2026-08-03 — Same agent, different regulator

From 2 August 2026 the AI Act's supervision machinery allocates the regulator by corporate boundary: the AI Office holds exclusive competence over AI systems built on general-purpose models by the same provider or the same undertaking, the Commission takes market surveillance powers where the system is or sits inside a very large online platform, and everyone else answers to a national authority — in Germany the Bundesnetzagentur, whose complaint office has been open since 29 July. Article 85 lets any natural or legal person start that file. So name the regulator for every system you ship, in writing, and treat the corporate boundary under your model as a compliance input you do not control.

Post

Since Sunday, who regulates your AI agent in Europe depends on your cap table.

Not on what the agent does. On who owns the model underneath it.

The Digital Omnibus on AI entered into force on 27 July, and from 2 August it refines Article 75 of the AI Act. Recital 31 is unusually direct: the AI Office should have exclusive competence over AI systems built on general-purpose AI models "not only where both the system and the model are developed by the same provider, but also where they are developed by providers that form part of the same undertaking."

Read that as an engineer and it says something uncomfortable.

  1. A lab that ships an agent on its own model answers to Brussels, directly.

  2. You, shipping a functionally identical agent on that same model, answer to your national market surveillance authority. In Germany that has been the Bundesnetzagentur since 29 July.

  3. Deployers inside that lab's undertaking follow the model to Brussels. Every other deployer stays national. Your vendor and your customer can be supervised by different institutions for the same system.

  4. Recital 32 adds a second carve-out: where an AI system qualifies as, or is embedded in, a very large online platform or search engine, the Commission takes the powers of a market surveillance authority.

  5. And when a national authority asks the AI Office to act on a system under its exclusive supervision, the AI Office has four months to say whether it will. That is recital 34.

The part I keep turning over: none of this is a property of your system. It is a property of a corporate boundary you do not control and your customer cannot see.

Meanwhile the entry point at the national end is wide open. Article 85 applies from 2 August: any natural or legal person with grounds to consider there has been an infringement may complain to the market surveillance authority. Germany's complaint office has been live since 29 July.

So today: for every agent you ship, write down the authority that supervises it, and the reason. If you cannot name it in one sentence, that is the finding.

Which regulator did you write down?

#AIAct #AgenticAI #EUCompliance #AIGovernance #SoftwareEngineering

First comment

Sources, in the order they appear:

Regulation (EU) 2026/1744, the Digital Omnibus on AI — full text, including recitals 31, 32 and 34 quoted above https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744

Official Journal record — adopted 8 July 2026, published 24 July, in force 27 July https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

AI Act Article 85, the right to lodge a complaint with a market surveillance authority https://artificialintelligenceact.eu/article/85/

AI Act Article 113, the application dates — general application from 2 August 2026 https://artificialintelligenceact.eu/article/113/

Bundesnetzagentur, 29 July 2026 — market surveillance authority, central contact point and complaint office under the KI-MIG https://www.bundesnetzagentur.de/1112336

Bundesnetzagentur's own description of its AI market surveillance duties and complaint handling https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/14_Marktueberwachung/start.html

One point I cut for length: recital 31 also preserves sectoral supervision — where specific sectoral oversight exists, responsibility stays with the national competent authority. For fintech and medtech agents that exception may matter more than the rule does.

Claims

Sources

Corrections

No corrections. Two candidate claims were held in the working vault rather than published: an Annex XIV code said to name agentic AI, which could not be found in the retrieved Official Journal text, and the fine percentages attributed to a new Article 75c, on which sources disagree.