What are the EU AI Act risk tiers and which one applies to my AI agent?

The provided sources do not define specific risk tiers for the EU AI Act or specify how an AI agent would be categorized within them. However, they do indicate that the EU AI Act, along with other frameworks like NIST AI RMF and ISO 42001, establishes a shared expectation for organizations to demonstrate awareness and control of the AI systems they operate.

While the EU AI Act's specific tiers are not detailed, the sources highlight several critical aspects of AI risk management that are relevant to compliance with such frameworks:

• Risk-aware engineering practices Organizations should treat AI risks as first-class engineering concerns, incorporating secure-by-design principles and threat modeling. This aligns with NIST-GOVERN-4.1.
• Accountability and oversight Clear roles, responsibilities, and accountability for AI risk must be documented, with a named risk owner for each deployed AI/agent system. This is covered by NIST-GOVERN-2.1 and cross-maps to ISO/IEC 42001 Cl.5.
• Incident response and monitoring Post-deployment monitoring and an AI/agent incident-response plan are essential for detection, escalation, containment, communication, and learning. This is addressed by NIST-MANAGE-4.1.
• Autonomy management The autonomy of AI agents should be carefully stratified, with actions categorized by reversibility, blast radius, cost, external visibility, and compliance sensitivity. This includes defining policies for human oversight and override authority, linking to OWASP LLM06/LLM08 regarding excessive agency.
• Generative AI-specific risks For LLM/agent stacks, particular attention should be paid to risks such as confabulation/hallucination, information security (e.g., prompt injection, data exfiltration, insecure tool use), data privacy, dangerous content, and value-chain/component integration. These map to OWASP LLM01, LLM02, LLM03, LLM05, and LLM06.
• Discovery and inventory Organizations must be able to discover and inventory all AI agents operating in their environment, as "shadow AI agents" pose a significant and invisible risk. This is analogous to the need for a Software Bill of Materials (SBOM) for open-source components.