The European AI Risk Index 2026

What an operator of an AI agent in Europe is now accountable for.

Name: The European AI Risk Index 2026
Creator: Future Proof Intelligence
Published: 2026-06-13
License: https://creativecommons.org/licenses/by-nc/4.0/
Keywords: EU AI Act, AI agent liability, Product Liability Directive, AI insurance, Article 50, Article 26, agent risk taxonomy

Since 2 August 2026, any deployer of a chatbot or conversational agent in the European Union must tell people they are talking to an AI, under Article 50 of the AI Act. From 9 December 2026, the revised Product Liability Directive treats AI software as a product under strict liability: a claimant no longer has to prove negligence, and an operator without documentation faces a presumption that its product was defective. This index maps the obligations, the deadlines, the liability cases, a seven dimension agent risk taxonomy and the European insurance gap in one reference.

Open the obligation map The dataset

Obligation clusters17 Maximum penaltyEUR 35M or 7% (Art. 99) Agent risk dimensionsSeven, weighted to 100

The forcing dates

2 August 2026Article 50 transparency applies. Not deferred.
9 December 2026Revised Product Liability Directive: AI software becomes a strict liability product.
2 December 2027Annex III high-risk obligations, as moved by the Digital Omnibus.
2 August 2028Annex I high-risk obligations for AI in regulated products.

Published by Future Proof Intelligence on 13 June 2026, revised 1 October 2026. Every claim is anchored to a named article, a named instrument or a decided case.

The deadline ladder. Today on the line.

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and switches on in stages. Two instruments matter most for operators of AI agents: the AI Act itself, and the revised Product Liability Directive. These are the legally operative dates after the Digital Omnibus.

1 August 2024The AI Act enters into forceThe staged application calendar begins to run.
2 February 2025Article 5 and Article 4Eight prohibited categories become enforceable, including untargeted facial image scraping, social scoring, and emotion recognition in workplaces and schools. AI literacy for staff.
2 August 2025Articles 53 and 55GPAI providers hold Annex XI and XII documentation, a copyright policy and a training data summary. Systemic risk duties above 10^25 FLOPs.
27 July 2026The Digital OmnibusRegulation (EU) 2026/1744 enters into force and moves the high-risk dates.
2 August 2026Article 50 transparencyChatbot disclosure and the marking of synthetic content. Not deferred.
9 December 2026Product Liability DirectiveAI software becomes a strict liability product, for products placed on the market after this date.
2 December 2027Annex III high-riskArticles 9 to 15, 26 and 27. Originally 2 August 2026.
2 August 2028Annex I high-riskAI as a safety component in regulated products. Originally 2 August 2027.

Why the evidence matters more than the date. Article 50 transparency and the Product Liability Directive are fixed. The high-risk obligations moved by sixteen months, but the evidence they call for, a risk register, logs, a named human overseer and a documented oversight boundary, is the same evidence a court examines after an incident and an underwriter examines before writing a policy. The deadline moved; the exposure stayed where it was.

The obligation map. Who must do what, by article, by date.

The AI Act allocates duties by role. A provider places a system on the market under its own name. A deployer uses a system under its own authority in a professional context; the Act's deployer is the figure this site calls the operator. Under Article 25, a deployer that rebrands, substantially modifies or repurposes a system into a high-risk use case becomes a provider and inherits the full provider stack.

EU AI Act obligation clusters, Regulation (EU) 2024/1689, plus the Product Liability Directive
Obligation	Binds	Article	Applies from	Evidence an assessor or underwriter needs
Prohibited practices	Both	Art. 5	2 Feb 2025	Product and deployment inventory confirming no system falls in the eight prohibited categories; documented screening before any new AI procurement.
AI literacy	Both	Art. 4	2 Feb 2025	Training log by role; coverage of contractors and service providers; evidence of periodic refresh as systems change.
Risk management system	Provider	Art. 9	2 Dec 2027originally 2 Aug 2026	Lifecycle risk management plan; risk register with likelihood and mitigation per risk; records showing review after any material change.
Technical documentation	Provider	Art. 11, Annex IV	2 Dec 2027originally 2 Aug 2026	Complete Annex IV package per system; version control; confirmation it was prepared before deployment, not retrospectively.
Transparency to deployers	Provider	Art. 13	2 Dec 2027originally 2 Aug 2026	Instructions for use covering each Art. 13(3) element; audit trail showing deployers received and acknowledged them. Generic model cards do not satisfy this.
Human oversight by design	Provider	Art. 14	2 Dec 2027originally 2 Aug 2026	Design documentation showing the oversight interface; test results demonstrating it works; confirmation of a halt or override mechanism.
Accuracy, robustness, cybersecurity	Provider	Art. 15	2 Dec 2027originally 2 Aug 2026	Accuracy and robustness benchmarks; adversarial or red team results; cybersecurity or penetration testing report; fallback plan; retest records after updates.
Conformity assessment and CE marking	Provider	Art. 43, 47	2 Dec 2027originally 2 Aug 2026	Completed conformity assessment file; signed EU Declaration of Conformity; CE marking; notified body certificate where the third-party route applies.
Deployer operational duties (seven sub-obligations)	Deployer	Art. 26	2 Dec 2027originally 2 Aug 2026	Deployment policy referencing provider instructions; named human overseer with training and authority; input data checks; incident log; log retention of at least six months; worker notice; EU database registration for public authorities. None delegable by contract.
Reclassification as provider	Deployer becomes provider	Art. 25	2 Dec 2027originally 2 Aug 2026	Change management policy that triggers a reclassification check before any significant modification; legal assessment that intended use stays within the original conformity scope. Fine-tuning, retrieval augmentation or rebranding can quietly trigger this.
Fundamental rights impact assessment	Deployer (public bodies and specified Annex III uses)	Art. 27	2 Dec 2027originally 2 Aug 2026	Completed FRIA per in-scope deployment; version history; evidence it was done before first deployment. National DPAs have signalled this is the first document they request.
Transparency to natural persons	Both	Art. 50	2 Aug 2026not deferred	A disclosure notice in every chatbot or agent interface; technical proof that AI generated outputs are watermarked or marked; a deepfake and synthetic media policy.
Post-market monitoring	Provider	Art. 72	2 Dec 2027originally 2 Aug 2026	Monitoring plan inside the Annex IV documentation; evidence data is collected on a schedule; records showing findings feed back into risk management.
Serious incident reporting	Provider reports; deployer notifies provider	Art. 73	2 Dec 2027originally 2 Aug 2026	Incident policy with an escalation path to the market surveillance authority; incident log assessed against the serious incident definition; notification within 15 days of establishing a causal link.
GPAI documentation and copyright	GPAI provider	Art. 53	2 Aug 2025	Annex XI technical documentation; Annex XII downstream package; copyright policy honouring the Directive (EU) 2019/790 opt-out; published training data summary; Code of Practice sign-on.
GPAI systemic risk duties	GPAI provider above 10^25 FLOPs	Art. 55	2 Aug 2025	Model evaluation with red team records; systemic risk assessment and mitigation plan; serious incident notifications to the AI Office; cybersecurity assessment for the model and its infrastructure.
Product liability (strict, no fault)	Manufacturers, importers, modifying deployers	Dir. 2024/2853	9 Dec 2026	Product safety documentation for every AI product; evidence security updates are planned and delivered; a retention policy keeping technical records for the duration of potential claims.

The penalty ladder, Article 99

Prohibited practices (Art. 5): up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
High-risk and GPAI obligation breaches, including Article 26 deployer duties: up to EUR 15 million or 3% of turnover.
Incorrect or misleading information to authorities or notified bodies: up to EUR 7.5 million or 1% of turnover.
Article 99(6) requires supervisors to set penalties with regard to the economic viability of SMEs and start-ups.

Where liability falls. When an output became a loss.

The AI Act allocates regulatory duties and creates no civil right of action. Civil liability runs through decided cases, national tort law and, from 9 December 2026, the revised Product Liability Directive. Three things define the terrain: cases that already turned an AI output into a financial loss, a strict liability instrument that reverses the burden of proof, and a value chain in which the injured party cannot tell who caused the harm.

2024 BCCRT 149 · 14 February 2024

Moffatt v. Air Canada

Air Canada's website chatbot told a bereaved customer he could claim a retroactive bereavement fare. The policy did not allow it. Air Canada argued the chatbot was a separate legal entity.

Holding. The British Columbia Civil Resolution Tribunal rejected the separate entity defence. An operator owes a duty of care for its chatbot's outputs and cannot make a consumer cross-check one part of a website against another. Award CAD 650.88 plus interest and fees. The loss was small; the principle is large.

No. 22-cv-1461 (S.D.N.Y.) · 22 June 2023

Mata v. Avianca

Two attorneys filed a brief citing six court decisions generated by ChatGPT. None existed, including the lead citation Varghese v. China South Airlines. When challenged, counsel affirmed the cases were real.

Holding. Judge P. Kevin Castel imposed USD 5,000 in sanctions and required corrective letters to every judge named in a fabricated opinion. AI tools are permissible, and the gatekeeping duty over accuracy stays with the professional. The canonical case of a hallucination causing professional harm.

No. 3:23-cv-00770 (N.D. Cal.) · in discovery

Mobley v. Workday

A class action alleging that Workday's AI applicant screening software discriminated by age, race and disability. In July 2024 the court let an agency theory claim against the AI vendor proceed; in May 2025 it certified a preliminary nationwide ADEA collective of applicants over 40 rejected since 24 September 2020.

Why it matters. There is no merits ruling yet, but the agency theory's survival means an AI vendor could bear direct liability for discriminatory outcomes across its whole customer base at once. This is the multi-client systemic loss insurers have yet to price.

Directive (EU) 2024/2853 · from 9 December 2026

The revised Product Liability Directive

Published on 18 November 2024, replacing the 1985 regime. Software, including SaaS and cloud AI, is explicitly a product. Strict liability applies, with no need to prove negligence.

The mechanism. Article 10 presumes a product defective where the operator fails to disclose evidence under Article 8, breaches mandatory safety rules, or where damage occurred during an obvious malfunction. Non-compliance with the AI Act triggers the regulatory breach presumption directly. Documentation becomes load bearing.

The liability chain

A deployed agent typically involves at least four parties. The Act decides who holds which documentation, and that documentation is what courts and insurers examine after an incident. The injured party usually cannot tell which link failed, and Article 25 lets the duty shift down the chain when a downstream party rebrands or substantially modifies a system.

Party	Role in the chain	Where the Act places it
Foundation model provider	Trains and publishes the base model. Contributes the core capability without controlling deployment, and may have no contract with the deployer.	GPAI: Art. 53, 55
Fine-tuner or integrator	Adapts the model through fine-tuning, retrieval pipelines or agentic scaffolding. Shapes behaviour, and may not be traceable to the end user.	May become provider: Art. 25
Deployer	Puts the system into use with real users and carries day to day responsibility. Controls the interface and the operational context.	Deployer duties: Art. 26
End user	The person or organisation that interacts with the system and sustains any harm, usually unable to identify which party caused the failure.	PLD claimant: Dir. 2024/2853

What the Act resolves

Which party keeps which documentation. The provider holds Articles 8 to 17, the deployer holds Article 26, and GPAI providers hold Articles 53 to 55. Article 25 moves the provider role to whoever rebrands or substantially modifies a high-risk system.

What it leaves open

It creates no direct civil right of action, does not apportion liability when several parties contributed, and sets no causation presumption. The proposed AI Liability Directive that would have done so was marked for withdrawal in the Commission's work programme of 11 February 2025 and formally withdrawn by a notice published on 6 October 2025. The Product Liability Directive and national tort law fill the space.

Seven dimensions of agent risk.

Compliance asks whether an organisation meets the Act. Insurability asks a narrower question: can this agent be left running without causing a loss, and is there evidence to prove it. Seven weighted dimensions answer it, each scored 0 to 10 and normalised to 100. The weights sit where AI incidents and accountability gaps cluster.

01
Trust and Safety
18
The measurable prevention of unsafe, unauthorised or harmful actions by the agent in production, and the discipline with which unsafe outputs are detected, contained and remediated.
02
Governance
16
The institutional scaffolding around the agent: known to the board, owned by a named senior role, policed by written policy, and logged in a way that survives an audit.
03
Context Integrity
14
The quality of the information the agent reasons over: provenance, freshness, lineage, and the controls that keep poisoned, stale or unauthorised data out of the retrieval pipeline.
04
Product Maturity
14
How far the agent behaves as a production system rather than a prototype: reliability, regression discipline, evaluation coverage, and the practices that keep behaviour predictable over time.
05
Autonomy Envelope
14
The written boundary between what the agent may do without human confirmation and what needs a person in the loop. The clearest single determinant of operational risk, and the first thing insurers and regulators examine.
06
Distribution Control
12
Who can invoke the agent, under what authority, and how its downstream actions are bounded. Where identity, authorisation and blast radius meet.
07
AI Integration
12
How the agent sits inside the organisation's systems of record, identity, approval and escalation: whether it extends institutional memory or bypasses it.

What each dimension asks to see

The failure modes that dominate each dimension, the single artefact that proves it is controlled, and the article it relates to most.

Trust and Safety

Failure modes. Model content filters mistaken for organisation level guardrails. Red team exercises run once at launch with no cadence. Kill switches that need an engineer to trigger, useless in a time critical event.

Evidence. A dated red team report tracked to a remediation register, with a verified kill switch access record showing non-engineering staff can trigger it.

Article. Art. 15, with Art. 9 and Art. 14 close behind.

Governance

Failure modes. Accountability assigned to the team that built the agent rather than a senior business owner. A generic AI risk policy that never addresses autonomous behaviour. Audit trails that capture outputs but not the reasoning steps.

Evidence. Board or risk committee minutes from the prior twelve months referencing the agent, with a risk register extract showing it as a live entry with a named owner.

Article. Art. 9, with Art. 27 and Art. 12 supporting. This is the dimension that decides whether a claim is defensible.

Context Integrity

Failure modes. Retrieval pipelines that do not record document origin, so an erroneous output cannot be attributed. Live sources with no freshness checks. User supplied context passed into retrieval without sanitisation, enabling indirect prompt injection.

Evidence. An end to end data lineage diagram from source to reasoning output, under version control, with evidence of automated staleness alerting in production.

Article. Art. 10, data and data governance. The hidden liability line: the loss carries no obvious failure signal.

Product Maturity

Failure modes. Prompts left unversioned while code is versioned, so the most consequential variable is uncontrolled. Regression suites that test only the happy path. Provider model upgrades applied automatically with no regression run on the operator's side.

Evidence. A version history for prompts, model configuration and tool definitions with change attribution, and a regression suite that runs on every change.

Article. Art. 15, with Art. 12 supporting. The drift line: the system at claim is not the system at bind.

Autonomy Envelope

Failure modes. An autonomy policy written so abstractly it does not map to the agent's tools and cannot be enforced. Human in the loop thresholds set for convenience rather than impact. Revocation that needs engineering access during an out of hours incident.

Evidence. A written Autonomy Envelope policy classifying every action class as fully autonomous, threshold gated or permanently prohibited, with technical enforcement, a tested rollback and a dated quarterly sign-off.

Article. Art. 14, with Art. 26 supporting. This dimension gives an underwriter probable maximum loss, the precondition for writing the line.

Distribution Control

Failure modes. API keys shared across callers, so misuse cannot be attributed to a person. Development instances wired to production level tool access. Blast radius assessed in theory and never tested against what the tools actually do.

Evidence. A per tool blast radius assessment with maximum impact quantified, backed by role based access control mapped to the identity provider and per caller spend and quota limits.

Article. Art. 26, obligations of deployers. Severity is bounded only by the most consequential tool the agent can reach.

AI Integration

Failure modes. Agent actions written to a proprietary log the compliance function cannot reach. Escalations routed to generic inboxes with no named owner. Identity that collapses at the API boundary, so every downstream system sees one service account.

Evidence. An audit trail extract from a real agent initiated action showing end to end attribution, with agent identity, timestamp and provenance, held in the organisation's central observability stack.

Article. Art. 14, with Art. 26 supporting. The attribution line: no evidence trail, no defence.

Below 20

Pre Assessment

Decline for now. The gap analysis is the roadmap.

20 to 34

In Progress

Referral: defer the decision rather than decline.

35 to 54

Certified

Standard terms with conditions.

55 to 74

Advanced

Standard acceptance.

75 to 100

Elite

Preferred risk.

The floor rule is the insurability mechanism. A tier also sets a minimum raw score on every dimension: Certified needs 4 on each, Advanced 6, Elite 8. An average can hide a hole. An agent scoring 70 overall but 3 on Distribution Control has an open blast radius the headline conceals, and the floor rule caps it below the tier its average suggests until the hole is closed. For an underwriter the tier is a pre-triaged risk: it confirms no single dimension sits in the red. The Autonomy Envelope further separates two agents with the same score, because it sets probable maximum loss. These tiers structure a conversation with a carrier. They are no binding rate, eligibility rule or commitment by any insurer.

The European insurance market and the gap.

The category did not exist as a standalone product before 2024. Between July 2025 and February 2026 the US and Canadian market built certification and insurance stacks, and the first live AI agent policy was announced in February 2026. Cover reaches European buyers through Lloyd's and Munich Re, yet no European-native product, built within the EU regulatory and legal context, exists.

What exists in the market

Artificial Intelligence Underwriting Company (AIUC) and AIUC-1. AIUC emerged from stealth in July 2025 with a USD 15 million seed round led by Nat Friedman, with Emergence, Terrain and an Anthropic co-founder also investing. AIUC-1 is its security, safety and reliability standard for AI agents: 51 requirements, 130 controls, six pillars. Certificates last twelve months with at least quarterly testing, and Schellman is the first accredited auditor.US-built.
ElevenLabs took the first AIUC-1 backed AI agent insurance policy in February 2026, after more than 5,000 adversarial simulations.The first live AI agent policy.
Armilla, a Lloyd's coverholder and the first dedicated exclusively to AI liability (2024), launched Affirmative AI Liability Insurance with Lloyd's underwriter Chaucer on 30 April 2025. Its Standalone AI Liability Policy carries limits of up to USD 25 million per organisation. A partnership with Trustible, announced on 8 October 2025, combines governance with cover.Reaches Europe through Lloyd's brokers.
Munich Re aiSure was announced with Mosaic Insurance on 26 February 2026, with an initial capacity of EUR, USD or CAD 15 million. It settles on measurable performance data, without a negligence finding.Reinsurer capacity behind the category.

What Europe still lacks

A European-native certification body that works as an insurance underwriting partner. AIUC-1 has no legal or regulatory relationship with EU institutions.The standards layer is American.
ISO/IEC 42001:2023 is a management system standard, certifiable by bodies such as TÜV, DNV and BSI. It describes how an organisation manages AI. It does not assess agent behaviour, produces no adversarial test results and carries no insurer relationship.Process, without behaviour or cover.
The EU AI Act creates obligations and requires conformity assessment for certain high-risk categories, but creates no certification body with insurance relationships. For most high-risk AI, self-assessment against harmonised standards is permitted.Obligations, without an insurance bridge.
Allianz, AXA and Zurich had announced no standalone AI liability product as of June 2026.The largest European carriers are absent.
The EIOPA Opinion on AI governance and risk management of 6 August 2025 reads AI into Solvency II and the Insurance Distribution Directive for insurers using AI. It is interpretive guidance and creates no new rules.A supervisory expectation, without a product.

The gap, stated plainly. A European business deploying AI agents has no certification pathway that assesses actual agent behaviour under adversarial conditions, turns that into evidence an insurer can price, and is built within the EU regulatory and legal context. AIUC-1 does the first two for US deployments. ISO 42001 does neither, and neither does the AI Act. There is no European actuarial table for agent failure yet, which is why a seven dimension evidence base matters: each scored agent adds a row of structured European deployment data that a US-built model lacks.

What readiness looks like

The same documents do three jobs.

Readiness is a set of artefacts. Together they satisfy the AI Act obligations on the calendar, form the factual record that rebuts a presumption of defect under the Product Liability Directive, and give an underwriter the evidence to price a policy. Building them is the work.

Request an assessment Start a conversation

01
Know your role, and where it can shiftEstablish whether each system makes you a provider or a deployer, and run an Article 25 check before any fine-tuning, retrieval augmentation or rebranding that could reclassify you. The duties you carry depend on the answer.
02
Hold the evidence each article calls forA risk register, Annex IV documentation, instructions for use, a named human overseer with authority to halt, logs retained for at least six months, and a fundamental rights impact assessment where Article 27 applies.
03
Score the agent against the seven dimensionsTested guardrails and a verified kill switch, data lineage, prompt and model versioning, a quantified blast radius, a named owner with board awareness, an end to end audit trail, and a written Autonomy Envelope enforced in code. The score names the gaps and the path to close them.

The questions people and assistants ask.

Each answer stands on its own and cites the article or instrument.

When does the EU AI Act apply to AI agents?

Regulation (EU) 2024/1689 applies in stages. Article 5 prohibited practices and Article 4 AI literacy have applied since 2 February 2025. Article 53 and Article 55 general purpose AI obligations have applied since 2 August 2025. Article 50 transparency to natural persons has applied since 2 August 2026 and was not deferred. The Annex III high-risk obligations (Articles 9 to 15, 26 and 27) carried an original date of 2 August 2026. The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved them to 2 December 2027, and moved the Annex I high-risk obligations to 2 August 2028.

Can a company be held liable for what its AI agent says?

Yes. In Moffatt v. Air Canada (2024 BCCRT 149, 14 February 2024) the British Columbia Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation by its website chatbot and rejected the argument that the chatbot was a separate legal entity. The principle that an operator cannot disclaim its AI's outputs maps onto the deployer duties in Article 26 of the EU AI Act and onto strict liability under the revised Product Liability Directive from 9 December 2026.

What is the difference between a provider and a deployer under the EU AI Act?

A provider develops an AI system and places it on the market or puts it into service under its own name. Providers of high-risk systems carry Articles 8 to 17: risk management, data governance, technical documentation, logging, human oversight design, accuracy and a quality management system. A deployer uses an AI system under its own authority in a professional context. Deployers carry Article 26: use within instructions, named human oversight, input data checks, log retention for at least six months, and serious incident reporting. Under Article 25 a deployer that rebrands, substantially modifies or repurposes a system into a high-risk use case becomes a provider and assumes the full provider stack.

Does the revised Product Liability Directive cover AI software?

Yes. Directive (EU) 2024/2853 applies from 9 December 2026 and explicitly treats software, including SaaS and cloud AI, as a product subject to strict liability. The claimant does not need to prove negligence. Under Article 10 a rebuttable presumption of defect applies where the defendant fails to disclose evidence under Article 8, where the product breaches mandatory safety rules, or where damage occurred during an obvious malfunction. Expanded damage categories include destruction or corruption of data and medically recognised psychological harm.

What are the penalties under the EU AI Act?

Article 99 sets three tiers. Breach of the Article 5 prohibited practices carries up to EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher. Breach of high-risk and general purpose AI obligations, including Article 26 deployer duties, carries up to EUR 15 million or 3 percent of turnover. Supplying incorrect or misleading information to authorities carries up to EUR 7.5 million or 1 percent of turnover. Article 99(6) requires supervisors to set penalties with regard to the economic viability of SMEs and start-ups.

Is there AI liability insurance available in Europe?

Coverage reaches European buyers but no European-native product exists. ElevenLabs took the first AIUC-1 backed AI agent policy in February 2026. Armilla, a Lloyd's of London coverholder, writes affirmative AI liability insurance with limits up to USD 25 million per organisation, underwritten by certain underwriters at Lloyd's. Munich Re aiSure, announced with Mosaic Insurance on 26 February 2026, provides an initial capacity of EUR, USD or CAD 15 million and settles on measurable performance data. AIUC-1 is US-built, ISO/IEC 42001 is a management system standard with no insurer link, and the EU AI Act creates obligations but no certification body with insurance relationships. Allianz, AXA and Zurich had announced no standalone AI liability product as of June 2026.

Do I have to tell people they are talking to an AI?

Yes, since 2 August 2026. Article 50 of the EU AI Act requires deployers of chatbots and conversational AI to disclose to natural persons, clearly and distinguishably, that they are interacting with an AI system unless it is obvious from the context. Providers generating synthetic content must mark outputs as machine-readable or watermark them where technically feasible; for systems placed on the market before 2 August 2026 that marking duty applies from 2 December 2026. Article 50 was not deferred by the Digital Omnibus.

What is a fundamental rights impact assessment and who must do one?

A fundamental rights impact assessment (FRIA) is required under Article 27 before first deployment of certain high-risk systems. It binds public bodies, private operators providing public services, and deployers of systems in Annex III points 1, 2, 3, 5(a), 6, 7 and 8. It describes the use case, the people affected, the specific risks, the human oversight measures and a mitigation plan. It is a living document, and several national data protection authorities have signalled it is the first document they will request in an enforcement inquiry.

Which EU country is furthest ahead on AI Act enforcement?

Italy and Germany have enacted their implementing laws. Italy's Law No. 132/2025 of 23 September 2025, in force since 10 October 2025, designates AgID as notifying authority and ACN as market surveillance authority and single point of contact. Germany's KI-MIG has been in force since 29 July 2026, with the Bundesnetzagentur as market surveillance authority, contact point and complaints body. The Netherlands put a draft implementing bill to consultation from 20 April to 1 June 2026. France had not formally designated an authority as of June 2026; the designation provisions were withdrawn from the DDADUE bill before Parliament.

How do you measure whether an AI agent is safe enough to insure?

The agent risk taxonomy used here scores seven weighted dimensions out of 100: Trust and Safety (18), Governance (16), Context Integrity (14), Product Maturity (14), Autonomy Envelope (14), Distribution Control (12) and AI Integration (12). Each dimension is scored 0 to 10 against named evidence artefacts, such as a dated red team report, a data lineage diagram, or a written Autonomy Envelope policy enforced in code. A floor rule caps a lopsided agent below the tier its average suggests, so no single dimension can sit unaddressed. The Autonomy Envelope is the closest available proxy for probable maximum loss, the figure an underwriter needs before writing a policy.

References and instruments

EU AI Act. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. OJ L, 12 July 2024. Articles 4, 5, 9 to 15, 25, 26, 27, 43, 47, 50, 53, 55, 72, 73, 99.
Revised Product Liability Directive. Directive (EU) 2024/2853. Published 18 November 2024. Applies to products placed on the market after 9 December 2026. Articles 8 and 10 (disclosure and presumption of defect).
Digital Omnibus on AI. Regulation (EU) 2026/1744. Political agreement 7 May 2026, Council final approval 29 June 2026, in force 27 July 2026. Annex III high-risk obligations move to 2 December 2027 and Annex I to 2 August 2028.
GPAI Code of Practice. AI Office, final text published 10 July 2025. Three chapters: transparency, copyright, and safety and security.
EIOPA Opinion on AI governance and risk management. 6 August 2025. Supervisory guidance for insurers using AI.
ISO/IEC 42001:2023. AI management system requirements. Published December 2023.
NIST AI Risk Management Framework 1.0. NIST AI 100-1, January 2023. Functions: Govern, Map, Measure, Manage.
NIST AI 600-1, Generative AI Profile. July 2024.
Moffatt v. Air Canada. 2024 BCCRT 149, British Columbia Civil Resolution Tribunal, 14 February 2024.
Mata v. Avianca, Inc. No. 22-cv-1461 (PKC), United States District Court for the Southern District of New York, 22 June 2023.
Mobley v. Workday, Inc. No. 3:23-cv-00770 (N.D. Cal.). Agency theory claim allowed July 2024; preliminary ADEA collective certified 16 May 2025; in discovery as of June 2026.
Italy, Law No. 132/2025. Of 23 September 2025, in force 10 October 2025. Designates AgID (notifying authority) and ACN (market surveillance authority and single point of contact).
Germany, KI-MIG. In force 29 July 2026. The Bundesnetzagentur is market surveillance authority, contact point and complaints body.
AIUC-1 and ElevenLabs. First AIUC-1 backed AI agent policy, February 2026, after more than 5,000 adversarial simulations. Schellman is the first accredited AIUC-1 auditor.
Armilla. Lloyd's coverholder dedicated exclusively to AI liability. Affirmative AI Liability Insurance launched with Chaucer, 30 April 2025, underwritten by certain underwriters at Lloyd's. Standalone AI Liability Policy, limits up to USD 25 million per organisation. Trustible partnership, 8 October 2025.
Munich Re aiSure. Mosaic Insurance partnership, 26 February 2026. Initial capacity of EUR, USD or CAD 15 million, settling on measurable performance data.
Withdrawn AI Liability Directive. COM/2022/496. Marked for withdrawal in COM(2025)45 of 11 February 2025; withdrawal notice published 6 October 2025.

Frequency and severity intuitions in the taxonomy are qualitative priors rather than actuarial rates; no European actuarial table for autonomous agent failure exists yet. The full numbered reference list is in sources.md, and the structured records are in the dataset.