The EU AI Act is not a data-privacy law wearing an AI costume — it's a product-safety framework that sorts AI systems into risk tiers and attaches obligations to each tier. If you're bolting an LLM agent onto Acumatica for AP coding, HR screening, or credit decisions, and any of your users or affected individuals are in the EU, the tier your use case lands in determines whether you need a light disclosure notice or a full conformity assessment. This is a plain walk through the tiers and where a typical ERP agent falls.
The four risk tiers
The Act defines four tiers. Unacceptable risk practices are banned outright — things like social scoring of individuals by public authorities and AI systems that use manipulative subliminal techniques to materially distort behavior in a way that causes harm. Almost no legitimate ERP feature lands here; it exists mainly to rule out a narrow set of practices, not to worry a finance team.
High-risk is the tier that matters for ERP work. It covers systems listed in the Act's Annex III categories, which include AI used in employment and worker management (screening or evaluating candidates, making decisions about promotion or termination) and AI used to evaluate creditworthiness. An AI agent that screens resumes, ranks candidates, or scores an applicant before a human sees them is squarely high-risk. So is an agent that produces a credit or payment-terms recommendation that's treated as decisive rather than advisory.
Limited risk covers systems that carry transparency obligations rather than a full compliance program — chiefly, telling people they're interacting with an AI system. A chatbot embedded in a customer portal, or an internal assistant answering "what's my PO status," typically sits here: disclose that it's AI, and you've met the bar. Minimal risk is everything else — most internal productivity tooling, spell-check-style assistance, and low-stakes automation — with no Act-specific obligations attached.
Mapping common ERP agent use cases to tiers
| Use case | Likely tier | Why |
|---|---|---|
| AP invoice coding assistant (suggests GL codes, human approves) | Minimal / limited | Advisory only, human makes the actual decision, no Annex III category applies |
| Resume screening / candidate ranking agent | High-risk | Falls under the employment/worker-management Annex III category |
| Customer support chatbot inside the ERP portal | Limited risk | Transparency obligation — disclose it's an AI system |
| Credit limit / payment terms scoring agent | High-risk | Falls under the creditworthiness Annex III category |
| Internal report-writing or summarization assistant | Minimal risk | No Annex III category, no manipulation risk |
What high-risk actually requires
If your agent lands in a high-risk category, the obligations are substantive and mostly fall on the provider (whoever develops or puts the AI system on the market) rather than the deployer (the company using it) — though deployers carry real obligations too, like ensuring human oversight in practice and monitoring the system's operation. The core requirements: a documented risk management system covering the system's lifecycle, data governance practices for training and input data, technical documentation describing how the system works, logging sufficient to trace the system's decisions after the fact, human oversight designed into the workflow (not just a theoretical "a human could override this"), and a conformity assessment before the system is placed on the market. If you're building the resume-screening agent in-house on top of Acumatica's HR module, you may be acting as both provider and deployer, which means both sets of obligations land on you.
Regulators and guidance around the Act are consistently skeptical of oversight that's nominal — a human who rubber-stamps 200 AI-ranked candidates a day without a realistic ability to catch errors doesn't satisfy the intent of the requirement. Oversight has to be structured so a person can meaningfully intervene, which usually means smaller review batches, visible confidence signals, and time to actually look.
The phased timeline
The Act entered into force in August 2024. The bans on unacceptable-risk practices became applicable in February 2025. Obligations for general-purpose AI models (the GPAI rules that affect foundation-model providers like the ones your agent is built on) became applicable in August 2025. Most of the high-risk system obligations become applicable in August 2026, with some Annex III categories on a slightly later timeline. If you're scoping a high-risk ERP agent today, August 2026 is the date to build backward from, not a future problem — technical documentation and risk management processes take real time to stand up.
Practical first steps for an ERP agent project
Before writing any prompt, classify the use case against Annex III honestly — "it's just a suggestion" doesn't move a resume-screening tool out of high-risk if its output materially influences who gets an interview. If you land in limited risk, build the AI-disclosure into the UI now; it's cheap and there's no reason to wait. If you land in high-risk, start the risk management documentation and logging design at the same time as the agent architecture, not after — retrofitting audit trails onto an agent that was never designed to log its reasoning is far more expensive than building it in from the start.
Wrapping up
Most ERP AI agent work — invoice coding assistants, report summarizers, internal chat interfaces — sits in minimal or limited risk and needs little beyond honest disclosure. The exceptions are real, though: anything touching hiring decisions or creditworthiness scoring is high-risk under the Act's own Annex III categories, and the obligations that come with that tier are substantial enough to affect your architecture, not just your paperwork. Classify early, and build logging and human oversight into the design rather than bolting them on before the 2026 deadline.
Independent software engineer in Nairobi specialising in Acumatica customisations, Laravel backends, and tax fiscalisation integrations across East and Southern Africa.