 'BNetzA handles AI' is too coarse to plan against.
bundesnetza2026bundesnet

Sources

Bundesnetzagenturprimary source
Bundesnetzagentur uebernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung
Original Archived PDFretrieved 30 September 2026 · published 29 July 2026
OpenAIprimary source
DevDay 2026 Recap
Original Archived PDFretrieved 30 September 2026 · published 29 September 2026
OpenAI Help Centerprimary source
Getting started with your dot
Original Archived PDFretrieved 30 September 2026 · published 29 September 2026
EU Artificial Intelligence Actsecondary
Implementation Timeline
Original Archived PDFretrieved 30 September 2026 · published 30 September 2026
EU Artificial Intelligence Actsecondary
Transparency obligations under Article 50
Original Archived PDFretrieved 30 September 2026 · published 30 September 2026
OpenAIprimary source
dots: always-on agents (OpenAI announcement)
Original Archived PDFretrieved 30 September 2026 · published 29 September 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

Dropped before drafting: an AWS Bedrock AgentCore story. Infosecurity Magazine dated the BeyondTrust write-up 28 September 2026, but the AWS security bulletins for CVE-2026-12530 and CVE-2026-16796 are dated 17 June and 23 July 2026 and the BeyondTrust posts are from June 2026. A coverage date is not an event date; the item was three months old.

Tightened before publication: an earlier draft said "BNetzA is the market surveillance authority". The Bundesnetzagentur's own 29 July 2026 release describes a hybrid model in which it is the central coordination and competence centre and the market surveillance authority for radio equipment and named sensitive sectors, while established sector regulators keep fully harmonised product areas. The line now says "central market-surveillance and coordination authority".