What to check before your AI agent goes live in the EU

Special category data under Art. 9(1) includes: racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data on sex life/sexual orientation. If your agent's prompts or CRM fields could ever capture this incidentally (e.g. a free-text "tell us about your situation" field in a healthcare-adjacent use case), that needs its own review.

Which basis fits depends on the specific purpose: responding to an inbound sales inquiry often rests on steps-to-a-contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)); unsolicited cold outreach typically needs a stronger justification and is where legitimate-interest assessments matter most. Document the reasoning per processing activity — don't apply one basis blanket-wide.

Full Art. 13(1)-(2)/14(1)-(2) list: controller identity and contact details, DPO contact if one exists, the purposes of processing and legal basis, legitimate interests pursued (if relying on Art. 6(1)(f)), recipients or categories of recipients, intention to transfer data internationally and the safeguard used, the retention period or the criteria used to determine it, the existence of data subject rights, the right to withdraw consent (if applicable), the right to complain to a supervisory authority, whether providing the data is a statutory/contractual requirement, and the existence of any automated decision-making with meaningful information about the logic involved.

AI Act Art. 50 requires providers/deployers of a system intended to interact directly with natural persons to ensure people are informed they're interacting with an AI system, unless it's obvious to a reasonably well-informed person from the context. This is separate from GDPR data-processing transparency (Art. 13/14) — an AI chat widget needs both a privacy notice AND an "you're talking to an AI" disclosure; one doesn't substitute for the other. Application-date specifics for this obligation should be verified against the current EUR-Lex consolidated text at implementation time, as AI Act timelines have been subject to revision.

A common myth is that GDPR sets a specific retention limit (e.g. "delete after 6 months"). It doesn't — Art. 5(1)(e) requires data be kept no longer than necessary for the purpose, which means YOU define and justify the period (e.g. "lead records are kept for 24 months to allow follow-up on a typical B2B sales cycle, then anonymized"), not that a universal number applies.

Art. 28(3) requires the DPA to set out: subject matter and duration of processing, nature and purpose of processing, type of personal data and categories of data subjects, and the controller's obligations/rights — plus binding the processor to specific duties: confidentiality, appropriate security (Art. 32), sub-processor authorization, assistance with data-subject-rights requests, assistance with the controller's Art. 32-36 obligations, deletion or return of data at the end of the service, and audit rights for the controller.

Two paths: (1) the Commission has issued an adequacy decision for the destination (e.g. the EU-US Data Privacy Framework, adopted 10 July 2023, for US vendors that have self-certified — check the specific vendor's certification status, not just "they're in the US"), or (2) appropriate safeguards apply absent adequacy, most commonly Standard Contractual Clauses (SCCs) in the vendor contract.

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), the notification obligation to recipients when data changes (Art. 19), data portability (Art. 20 — applies only where the basis is consent or contract AND processing is automated), and the right to object (Art. 21 — applies against Art. 6(1)(e)/(f) processing, and always applies against direct marketing). Not every right applies to every processing activity — e.g. portability doesn't apply to legitimate-interest-based processing.

Typical AI lead-scoring/routing that only prioritizes which human sales rep looks at a lead first generally falls outside Art. 22's strict regime, because it isn't "solely automated" with a legal or similarly significant effect on the person — a human still reviews and acts on it. This is a reasoned interpretation based on the text and WP29/EDPB guidance, not a ruling on lead-scoring specifically. If the agent's output autonomously denies service, sets a binding price, or approves/rejects something with no real human review afterward, Art. 22 is much more likely to apply, and that needs its own legal review.

DPIA is mandatory when processing is "likely to result in a high risk." Art. 35(3) names three always-DPIA triggers: systematic and extensive profiling with legal/similarly significant effects, large-scale processing of special category data, or systematic large-scale monitoring of a public area. WP29's supplementary 9-criteria list (evaluation/scoring, automated decision-making with legal/similar effect, systematic monitoring, sensitive data, large-scale processing, dataset matching, vulnerable subjects, innovative technology use, processing that blocks a right/service) is used to assess borderline cases — generally 2+ criteria present suggests a DPIA is likely needed. A small/medium-business AI sales agent doing routine lead scoring usually doesn't hit this bar alone, but adding scraped third-party enrichment data or sensitive-sector data changes that.

If your AI/CRM vendor (a processor) suffers a breach, they must tell you "without undue delay" — no fixed hour count applies at that step (Art. 33(2)). The 72-hour clock is yours as controller, starting when you become aware, for notifying the supervisory authority (Art. 33(1)) — and even then, only where the breach is likely to result in a risk to individuals. Notifying the affected people themselves (Art. 34) is a separate, higher threshold: only where the risk is assessed as "high," not just "a risk."