NOCTRYSThe deadline moved. The obligation didn’t.
High-risk AI-agent obligations move to 2 December 2027 under the EU Digital Omnibus, now law as Regulation (EU) 2026/1744. But transparency duties and the AI Office’s enforcement powers already apply from 2026, and the engineering that satisfies the high-risk rules takes far longer than the extension buys you. NOCTRYS makes you provably ready early, by design, not in a last-minute scramble.
Where the timeline really stands in 2026
Read almost any 2025-era summary and you will see "high-risk obligations go live 2 August 2026." Under the EU Digital Omnibus, now law, that is no longer accurate, and getting it wrong in a board deck is its own kind of risk. Here is the current picture:
Transparency + AI Office
Article 50 transparency duties and the AI Office’s enforcement powers apply. General-purpose AI model obligations are already in force.
High-risk (Annex III)
Obligations for Annex-III high-risk use cases (credit, insurance, employment, essential services) apply from this date under the Digital Omnibus, Regulation (EU) 2026/1744.
High-risk (Annex I)
High-risk AI embedded in already-regulated products (Annex-I safety legislation) moves to this later date.
The honest read: the Digital Omnibus postpones the high-risk obligations, and the deferral is now law: published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744, in force from 27 July 2026. Annex-III use cases (credit, insurance, employment, essential services) move to 2 December 2027, and Annex-I-embedded high-risk systems to 2 August 2028. What is not postponed: the Article 50 transparency duties and the AI Office’s enforcement powers, which apply from 2 August 2026.
The near-term duty is disclosure, and agents are named directly
The Commission’s Guidelines on Article 50 (Annex to C(2026) 5054 final, 20 July 2026; formally non-binding) address AI agents in so many words. Agents that interact with people while executing tasks fall under Article 50(1); the Commission’s own examples include making bookings, managing correspondence, negotiating or concluding contracts, and executing purchases.
AI agents must be designed and developed in such a way that they disclose both their artificial nature and the person on whose behalf they are acting.
The Guidelines also expect an agent to disclose itself to the person instructing it at key steps, with the Commission naming the point of authorisation, reporting, and validation, and at every new interaction. The exceptions are narrow, and relying on one is a demonstration burden: the provider must assess and demonstrate that it applies (para (42)). Separately, the final Code of Practice on Transparency of AI-Generated Content (10 June 2026) sets the quality bar for transparency metadata: "digitally signed and time-stamped" in a "secure and tamper-evident" manner.
Where NOCTRYS fits, stated precisely. NOCTRYS does not watermark content and does not render disclosure interfaces, and no product makes a company "Article 50 compliant" by itself. Article 50 also does not impose a standalone record-keeping duty; the posture it creates is assess and demonstrate. What NOCTRYS produces is exactly the kind of record the Code of Practice describes: a signed, time-stamped, tamper-evident, independently verifiable account of what an agent did and under whose mandate. When you are asked to demonstrate that your agents disclosed and stayed within their mandate, that is the record you hand over.
Shipped: disclosure-evidence records. NOCTRYS records disclosure as first-class evidence: signed, time-stamped, tamper-evident records that an agent disclosed its artificial nature and the person on whose behalf it acts, covering the disclosure being presented, renewed, and authorised by the principal, sealed into the same independently verifiable audit chain. An optional policy gate can block designated tools unless the action carries a resolvable disclosure reference, and the compliance report includes a dedicated transparency-evidence section. Stated plainly once more: Article 50 imposes no standalone record-keeping duty, and no record makes anyone "Article 50 compliant"; these are the records you can produce when asked to demonstrate that disclosure took place.
An extension is runway, not a reprieve
The duties that land on autonomous agents (tamper-evident logging, real-time human oversight, robustness against manipulation, multi-year record-keeping) are not a document you write the week before an audit. They are an architecture. Teams that treat December 2027 as "do it later" will discover that retrofitting a believable, intervenable audit trail onto agents already in production is the hard, expensive path.
The hard part for autonomous agents was never writing a log. It is producing a log a regulator will believe, and being able to intervene in real time.
NOCTRYS is the by-design route: install it now, and every agent action is governed, overseeable, and independently provable from day one. When the obligations bite, and when your own auditors, insurers, and enterprise customers ask sooner than the regulator does, you are already compliant instead of scrambling.
The high-risk duties, mapped to concrete controls
The extension changes when, not what. These are the obligations that land on the agent action layer, and the NOCTRYS control that satisfies each. The substance stays the same whichever date applies.
| Article | What it requires | How NOCTRYS satisfies it |
|---|---|---|
| Art. 12 | Automatic logging of events over the system’s lifetime; full traceability. | Every action is hash-chained into a tamper-evident recorder, anchored on the AERE chain and cosigned by independent witnesses, so the log is not just complete but unforgeable and independently verifiable. |
| Art. 14 | Effective human oversight; ability to detect anomalies and intervene. | High-risk actions are held for a named human’s cryptographic sign-off; a kill-switch freezes an agent, or the whole fleet, instantly. |
| Art. 15 | Accuracy, robustness, and resilience against manipulation. | Deterministic, fail-closed enforcement plus defenses against injection, self-modification, tool-drift, tool-shadowing, and Unicode smuggling. |
| Art. 26 | Deployer keeps automatically generated logs for at least six months. | Persistent, tamper-evident store with SIEM export and redaction of secrets/PII. |
| Art. 50 | Transparency duties (already applying from 2026). | Every governed action is attributable, and disclosure events are captured as signed, time-stamped disclosure-evidence records in the same audit chain: evidence you can produce on request, not a record-keeping duty the Article imposes. |
This is an engineering mapping and a plain-language reading of the law, not legal advice; dates reflect the Digital Omnibus as published in the Official Journal (Regulation (EU) 2026/1744). Consult qualified counsel for your obligations.
What you can hand an examiner
- A one-command AI-Act audit report: totals, blocks by reason, integrity status, the anchored Merkle root, and article coverage.
- A public verifier so the examiner checks the record themselves, with no need to trust you or us. Try it →
- OWASP Top 10 for Agentic Applications (2026): 10/10 covered. See Compliance →.
Be one of our first five design partners
Free pilot. A two-week, self-hosted integration. You keep the tamper-evident audit and the AI Act compliance report.
Request a pilot →