July 20, 2026
The EU AI Act and autonomous spending: what companies need to log
The EU AI Act phases in through 2026 and 2027, and one of its recurring demands is that organisations deploying autonomous systems must be able to show human oversight and traceability. For AI agents that move money, this is not abstract: an agent initiated payment is exactly the kind of real world action where after the fact reconstruction must be possible.
“High-risk agentic systems with untraceable behavioral drift cannot currently satisfy the AI Act's essential requirements.”
EU AI Act, the phase in at a glance
The AI Act enters into force.
Prohibited practices apply.
Obligations for general purpose AI models apply.
The broad set of obligations applies, including for high risk systems under Annex III.
The three questions an auditor will ask
Who authorised this behaviour, what did the system decide, and can anyone have changed the record afterwards? Mapped to spending agents, that means: the mandate with its human SCA signature, the policy decision for every request including declines, and an append only log, ideally hash chained, that makes silent rewriting detectable. If those three answers exist as exportable data, most of the oversight conversation becomes short.
Log declines, not only payments
A subtle point that separates good implementations: the payments that did not happen are as important as the ones that did. A declined request documents that the control system worked, and a pattern of declines documents drift in an agent's behaviour before it becomes damage. Systems that log only successes throw away the evidence that regulators, and frankly operators, care about most.
Compliance as a by product
The practical recommendation is to build the audit trail as the spine of the product rather than as a reporting feature bolted on later. When every intent, decision and execution flows through one append only log with mandate references, AI Act documentation becomes an export button. That is the difference between compliance as a project and compliance as a by product of good architecture.