The EU AI Act Now Applies to Your Agentforce Agents: The Transparency Work That Cannot Wait

Your service agent opened four thousand conversations last month with "Hi, I'm Max. How can I help?" Not one of those customers was told they were talking to software. Since 2 August 2026 that greeting is a compliance problem in every EU member state, and the fix is a text field on the agent detail page that somebody filled in during a demo and never touched again.

That is the shape of most EU AI Act exposure in a Salesforce org right now. Not a conformity assessment. Not a technical file. A sentence.

What turned on this month, and what got pushed to 2027

Two things happened nine days apart, and mixing them up is how teams end up doing the wrong work.

The Digital Omnibus on AI, formally Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It is the first amendment to the AI Act since the original regulation passed in 2024, and it moved fast on purpose: three days from publication to force, so the amended timeline was settled before the Act's general application date arrived.

What it moved:

• Stand-alone high-risk systems under Annex III went from 2 August 2026 to 2 December 2027.
• High-risk AI acting as a safety component in a regulated product under Annex I went to 2 August 2028.
• The machine-readable marking of synthetic content got a grace period for systems already on the market before 2 August 2026, which now runs to 2 December 2026.

What it did not move: Article 50 transparency. That applied on schedule on 2 August 2026, and the deferral covers Chapter III obligations only. Article 50 sits outside Chapter III, so nothing about the Omnibus buys you time on it.

The penalty tier matters for how hard you argue this internally. Breaches of Article 50 sit in the second band of Article 99: up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher, with the lower of the two applying to SMEs. That is not the headline 7% number reserved for prohibited practices, and it is still enough to get a budget line.

So the live compliance surface for a normal Agentforce deployment in the EU today is transparency and AI literacy. Conformity assessments, risk management systems, and technical documentation belong to a deadline in December 2027, and only if your agent is actually high risk. More on that below, because most are not.

Provider, deployer, and the part the contract does not settle

Salesforce is the provider of Agentforce. You are the deployer. Salesforce says this plainly in its own AI Act guidance, and the split is the right starting point for a legal review.

It is also where the useful work stops being legal work.

Article 50(1) is drafted at providers: an AI system intended to interact directly with people has to be designed so those people are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed person. Salesforce holds up its half by shipping the mechanism. The welcome message field exists. The progress indicator exists. Both ship empty, and an empty disclosure informs nobody.

Article 50(4) is drafted at deployers, which is you, and covers two things: deepfake content, and AI-generated text published to inform the public on matters of public interest.

Article 25 is the clause people reach for next, the one that turns a deployer into a provider when they put their own name or trademark on a system or substantially modify it. Read it carefully before you build a policy around it: it applies to high-risk systems, and high-risk is the tier that just moved to 2027. For a branded customer service agent it is not your live problem this quarter.

Here is the practical version. A market surveillance authority responding to a complaint does not open with a question about your contract with Salesforce. It opens with a transcript and asks whether the person on the other end knew. Your answer is whatever you typed into the welcome message field.

The disclosure, and where it actually lives in Setup

The welcome message sits on the agent detail page for an Agentforce for Service agent, capped at 800 characters. Salesforce documents making it dynamic with {!$Context.serviceAgentPrompt} so a service campaign can pass in its own opener, with a Flow formula supplying a fallback when the variable is blank. That fallback is the one that bites. The stock example reads "I'm here to assist you with any queries you might have", which says nothing about being AI, and it is exactly the branch that fires when a campaign variable is empty at two in the morning.

Article 50(5) sets the standard for how the information lands: clear, distinguishable, delivered at the latest at the time of the first interaction, and meeting accessibility requirements. Three practical consequences.

The disclosure goes in the first turn, not in a policy link. A privacy notice at the bottom of the chat window is not first-interaction disclosure.

One sentence does three jobs. It identifies the agent as AI, states what it can do, and gives an exit to a person. "Hi, I'm Max, an AI assistant for Acme. I can check an order, start a return, or update a delivery address. Ask for a person any time and I'll bring one in." That is disclosure, scope, and human oversight in 34 words, and it reads better than what most orgs have now.

Every channel needs its own answer. A voice agent has to say it out loud in the opening turn, because there is no window to read. In a third-party messaging channel through Bring Your Own Channel, Salesforce exposes a setting to show the Agentforce agent progress indicator so a user can see an agent is engaged; wire it, because the visual cue your web deployment relies on does not travel to WhatsApp on its own. And when a conversation escalates through Omni-Channel to a human and later routes back to an agent, that return trip needs a fresh disclosure. Nobody remembers who they were talking to twelve minutes ago.

One more, because it comes up in every review and the answer surprises people: internal agents count. Your employees are natural persons. Article 50(1) has no carve-out for staff-facing systems, so the HR agent in Slack needs the same first-turn line as the customer one.

The clause everyone over-reads

Article 50(4) says deployers of a system that generates or manipulates text published with the purpose of informing the public on matters of public interest have to disclose that the text was artificially generated. There is an exemption where the content went through human review and a person or organisation holds editorial responsibility for it.

Every quarter somebody reads that and proposes stamping "generated with AI" on every email that Prompt Builder touched. Do not do this. A promotional email about a summer sale is not text published to inform the public on matters of public interest, and a disclosure attached to everything trains people to read none of it.

Where the clause does land: public sector bodies publishing guidance, health and insurance organisations running advisory content, utilities posting outage and safety information, anyone whose Salesforce-generated text is doing a public information job. If that is you, the exemption is the cheaper path. Route generative drafts through a named reviewer, record the review, and hold editorial responsibility explicitly. That is a Flow approval step and a field on the content record, and it is less work than maintaining disclosure markup across every publishing surface you own.

Machine-readable marking of synthetic output under Article 50(2) is the provider's obligation, and the Omnibus gave systems already on the market until 2 December 2026 to meet it. That one is a question for your account team rather than a task for your admin: ask what marking Salesforce applies to generated content, and get the answer in writing before December.

Evidence, and why the audit trail is worth turning on anyway

Nothing in Article 50 tells you to keep logs. The record-keeping and automatic logging duties live in Chapter III with the high-risk rules, which is exactly the block that just moved to December 2027.

Turn the logging on anyway, because "we updated the welcome message in April" is not evidence and a regulator is not obliged to take your word for it.

In Setup, under Einstein Feedback, switch on Collect and Store Einstein Generative AI Audit Data. Records start landing in Data Cloud within about 24 hours, in a documented set of data model objects: GenAIGatewayRequest__dlm for the inbound request, GenAIGatewayResponse__dlm and GenAIGeneration__dlm for what came back, GenAIContentCategory__dlm for safety scores across eight categories including toxicity, hate, violence, and bias, and GenAIFeedback__dlm with GenAIFeedbackDetail__dlm for what users did with the output. You query them with SQL in the Data Cloud Query Editor.

Be honest about what that gives you. The Einstein Trust Layer audit data proves what the model was asked, what it answered, how the masking and toxicity scoring behaved, and how people reacted. It does not prove a customer saw a disclosure. The message transcript on the Messaging Session does that. Two stores, two retention settings, and the pair is only useful when both cover the same window. Set Data Cloud retention deliberately instead of discovering the default the week you need a record from eleven months ago. If you want the full picture of what that layer does and does not intercept, the Einstein Trust Layer guide covers the prompt path end to end, and the Agentforce observability guide covers what you can see once agents are running at volume.

The line that has been hard since February 2025

Everything above is a schedule. Article 5 is not. The prohibited practices have applied since 2 February 2025, they carry the top penalty band of up to €35 million or 7% of worldwide turnover, and no part of the Omnibus touched them.

Two entries on that list are reachable from an ordinary Salesforce roadmap.

Inferring emotions of workers. Article 5 bans AI systems used to infer emotions of a natural person in the workplace and in education, outside narrow medical and safety exceptions. Sentiment scoring on customer conversations is not what that clause is aimed at. Sentiment scoring turned on your own service reps, feeding a coaching dashboard or a performance conversation, walks straight into it. The feature is the same feature. The difference is who is being scored, and that difference is the whole prohibition. If a supervisor dashboard in your org ranks agents by an emotional state the model inferred, that is a conversation for this week, not for 2027.

Social scoring. Also banned: evaluating or classifying people over time based on social behaviour or personal characteristics in a way that leads to detrimental treatment in contexts unrelated to where the data was collected. A customer health score built from support behaviour and used to set service levels is normal commercial segmentation. The same score reused to deny someone access to an unrelated service starts to look like the thing the clause describes.

Where emotion recognition is permitted, Article 50(3) adds a deployer duty on top: inform the people exposed to it, and handle the personal data under GDPR. That one lands on you, not on Salesforce, and it applies now.

Human oversight is deferred, not cancelled

Article 14 human oversight and the rest of the high-risk requirements now bite on 2 December 2027 for Annex III systems. Before you file that under "next year's problem", settle whether any of your agents are Annex III at all.

Most are not. A service agent that checks order status, books an appointment, or answers a product question is limited risk, and transparency is the whole of your obligation. Annex III is a specific list, and the entries that catch Salesforce builds are employment and worker management, including systems used to screen or filter job applications, creditworthiness evaluation for natural persons, and access to essential public and private services. If somebody in your org has built an agent that ranks applicants against a role, pre-scores a credit application, or triages eligibility for a benefit, December 2027 is a build deadline, not a filing deadline, and the work in front of it is eighteen months of design.

For everything else, build the escalation path now for the ordinary reason that it makes the agent better. An escalation action that hands off to a queue through Omni-Channel, a rule for what the agent does when it cannot ground an answer, and a regression suite in Agentforce Testing Center that runs before every release. When the high-risk rules do land on whatever you build in 2027, the org that already has those three has a starting point instead of a project.

The obligation that has been live since February 2025

Article 4 has applied since 2 February 2025 and almost nobody in the Salesforce ecosystem has actioned it. Providers and deployers must ensure a sufficient level of AI literacy among staff and anyone else operating the systems on their behalf. It applies at every risk tier, including minimal risk, and it reaches contractors and service providers, not just employees.

There is no direct fine attached. There is liability exposure when an untrained person causes harm with a system you deployed, and it is the first question an authority asks when it wants to know whether you took your obligations seriously.

Make it role-based and make it recorded. A service rep who accepts or edits agent responses needs to know what grounding is and when to distrust an answer. An admin building topics and actions needs a level above that. The training itself is not exotic, and Trailhead covers most of it. The part orgs skip is the record: who completed what, when, mapped to the roles that touch AI. A report on a custom object beats a shared drive full of certificates.

Data residency answers a different question

Somebody will close the AI Act ticket by citing the Hyperforce EU Operating Zone. It is a good control and it answers the wrong question. EU OZ addresses where data is stored and processed, with in-region support and data protection commitments. Those are GDPR and residency answers. The AI Act asks whether the person knew they were talking to a machine, whether staff are trained, and whether generated public-interest text is marked. A perfect residency posture moves none of those. Keep the two threads separate on your compliance tracker, because merging them is how the transparency item quietly stops being tracked. The same discipline shows up in the Well-Architected guidance for Agentforce, where trust controls and regulatory controls are deliberately separate lenses.

The next four weeks

The whole programme is smaller than the legal briefings suggest, and it is almost entirely configuration rather than development. The expensive version of this work is the one you do in November 2027 after a complaint, when the same fixes come with a regulator attached.

Open Setup, find every Agentforce agent that talks to anyone in the EU, and read its welcome message and its blank-variable fallback out loud. If either one fails to say the word AI in the first sentence, you have found this week's work, and it is a text field.

About the Author

Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He writes and edits salesforcedictionary.com, published by KineticBit Inc., to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.