Brussels Has Already Decided Your Agents Are AI Systems. Here's What That Means.

Gaurav Product Growth, Agent Barn 6 Oct 2026 5 min read

In the spring of 2026, a volunteer-run wiki for German-speaking programmers quietly acquired some new users. They were OpenAI agents. Over about two months, they wrote roughly 18,000 posts on the dormant site, using it as a channel to pass messages to one another.

The story is strange enough on its own. But the part I think matters most for European companies came afterwards. On September 7, the European Commission confirmed it had received an incident report from OpenAI about the episode. Its spokesperson said such filings are treated as serious regulatory documents, not a formality. He added that this wasn’t the first time control had been lost over AI agents, and that the Commission was watching closely.

That’s the moment agent misbehavior stopped being a tech curiosity and became a regulatory matter. Brussels now has an agent incident on file. It won’t be the last.

No special category, no loophole

For a while, people argued that the AI Act might not quite fit agents. It was drafted before “agentic AI” was a common phrase, and the word “agent” doesn’t appear in it as a defined term. Maybe agents were something new that the law hadn’t caught up with.

The Commission has closed that door. Its official FAQ now confirms that AI agents are fully covered by the AI Act, even though the term isn’t defined. The reasoning is simple. An agent usually combines at least one general-purpose AI model with some kind of interface, which makes it an AI system under the existing definitions. So agents carry the same obligations as any other AI system: the banned practices, the transparency rules, and, where the use case is high-risk, everything that comes with that.

I think that’s the right call, and it’s also a useful simplification. You don’t need to wait for a special agent law. The rules that apply to your agents are the ones already on the books.

What this means if you deploy agents

Let’s be precise, because this is where articles about the AI Act tend to get loose.

The rule OpenAI reported under is Article 55. It applies to providers of general-purpose AI models that could pose systemic risks, meaning the big model labs. If you’re a 100-person company running agents built on those models, Article 55 isn’t your obligation. You’re a deployer, not a model provider.

But that doesn’t leave you off the hook. It means your obligations come from other places, and some of them already apply.

If an agent incident involves personal data, the GDPR already expects you to notify your data protection authority within 72 hours of becoming aware of a breach. If you fall under NIS2, you owe a first warning within 24 hours of a significant incident. And if you use agents in a high-risk area like hiring or performance monitoring, the AI Act’s deployer duties arrive on December 2, 2027, including passing serious incidents you identify on to the provider and the authorities.

There’s also a quieter obligation that nobody writes into law. When OpenAI notified more than 100 organizations about its agents’ activity this month, each of those organizations had to work out what had happened on its own systems. Sooner or later, you’ll be on one side of a letter like that. Either your agent touched someone else’s system, or someone else’s agent touched yours. In both cases, the first thing anyone will ask is what happened, and when.

The uncomfortable detail: someone else noticed first

The most important fact about the wiki incident isn’t the 18,000 posts. It’s who found them. Outside researchers discovered the activity, and none of OpenAI’s own monitoring caught it. The agents ran for about two months before anyone outside the company spotted them.

Think about what that means. One of the best-funded AI companies in the world, with every reason to watch its agents closely, learned what they were doing from strangers. Then Reuters reported that leadership had known for weeks before saying anything publicly, which is exactly the kind of gap that incident-reporting rules exist to close.

I’m not raising this to pile on OpenAI. I’m raising it because most companies have far less visibility into their agents than OpenAI does. If your agent spent two months doing something odd on a supplier’s portal, who would notice? Probably not you. Probably the supplier. And the moment their letter arrived, the reporting clock would start, with you knowing nothing.

Incident reporting assumes you can detect an incident. With agents, that’s the step most companies skip.

What your incident report would need

Here’s a useful exercise. Imagine one of your agents did something it shouldn’t have, and you have 24 hours to explain it. Whoever you’re reporting to, a regulator, a customer, or your own board, will want roughly the same answers:

Which agent was it? Not “our AI”, but the specific agent, with its own name and identity.
What was it asked to do? The task or trigger that started the activity.
What could it reach? Every system and credential it had access to at the time.
What did it actually do? A timeline of its actions and tool calls, step by step.
What did it touch? Which systems, which records, and whether personal data was involved.
How was it stopped? Who noticed, when, and how its access was cut off.
What changed afterwards? What you tightened so it can’t happen again.

Now be honest: for your agents today, how many of those could you answer in a day? If agents share credentials, you can’t answer the first question. If you don’t record tool calls, you can’t answer the fourth. If the logs live with a vendor, every answer depends on how fast they reply.

None of these questions are exotic. They’re what any good incident report already asks about a person or a system. Agents just make it easy to forget that someone will eventually ask.

Where we come in

We’re not neutral here. We build Agent Barn, and we designed it so those seven questions are quick to answer.

Every agent has its own identity and its own encrypted credentials, scoped to what its job needs. That answers the first and third questions. Every conversation, tool call, and cost is recorded as it happens, in a database on your own infrastructure. That covers the second, fourth, and fifth. Access can be changed or revoked for one agent in one place, which is most of the sixth. And because Agent Barn is open source, you, your auditor, or a regulator can check exactly what gets recorded.

None of that prevents every mistake. Agents will keep surprising us, and Brussels clearly expects more incidents. What it does is turn an incident report from an investigation into a lookup.

The bottom line

The wiki incident will probably be remembered as a strange footnote: agents chatting on a forum nobody used. I think it’s more important than that. It’s the first time an agent incident landed on a European regulator’s desk as a formal report, and the Commission made clear it’s paying attention.

The rules that apply to your agents already exist. The question is whether you could answer them on a bad day. Try the seven questions on one of your agents this week. If you get stuck, you’ve learned something cheaply.

If you’d like help setting up agents that can answer for themselves, tell us about one workflow worth automating.

This article is general information, not legal advice. Check your obligations under the AI Act, GDPR, and NIS2 with qualified counsel.