Last quarter your IT-Automation team finished documenting Acme.HelpdeskAgent v1.0, model, tools, memory, identity, guardrails, in the system card from lesson 027. This quarter your AI Officer faces a different question: how does Article 27 of Regulation (EU) 2024/1689 apply to an agent rather than a static-model deployment? A standard hiring-AI FRIA (lesson 045) walks Article 27(1)(a)-(f) for a system that scores, ranks, and outputs. An agent does that plus invokes tools under a service-account identity, retains memory across sessions, operates at some autonomy tier, and carries a kill-switch the human oversight regime must be able to pull. The harm surface is not the same as a static model. The Charter rights at risk are not the same. The Article 14 oversight design is not the same. The Article 73 incident playbook is not the same. This lesson is the agentic-FRIA worked example for Acme.HelpdeskAgent v1.0: seven Article 27(1)(a)-(f) sections layered with autonomy-tier per action class, tool allowlists by sensitivity, memory-hygiene policy under MITRE ATLAS Memory Manipulation and AI Agent Context Poisoning, kill-switch design under Article 14, and the consent and identity model under GDPR. By the end you can produce the L3 deliverable: an Article 27 FRIA on a deployed agent that satisfies Articles 27 + 14 + 26 + 73, the OWASP Agentic Top 10 (ASI01-ASI10), MITRE ATLAS v5.4.0 agentic techniques, NIST's emerging AI Agent Interoperability Profile, CAISI's Feb 17, 2026 Agent Standards Initiative, ISO 42001 A.6 + A.8, and GDPR Article 22 + Article 35 simultaneously.

Why Agentic Systems Need an FRIA Variant - Five Layers, Five New Charter Exposures

Article 27 was drafted for a world where a deployer takes a high-risk system off the shelf and the harm surface is the system's output: a score, a ranking, a classification. The lesson 045 hiring FRIA is the modal example: Article 21 disparate-impact interrogates the score; Article 14 oversight is a recruiter reviewing before any candidate-facing action.

An agent breaks the shape. The lesson 027 system-card decomposition, model, tools, memory, identity, guardrails, matters because each layer carries its own fundamental-rights surface. The model layer inherits upstream Charter exposures (Article 21 from training data; Article 1 from refusal patterns). The tool layer adds Article 8 personal-data exposures on every read of identifying data, Article 41 good-administration exposures on every write affecting an individual. The memory layer adds Article 8 cross-session-leakage, Article 21 disparate-impact from memory-conditioned outputs, and a new Article 47 effective-remedy exposure when poisoning persists past the moment of complaint. The identity layer adds Article 8 attribution exposures when the agent acts under a service-account the affected person cannot trace, Article 41 when the affected person cannot tell which actor caused the decision. The guardrail layer is the locus of the deployer's mitigation duty under Articles 14, 15, and 16: kill-switch, tool-call validation, refusal logging, rate limits.

The 2026 agentic-risk taxonomies make these exposures concrete. The OWASP Agentic Top 10 (ASI01-ASI10): Goal Hijack (ASI01), Tool/Function Abuse (ASI02), Identity and Privilege Abuse (ASI03), Resource Manipulation (ASI04), Supply-Chain Compromise (ASI05), Memory Poisoning (ASI06), Inter-Agent Spoofing (ASI07), Repudiation and Untraceability (ASI08), Human-Agent Trust Exploitation (ASI09), Rogue Agents (ASI10). MITRE ATLAS v5.4.0 names the techniques: AI Agent Context Poisoning, Memory Manipulation, Thread Injection, Modify AI Agent Configuration, RAG Credential Harvesting, Publish Poisoned AI Agent Tool, Escape to Host. NIST's AI Agent Interoperability Profile (Q4 2026 planned) and CAISI's Feb 17, 2026 Agent Standards Initiative are converging on a common vocabulary for agent oversight, identity, memory, and tool-allowlist governance. Article 27(1)(a)-(f) remains the regulator's seven slots, but each is filled with agentic-specific content.

When is the agentic FRIA mandatory? Same triggers as the static-model FRIA: public-law body OR private operator providing public services, AND Annex III high-risk; OR Annex III §5(b) creditworthiness or §5(c) life-and-health insurance pricing; OR (after Omnibus VII Dec 2, 2027) any Annex III stand-alone deployment. Acme.HelpdeskAgent v1.0 is limited-risk (Article 50(1) employee-facing chatbot) so not statutorily required, Acme produces it anyway because it bids on public-sector group-insurance contracts and the audit committee set a "FRIA-for-all-agents" policy. Voluntary in form, operationally identical to the statutory version.

Section 1 - Description (Article 27(1)(a))

Article 27(1)(a) requires "a description of the deployer's processes in which the high-risk AI system will be used in line with its intended purpose." The agentic FRIA fills this with five sub-sections, agent identity, tool list with sensitivity tiers, memory architecture, identity model, autonomy tier per action class, the anchor for every subsequent agentic risk analysis.

Agent identity. Acme.HelpdeskAgent v1.0 (instance ACME-HDA-EU-2026-001). Operator: Acme IT-Automation Engineering. Compliance owner: Acme AI Officer. Population: ~12,000 EU employees across 14 countries, ~5,000 monthly users; downstream effects on contractors (~3,000) and customers (indirectly). Model: Anthropic Claude 4 Sonnet (no fine-tuning; no Article 25(1)(b) transfer; Acme remains deployer). Go-live April 1, 2026; current release v1.0.3 (May 10, 2026); persistent memory added in v1.0.2 (April 22, 2026), the modification that re-triggers FRIA review.

Tool list with sensitivity tiers. Each tool classified into one of four tiers by data and action surface:

• Tier R (read-only, low sensitivity)-internal_kb.search (~5,000 KB articles); microsoft_graph.read_calendar (requesting user's own free/busy, OAuth-on-behalf-of-user); microsoft_graph.read_mailbox_metadata (requesting user's own metadata only). Acceptable for Tier 3 ACT autonomy.
• Tier W-B (write-bounded, medium sensitivity)-servicenow.read_ticket (relationship-scoped); servicenow.create_ticket (standard categories only, 10/min/user); servicenow.update_ticket (agent-originated or assigned only, full diff retained). Tier 2 CONFIRM for non-standard categories; Tier 3 ACT for standard low-impact creation.
• Tier W-Br (write-broad, high sensitivity)-active_directory.read_user_attrs (relationship-scoped to requesting user + manager + direct reports; service account in principle can read any attributes, the principle-vs-practice gap that the blast-radius calculation must bound). Tier 2 CONFIRM for any attribute beyond the requesting user.
• Tier R-X (restricted, critical sensitivity)-active_directory.reset_password (requesting user's own account only, MFA second-factor gate, 3 calls/day/user, privileged service account). Tier 1 SUGGEST or Tier 2 CONFIRM only, never Tier 3 ACT, never Tier 4 AUTONOMOUS.

Two tools deliberately absent: browser.navigate (provisioned in v1.0.0, removed in v1.0.3 after a Q1 2026 red-team finding that prompt-injection in fetched pages could escalate; re-enablement gated on browser-sandbox hardening planned for Q3 2026), and code_interpreter (never provisioned; reduces ASI02 Tool/Function Abuse surface, ASI10 Rogue Agent execution paths, and MITRE ATLAS Escape to Host attack surface). Regulator and auditor questions on "why did you not provision X" require a deliberate-decision answer.

Memory architecture. Three layers, each with hygiene policy. Short-term context (Claude 4 Sonnet 200K tokens, per-conversation, flushed at session end). Persistent per-user memory (Acme-hosted Qdrant vector store keyed by employee ID; preferred contact channel, recent ticket categories, prior agent-resolution acceptance/rejection; 90-day rolling retention; GDPR Article 17 deletion and Article 15 access via privacy portal). Organization-wide summary cache (read-mostly cache of recently-resolved KB-article summaries; nightly refresh from IT-Automation pipeline; writes only from the authorized pipeline, not from agent runtime, the primary ASI06 Memory Poisoning defense). Per-user writes provenance-tagged (interaction, time, service-account context); nightly cross-user-pattern detector; nightly integrity check on summary cache (hash vs source-of-truth KB).

Identity and consent model. Two service accounts. svc-helpdesk-agent-readonly handles Tier R and reads of Tier W-B. svc-helpdesk-agent-privileged handles writes of Tier W-B, all of Tier W-Br and Tier R-X. Credentials rotated every 30 days; access logged to SIEM with tamper-evident storage. OAuth-on-behalf-of-user delegated-permission flow for Microsoft Graph; user consent recorded at first use with timestamp + UI version; revocable via Microsoft Account portal with revocation flowing back to agent. Article 50(1) chatbot disclosure + scope-of-tools statement at session start; consent reaffirmed annually. Every tool call traceable to (employee user) × (agent service account) × (tool) × (timestamp).

Autonomy tier per action class. Tier 1 SUGGEST for password reset (default; rare). Tier 2 CONFIRM for password reset (when MFA gate fires), access-request ticket creation. Tier 3 ACT for standard low-impact ticket creation (under $500 procurement; user can cancel within 5 minutes), KB lookup with answer presentation. No Tier 4 AUTONOMOUS actions in v1.0.3.

Period and frequency (Article 27(1)(b)). 24/7/365 since April 1, 2026. Monthly maintenance Sunday 02:00-06:00 UTC (standard ServiceNow portal handles requests). ~5,000 invocations/day; peak ~600/hour Monday-morning password-reset surges; up to 10 tool calls per invocation (typical 2-4). Aggregate ~20,000 tool calls/day, ~7M/year. Short-term context flushed at session end; per-user memory 90-day rolling; summary cache nightly. A complaint on day 30 about a day-1 interaction can still recover per-user memory state (per-user log retained 10 years per Article 18; the 90-day window applies to active memory, not the audit log). 10-year audit window for every tool call, memory write, refusal, confirmation-gate firing.

FRIA refresh cadence. Quarterly review covers tool-call analytics, memory-hygiene check results, refusal-pattern review, autonomy-tier analytics, OWASP/ATLAS reassessment. Annual full refresh (April 1). Triggered refresh within 30 days for tool catalog change, memory architecture change, base-model version change, service-account scope change, autonomy-tier upgrade, OWASP/ATLAS technique addition, red-team finding, Article 14 oversight-design change, ASI01-ASI10 exposure change.

Section 3 - Categories of Affected Persons (Article 27(1)(c))

Article 27(1)(c) covers "the categories of natural persons and groups likely to be affected." The agentic FRIA adds a category the static-model FRIA rarely needs, downstream-of-action populations affected when agent-triggered tool calls produce second-order effects.

Primary: internal employees (~50,000 globally; ~12,000 in EU scope). ~48% female, 52% male; 32% age 22-34, 38% age 35-49, 30% age 50+; disability self-identification ~7%. IT interactions (password resets, software-access provisioning, ticket handling) mean Article 8 personal data and Article 41 good administration dominate over Article 21 non-discrimination (no candidate-selection).

Intersectional categories. Employees with disabilities depending on consistent agent behavior for assistive-tech integration; older employees (50+) warranting Article 26(3) competence design with accessible human-reviewer handoff; protected-leave statuses (parental, sick, sabbatical) whose persistent-memory entries may need quarantine on return; whistleblower-protected employees (agent never accesses HR-investigation or whistleblower-channel tickets, deliberate tool-catalog exclusion).

Secondary: contractors and third-party workers (~3,000 with AD presence). Same tool surface as employees with shorter retention. Agent's per-user memory does not differentiate employee vs contractor; Article 27(1)(c) considers the contractor population not implicitly disadvantaged.

Tertiary: downstream customers. ~8% of helpdesk tickets concern access provisioning to customer-facing systems. The agent never directly interacts with customers, but its tool calls affect customer-facing system availability, Article 41 good administration applies indirectly.

Worker representation (Article 26(7)). Acme consulted the EU Works Council (March 2026); German Betriebsrat, Dutch OR, Spanish comité de empresa briefed on agentic specifics: service-account-attributed actions, persistent memory, autonomy tiers, kill-switch. Works-council minutes (Appendix C-1) reference the autonomy-tier table; the works-council specifically requested clarity on the Tier R-X password-reset constraint and the kill-switch authority chain.

Vulnerable categories per expected AI Office Article 27(1)(c) guidance. (i) protected-leave employees whose persistent-memory entries may need quarantine on return; (ii) employees in identified-victim categories under Acme's anti-discrimination policy (the agent operates with no awareness, by design); (iii) employees in ongoing HR investigations (mitigated by tool-allowlist restrictions); (iv) cross-border roles where work-permit status interacts with access-provisioning (the agent never reads work-permit status; delegated to a human HR workflow).

Section 4, Specific Risks (Article 27(1)(d)), Agentic Risk Surface

Article 27(1)(d) adds OWASP Agentic Top 10 (ASI01-ASI10) and MITRE ATLAS technique mappings alongside Charter articles.

ASI01 Agent Goal Hijack - Charter Article 8 + Article 41. Prompt-injection redirecting agent goal. Inherent likelihood HIGH (any free-text input); inherent consequence MEDIUM-HIGH (depending on tier reached). Mitigations: input-validation prompt-injection filter at session boundary; tool-call parameter validation; refusal-training inheritance from Claude 4; per-tool rate limits; confirmation gates for Tier W-Br and Tier R-X; aggregate per-session limit (50 calls). Residual: novel injection vectors. Risk: inherent 16/25, residual 6/25.

ASI02 Tool/Function Abuse - Charter Article 8 + Article 41. Agent invokes tools beyond intended scope, including chaining. Inherent MEDIUM/MEDIUM-HIGH. Mitigations: sensitivity-tier classification; per-tool scope narrowing; least-privilege two-tier service accounts; rate limits; aggregate per-session limit; browser tool removed in v1.0.3; code interpreter never provisioned. Residual: complex tool-chaining edges. Risk: inherent 12/25, residual 4/25.

ASI03 Identity and Privilege Abuse - Charter Article 8 + Article 41. Service-account credentials misused via compromise or hijack-then-action. Inherent MEDIUM/HIGH (password-reset capability on 12,000 employees in principle). Mitigations: two-tier service accounts; 30-day rotation; SIEM logging with tamper-evident storage; confirmation gates on Tier W-Br and Tier R-X; OAuth-on-behalf-of-user for personal-data access; circuit-breaker on anomalous rate. Residual: insider with SIEM access. Risk: inherent 15/25, residual 5/25.

ASI06 Memory Poisoning - Charter Article 8 + Article 41 + Article 47. The agentic-FRIA risk with no static-model equivalent. Adversarial memory injection persisting across sessions. MITRE ATLAS Memory Manipulation and AI Agent Context Poisoning are the precise techniques. Inherent MEDIUM (persistent memory layer); inherent consequence HIGH (poisoned memory affects future sessions; Article 47 effective-remedy exposure when poisoning persists past the moment of complaint). Mitigations: per-user writes provenance-tagged at write; organization-wide cache writes only from authorized pipeline (runtime-write prohibition); nightly integrity check on summary cache; nightly cross-user-pattern detector; memory-quarantine procedure on detection. Residual: subtle memory drift. Risk: inherent 12/25, residual 4/25.

ASI07 Inter-Agent Spoofing - Charter Article 8 + Article 41. Multi-agent contexts where one agent impersonates another. Inherent LOW (single-agent deployment in v1.0.3; no multi-agent orchestration). Mitigations: agent identity authenticated at downstream tool calls; no agent-to-agent channel; service-account scoping. Risk: inherent 4/25, residual 2/25. Flagged for re-assessment if multi-agent orchestration is added.

ASI10 Rogue Agent Action - Charter Article 1 + Article 8 + Article 41 + Article 47. Agent acting outside policy envelope, most severe is unauthorized deployment of an additional agent under similar service-account scope; most likely is drift from documented action set due to base-model behavior change or guardrail bypass. Inherent LOW/HIGH (Article 1 dignity violation when agent acts in dehumanizing ways; Article 47 exposure when action is unattributable). Mitigations: agent identity bound to two service accounts; non-attributable activity triggers incident response; circuit-breaker on error rate; emergency kill-switch. Risk: inherent 10/25, residual 3/25.

MITRE ATLAS technique-specific risks. AI Agent Context Poisoning (covered in ASI01). Memory Manipulation (covered in ASI06). Thread Injection (session-boundary input validation; per-session rate limits; session-context flush at end). Modify AI Agent Configuration (agent prompt + tool catalog under version control; config-change-management approval; integrity attestation on startup). RAG Credential Harvesting (KB-content scanning for embedded credentials at CI gate; retrieval-output secrets-detection filter). Publish Poisoned AI Agent Tool (allowlist; no runtime tool registration; quarterly dependency review; CycloneDX 1.7 ML-BoM line-item review). Escape to Host (tools in dedicated sandboxed processes; no code interpreter; browser removed).

Charter rights summary. Article 1 dignity: risk of dehumanizing automated treatment; mitigated by Article 50(1) disclosure, named-human-handoff, transparency. Inherent 8/25, residual 3/25. Article 8 personal data: comprehensive exposure across employee personal data, memory contents, service-account-attributed actions; mitigated by least-privilege service accounts, OAuth-on-behalf-of-user, memory-hygiene policy, GDPR Article 15 + Article 17 + Article 22. Inherent 15/25, residual 5/25. Article 21 non-discrimination, limited applicability (no candidate-selection), but residual exposure in protected-leave/HR-investigation handling; mitigated by tool-allowlist exclusion. Inherent 6/25, residual 2/25. Article 41 good administration: right to processing within reasonable time (response within 90 seconds read, 5 minutes write with confirmation gates), fair process (oversight), right to know reasons (Article 50(1) + agent-confidence display + recourse). Inherent 12/25, residual 4/25. Article 47 effective remedy: complaint channel, investigation, remediation; memory-poisoning incident creates unique Article 47 exposure mitigated by memory-quarantine. Inherent 8/25, residual 3/25.

Section 5, Human Oversight (Article 27(1)(e) and Article 14), Autonomy Tiers and Kill-Switch

Article 27(1)(e) and Article 14 require effective oversight by natural persons. The agentic FRIA adds three structural elements: autonomy-tier control matrix per action class, tool-allowlist sensitivity-tier policy, kill-switch design that survives the day-night boundary.

Autonomy-tier per action class.

• Tier 1 SUGGEST, Agent proposes; human executes. 100% human action; agent text reviewed before any side effect. Application: default for sensitive actions including password-reset that does not survive MFA, Tier W-Br on attributes beyond requesting user, any Tier R-X. Article 14(4)(d) override: trivial.
• Tier 2 CONFIRM, Agent prepares; human approves single step; agent executes. Pre-action review by named human; confirmation evidence in audit log. Application: password reset after MFA gate fires, access-request ticket creation, ServiceNow update for non-standard category. Article 14(4)(d) override: explicit confirmation step.
• Tier 3 ACT, Agent executes within bounded budget with rate limits + blast-radius cap + kill-switch. Post-action sample review (5% within 24 hours by Tier 2 helpdesk reviewer); pattern-deviation triggers investigation; aggregate per-day cap (max 50 standard tickets agent-wide before circuit-breaker). Application: standard ticket creation under $500, KB lookup with answer presentation, ServiceNow read for relationship-scoped tickets. Article 14(4)(d) override: 5-minute cancellation plus kill-switch.
• Tier 4 AUTONOMOUS: Agent acts in policy envelope with ephemeral credentials, async approval, hard kill-switch. No Tier 4 actions in v1.0.3. Q3 2026 candidate: routine ticket-status updates after fully-deterministic resolution, gated on Article 14 oversight-design review and FRIA refresh.

Tool allowlists by sensitivity tier. Tier R may operate at Tier 3 ACT with post-action sample review. Tier W-B operates at Tier 3 ACT for standard low-impact actions but Tier 2 CONFIRM for non-standard categories. Tier W-Br operates at Tier 2 CONFIRM for any attribute beyond the requesting user. Tier R-X operates at Tier 1 SUGGEST or Tier 2 CONFIRM only, never higher. Enforced at the agent runtime by tool-call validation and at the platform layer by SIEM correlation (any tool call at unauthorized tier triggers immediate incident response).

Memory hygiene policy. Three elements operationalize Article 14 oversight of memory:

• Encryption at rest. Per-user memory and organization-wide cache encrypted with Acme-managed keys (KMIP-compliant). Quarterly key rotation. Access logged.
• Access control. Per-user memory accessible only to (a) agent runtime at session start, (b) user's privacy-portal flow for GDPR Article 15 access and Article 17 erasure, (c) IT-Automation team for incident investigation with audit-committee approval. Organization-wide cache accessible only to (a) agent runtime at retrieval, (b) IT-Automation pipeline for nightly refresh, (c) IT-Automation team for integrity-check operations.
• Periodic purge and provenance attestation. Nightly purge of per-user entries beyond 90-day rolling window; nightly hash comparison of organization-wide cache against source-of-truth KB; nightly cross-user-pattern detector. Memory-quarantine on detection: affected partition frozen, immutable snapshot captured, runtime configured to operate without the partition pending investigation. Provenance-attestation log retained 10 years per Article 18.

Kill-switch design (Article 14(4)(e)). Three trigger conditions: (i) operator trigger, Chief AI Officer, IT-Automation Engineering Lead, or designated on-call engineer initiates on identified anomaly or serious incident; (ii) circuit-breaker trigger, automated firing on any of (a) rate-limit breach by ≥3× normal, (b) output-pattern alert from SIEM (refusal-pattern anomaly, novel injection-signature), (c) tool-call validation failure rate >1% sustained over 15 minutes, (d) memory-poisoning detection from nightly integrity check; (iii) regulator-or-vendor trigger, Anthropic notification of a base-model issue, or market-surveillance instruction. Action: both service accounts revoked within 5 minutes via AD; in-progress invocations terminated; persistent-memory writes paused; user-facing message displayed; incident response paged. Tested quarterly with full revocation-and-restore drill; logged for Article 14 evidence; reviewed at AI Governance Committee quarterly review.

Consent and identity under GDPR. Article 22 applies to "decision based solely on automated processing"; the agent's actions are not solely automated because (a) Tier 1 SUGGEST and Tier 2 CONFIRM involve human action, (b) Tier 3 ACT actions are reversible within 5 minutes and subject to post-action sample review. Article 35 DPIA applies; the persistent-memory layer triggers Article 35 because of cross-session-leakage risk; cross-referenced in Appendix B aligned with the FRIA section-by-section. Consent: Article 50(1) chatbot disclosure at session start; explicit consent for OAuth-on-behalf-of-user at first use; reaffirmed annually; revocation via Microsoft Account portal flows back to agent. Identity: every tool call attributable to (user) × (agent service account) × (tool) × (timestamp); attribution log retained 10 years per Article 18.

Article 14(4)(a)-(e) capabilities mapping. (a) understand capacities and limitations, Article 26(3) reviewer training 4 hours initial + 1 hour quarterly refresh + quarterly tabletop; (b) avoid automation bias, post-action sample review scrutinizes both agent action and reviewer engagement; (c) correctly interpret output, dashboard displays confidence score, top-3 contributing features, tool-call audit trail; (d) decide to disregard, override or reverse, 5-minute cancellation window for Tier 3 ACT; reviewer override with full logging; (e) intervene or interrupt via stop button, kill-switch above.

Article 26(4) effectiveness monitoring. Per-quarter, sample-review false-negative rate (target <2%); kill-switch test successful within 5 minutes (target 100%); memory-quarantine successful (target zero poisoning incidents reaching production; quarantine drill once per quarter); MFA-gate bypass attempts (target zero); rate-limit breach frequency (target <0.1% of sessions); tool-call validation failure rate (target <0.5% of calls). Reported to AI Governance Committee.

Section 6, Measures If Risks Materialize (Article 27(1)(f)), Incident Response, Rollback, Memory Quarantine

Article 27(1)(f) covers "measures... in the case of materialization of those risks, including internal governance and complaint mechanisms." The agentic FRIA adds three runbook elements: tool-revocation pathway, memory-quarantine procedure, autonomy-tier-rollback decision tree.

Incident classification. Four agent-specific classes (lesson 027 §12), each with detection trigger, initial response, and 72-hour Article 73 assessment. Rogue-action, agent executes outside expected scope; revoke privileged service account; freeze readonly write paths; preserve logs. Tool-abuse, tool calls indicate compromise or misuse; disable affected tool; rotate credentials; preserve logs. Memory-poisoning, provenance mismatch or integrity-check failure; flush affected partitions; restore from authorized-pipeline snapshot; investigate write-path compromise. Identity-abuse, service account used outside legitimate agent runtime; rotate credentials; investigate compromise vector; freeze agent until cleared.

Tool-revocation pathway. Three steps: (i) disable at agent runtime, tool removed from active allowlist; runtime refuses with graceful error; SIEM alert verified no further calls succeed; (ii) revoke at platform layer, service-account permission for the tool revoked at the downstream system (ServiceNow, Active Directory, Microsoft Graph) so a hypothetical bypass cannot succeed; (iii) announce and document, Communications notified for any externally-visible impact; incident-log entry with rationale, rollback timeline, re-enablement criteria. The browser tool removal in v1.0.3 followed this pathway.

Memory-quarantine procedure. Four steps: (i) freeze affected partition, runtime configured to operate without the affected per-user memory or organization-wide cache partition; immutable snapshot captured; (ii) forensic analysis, Security and IT-Automation teams trace the write path; analysis covers per-user provenance log for the interaction window and the organization-wide cache write log for the affected entries; (iii) restore from authorized snapshot, partition restored from most-recent authorized-pipeline snapshot; gap between snapshot time and incident time documented for GDPR Article 33 + Article 34 affected-user notification if personal data was compromised; (iv) memory-write-path hardening, identified vector remediated; runtime-write prohibition reinforced; provenance-tagging logic updated.

Autonomy-tier rollback decision tree. When investigation indicates the autonomy-tier authorization for an action class was too aggressive: (i) identify affected action class; (ii) roll back the tier, e.g., Tier 3 ACT downgraded to Tier 2 CONFIRM; runtime configuration updated; change committed to version control with change-management approval; (iii) communicate to affected users, user-facing message at next session announces the additional confirmation step; reviewers briefed on increased throughput; (iv) monitor for stabilization, 30-day observation window with daily metrics review; Article 26(4) metrics tracked; (v) re-elevate if appropriate, at 90 days, if metrics support, tier may be re-elevated with documented rationale and FRIA-refresh acknowledgement.

Article 73 serious-incident reporting. Primary obligation on the provider; Acme as deployer notifies Anthropic within 24 hours of any incident potentially attributable to base-model behavior, plus Acme's Article 26(5) deployer-side reporting. Article 73 triggers in the agentic context: confirmed identity-abuse on the privileged service account at material scale; confirmed memory-poisoning affecting multiple users; algorithmic action materially affecting an identifiable protected-class population (rare here, possible). Timing: 15 days standard; immediate for life-threatening or critical-infrastructure. Policy in Appendix A.

Internal governance. AI Governance Committee chaired by Chief AI Officer; members: VP IT Ops, IT-Automation Lead, CPO, CISO, General Counsel, AI Officer rep, external agent-security consultant (advisory). Monthly standing; ad hoc on incident. Quarterly briefing to Board Risk Committee; annual to full Board. Article 26(7) worker-representative consultation maintained.

Affected-employee complaint channel (Article 27(1)(f) + 27(3)). Acme publishes the internal pathway at https://intranet.acme.example.com/agent-complaints: (i) what employees can complain about, failed password reset, incorrect ticket created on their behalf, misrepresenting persistent-memory entry, data-handling concern; (ii) how to file, web form, email [email protected], or via standard helpdesk escalation; (iii) Acme's commitment to acknowledge within 3 business days and respond within 14 calendar days; (iv) right to escalate to the Irish Data Protection Commission (and equivalent national DPAs); (v) right to seek effective remedy under Charter Article 47. Investigation: Acme Agent Complaints Team (2 FTE in AI Officer team) triages within 3 business days. Four categories: information request (Article 86 right-to-explanation; 7-business-day response with tool-call audit trail and relevant per-user memory contents); action complaint (escalates to senior reviewer; 14-business-day response with remediation menu); memory complaint (memory-quarantine if poisoning suspected; otherwise GDPR Article 16 rectification or Article 17 erasure); data complaint (routed to DPO; standard GDPR Article 12-22 response). Remediation menu: re-execution by human reviewer; compensation for direct out-of-pocket costs; memory correction; policy correction (autonomy-tier rollback, tool-revocation, oversight-design enhancement); for confirmed memory-poisoning affecting a cohort, Section 6 quarantine engages and affected employees are informed of corrective action and GDPR Article 33 + Article 34 breach notification if personal data was compromised. Article 18 retention 10 years across tool-call logs, per-user memory provenance, refusal logs, confirmation-gate firing records, kill-switch trigger and test records, complaint records, FRIA refresh records. Article 27(3) notification to the Member State market surveillance authority on substantial modification: v1.0.2 persistent-memory addition triggered notification May 1, 2026; v1.0.3 browser-tool removal triggered notification May 12, 2026. Future triggers: Tier 4 AUTONOMOUS upgrade for any class; multi-agent orchestration; base-model change beyond Anthropic minor release. Receiving-authority acknowledgments retained per Article 18.

Cross-Walks - Six Frameworks, One Agentic FRIA

The Acme.HelpdeskAgent v1.0 agentic FRIA serves multiple frameworks simultaneously:

• EU AI Act, Article 27 (full); Article 27(3) notification; Article 14 (oversight; autonomy tier; kill-switch; Article 14(4)(a)-(e) capabilities); Article 26 (deployer obligations; Article 26(3) competence; Article 26(4) effectiveness; Article 26(5) serious-incident; Article 26(7) worker-representative); Article 50(1) (chatbot disclosure); Article 73 (serious-incident; Anthropic vendor-side coordination); Article 18 (retention).
• OWASP Agentic Top 10 (ASI01-ASI10): Section 4 enumerates each applicable ASI with Charter-article mapping, inherent and residual risk scores, and mitigation evidence.
• MITRE ATLAS v5.4.0, AI Agent Context Poisoning (Section 4 + Section 5 hygiene); Memory Manipulation (Section 4 + Section 6 quarantine); Thread Injection (Section 4 input validation); Modify AI Agent Configuration (Section 4 config management); RAG Credential Harvesting (Section 4 KB scanning); Publish Poisoned AI Agent Tool (Section 4 tool catalog); Escape to Host (Section 4 sandboxing).
• NIST AI Agent Interoperability Profile (Q4 2026 planned), autonomy-tier (Section 1 + 5); identity-and-consent (Section 1 + 5); tool-allowlist (Section 1 + 5); memory-hygiene (Section 1 + 5 + 6). FRIA refresh aligns on profile publication.
• CAISI Agent Standards Initiative (Feb 17, 2026), agent-oversight common-vocabulary; agent-identity standard; tool-allowlist standard. Acme participates in the CAISI working group.
• ISO/IEC 42001:2023, A.6.1.1 impact assessment; A.6.2 impact criteria; A.6.4 post-deployment monitoring; A.7 data governance; A.8 information for users (Article 50 + consent + employee-facing summary); A.10 third-party (Anthropic + Qdrant + ServiceNow + Microsoft).
• GDPR, Article 22 (not solely automated because of Tier 1/Tier 2 design); Article 35 DPIA (cross-referenced section-by-section; Appendix B); Article 15 (per-user memory and tool-call audit-trail disclosure); Article 17 (per-user memory deletion); Article 16 (memory correction); Article 33 + Article 34 (breach notification).

One agentic FRIA, seven framework windows, the L3 cross-walk exemplar for agent deployments.

Six common mistakes. (1) Treating the agentic FRIA the same as a static-model FRIA: section structure is unchanged but each section's content differs materially; Sections 1, 4, and 5 must include the agentic-specific elements above. (2) Missing the autonomy-tier control matrix: "the agent has a kill-switch" is not a matrix; enumerate every action class and assign Tier 1 SUGGEST / Tier 2 CONFIRM / Tier 3 ACT / Tier 4 AUTONOMOUS with oversight measure, rate-limit and blast-radius cap, ephemeral-credential and async-approval design. (3) Weak memory-hygiene policy: without encryption with managed keys, access control with audit-committee-approved investigation pathway, periodic purge with provenance attestation, and memory-quarantine procedure, ASI06, MITRE ATLAS Memory Manipulation, and AI Agent Context Poisoning are unmitigated, and GDPR Article 15 + Article 17 + Article 16 rights unsupported. (4) Missing tool-allowlist sensitivity tiers, the four-tier classification (R / W-B / W-Br / R-X) anchors the autonomy-tier matrix; without it the matrix has no anchor. (5) Weak kill-switch design: three-trigger model (operator, circuit-breaker, regulator-or-vendor), 5-minute revocation target, quarterly test cadence with logged evidence. (6) Static agentic FRIA without quarterly + triggered refresh on tool catalog change, memory architecture change, base-model version change, service-account scope change, autonomy-tier upgrade, OWASP/ATLAS technique addition, red-team finding, Article 14 oversight-design change, standards-body publication; the Article 27(3) notification register must reflect the refresh history.

Key Takeaways

• Agentic systems need an FRIA variant. The Article 27 section structure is unchanged (27(1)(a)-(f) plus 27(3) notification) but each section is filled with agentic-specific content: tool list with sensitivity tiers, memory architecture with hygiene policy, identity model with service-account boundaries, autonomy tier per action class, kill-switch design, OWASP Agentic Top 10 and MITRE ATLAS technique coverage.
• Section 1 must enumerate five sub-sections. Agent identity; tool list with sensitivity tiers (R / W-B / W-Br / R-X); memory architecture (short-term + persistent per-user + organization-wide cache with provenance tagging); identity and consent model (two-tier service accounts + OAuth + Article 50 disclosure); autonomy tier per action class (Tier 1 SUGGEST / Tier 2 CONFIRM / Tier 3 ACT / Tier 4 AUTONOMOUS).
• Section 4 maps OWASP Agentic Top 10 + MITRE ATLAS to Charter articles. ASI01 Goal Hijack → Article 8 + 41; ASI02 Tool/Function Abuse → Article 8 + 41; ASI03 Identity/Privilege Abuse → Article 8 + 41; ASI06 Memory Poisoning → Article 8 + 41 + 47; ASI07 Inter-Agent Spoofing → Article 8 + 41; ASI10 Rogue Agents → Article 1 + 8 + 41 + 47. MITRE ATLAS techniques (Context Poisoning, Memory Manipulation, Thread Injection, Modify Config, RAG Credential Harvesting, Publish Poisoned Tool, Escape to Host) covered with detection + mitigation.
• Section 5 integrates autonomy-tier matrix, tool-allowlist tiers, memory hygiene, kill-switch. Each tier with explicit oversight measure; tool allowlist enforced at runtime + platform layer; memory hygiene three elements (encryption, access control, periodic purge with provenance attestation); kill-switch three triggers + 5-minute revocation target + quarterly test cadence.
• Section 6 adds tool-revocation pathway, memory-quarantine procedure, autonomy-tier rollback decision tree. Three runbook elements the static-model FRIA does not require; each with operational steps and incident-response integration.
• Section 7 affected-employee complaint channel + Article 27(3) notification on substantial modification. Four complaint categories (information, action, memory, data); GDPR Article 15/16/17 integration; Article 18 retention 10 years across tool calls, memory provenance, refusals, gates, kill-switch trigger and test, complaint records, FRIA refresh.
• One agentic FRIA, seven framework windows. EU AI Act Article 27 + Article 14 + Article 26 + Article 73; OWASP Agentic Top 10; MITRE ATLAS v5.4.0; NIST AI Agent Interoperability Profile; CAISI Agent Standards Initiative; ISO 42001 A.6 + A.8; GDPR Article 22 + Article 35.
• Six mistakes to avoid. Treating agentic FRIA same as static-model FRIA; missing autonomy-tier control matrix per action class; weak memory-hygiene policy; missing tool-allowlist sensitivity tiers; weak kill-switch design; static FRIA without quarterly refresh.
• The agentic FRIA is a living document. Quarterly refresh + triggered refresh on tool catalog change, memory architecture change, base-model version change, service-account scope change, autonomy-tier upgrade, OWASP/ATLAS technique addition, red-team finding, Article 14 oversight-design change, standards-body publication. Article 27(3) notification register tracks refresh history.