LexLint

The terms the agents documents use, on two pages: the law first, then the agent and its words. Every term links to the page that discusses it or to its entry in the glossary, on this page and in the PDF alike. Download the two-page PDF →

LexLint Version 1.13 · 2026-09-20 Two-page PDF

AI Agents and the Law

Page 1 of 2: the law, and whom it binds

lexlint.org/agents/cheatsheet

Every term is a link to the page that defines it.

1LawHow law is put together

Instrument One statute, regulation, directive or binding guidance document, with its citation, status and date.Jurisdiction A body of law together with the authorities and courts that apply it. A cloud region is not one.In force The status of a duty that binds today. Enacted means it is coming; proposed means it may never arrive.Regulation or directive In the EU a regulation applies directly in every member state; a directive is transposed into each state's own law.Extraterritorial reach How far a law binds parties outside its territory, by the market a system is sold in and where its output is used.Private right of action A private party's statutory right to sue for a breach, beside enforcement by a public body.

2SoftwareThe law that already bound software

Personal data Any information relating to an identified or identifiable person, location, identifiers and inferences included.Impact assessment A written assessment of a processing operation's risks to the people whose data it uses, made before it starts.Automated decision-making A decision about a person made by a system without meaningful human involvement, with legal or similar effects.Text and data mining Automated analysis of text or data, model training included. Lawful without a licence only under an exception.Age assurance Establishing that a user is above or below an age, by declaration, estimation or verification.

3Software lawWhom the statutes bind

MAKER makes it DISTRIBUTOR distributes it OPERATOR runs it OVERSEER oversees it USER uses it COUNTERPARTY it talks to

Provider AI Act Develops an AI system or model and places it on the market under its own name.MAKER Importer, distributor AI Act The parties that bring a system into a market or make it available there, with narrower duties than a provider.DISTRIBUTOR Deployer AI Act, state acts Uses an AI system under its own authority.OPERATOR Controller privacy law Decides why and how personal data is processed, and carries most of the privacy duties.OPERATOR Processor privacy law Processes personal data on a controller's instructions, with its own narrower duties.OPERATOR Data subject privacy law The person the personal data is about, and the holder of the rights over it.USER Rightsholder copyright law The owner of rights in content a system reads, reuses or trains on.COUNTERPARTY Competent authority every regime The government body empowered to enforce an instrument in a jurisdiction.OVERSEER

LexLint Version 1.13 · 2026-09-20 Two-page PDF

AI Agents and the Law

Page 2 of 2: the agent, and the words everyone needs

lexlint.org/agents/cheatsheet

Every term is a link to the page that defines it.

4AIWhat the AI laws ask

Tell the person it is a machineMark what the machine madeTier by risk, with a prohibited topKeep a person able to interveneKeep records, and be able to explainAssign duties by role along a chainReach by market and by outputCommence in stages, and change in flightHigh-risk AI system The EU AI Act's class for AI used in listed areas such as hiring, credit, education and policing. The heaviest duties.Prohibited practice A use an AI act bans outright, the top tier of a risk-tiered law.General-purpose AI A model that can serve many different tasks, such as a large language model. Its provider owes duties of its own.

Who the law reaches through

Six parties stand around any software; an agent acts on most of them at once.

MAKER makes itthe developer or publisher, the model provider, upstream suppliers, open-source projects DISTRIBUTOR distributes itthe store or marketplace, the importer, the reseller, the integrator OPERATOR runs itthe operator, a self-hosting customer, hosting and cloud, the services on the request path

AGENTsoftware that pursues a goal by choosing and taking actions through tools, across more than one step, with limited human intervention between the steps

OVERSEER oversees itregulators and courts, auditors, standards bodies, platform rule-setters USER uses itthe user as principal, the affected person, the data subject, a minor COUNTERPARTY it talks tothe sites and interfaces it reads, the recipients it writes to, rightsholders, other users and devices

5AgentsThe words for agentic systems

Agent Software that pursues a goal by choosing and taking actions through tools, across more than one step.Harness The software control layer between a model and the outside world. It runs the loop, connects tools, keeps state, records.Delegation Granting an agent authority to act on behalf of a person, an organisation or a system, within a stated scope.Human in the loop, on the loop In the loop, a person must act before the agent proceeds. On the loop, a person watches and may act.Kill switch A control that lets a person halt an agent at once, whatever it is doing.Autonomy level How much an agent may do without a person approving it, from suggesting an action to taking it alone.MCP Model Context Protocol, the open standard agents use to discover and call external tools.

6IncidentsWhen something goes wrong: the clocks

Breach and incident An incident compromises a system's confidentiality, integrity or availability. A breach is the subset that exposes personal data.Reporting clock A deadline a statute starts when an incident or a breach is detected or known, to a regulator or to the people affected.Rung One deadline on a staged ladder. Security clocks mostly run an early warning, then a notification, then a final report.