# AI agents, GDPR and the EU AI Act

> We design for GDPR and the EU AI Act from the first line, and every Phase 1 includes a plain-language record of what the agent does, which data it touches and who checks its work. This page describes what we build and document. It is not legal advice.

## What you get with every Phase 1

A plain-language record of what the agent does, which data it touches and who checks its work.

## Where the data goes

The record lists which data the agent touches. One of our agents runs on an EU server.

## Questions to ask any agent vendor

- Where is the data processed, and by whom?
- Who can see the agent's logs?
- Which actions need a person's approval?
- Can we leave with the code, the prompts and the accounts?

## Leaving is possible

The code, the prompts and the accounts are in your company's name, and we hand everything over at go-live. See [how we build agents](https://agenticengineeringconsulting.com/wiki/how-we-build-agents).

## Not legal advice

Your obligations depend on your business and how the agent is used. Ask your own counsel what applies to you.

## Related

- [What does human in the loop mean for AI agents?](https://agenticengineeringconsulting.com/wiki/human-in-the-loop)
- [How we build an AI agent in 30 days](https://agenticengineeringconsulting.com/wiki/how-we-build-agents)
- [AI agents: questions buyers ask](https://agenticengineeringconsulting.com/wiki/ai-agent-faq)

## Next step

- Apply: https://agenticengineeringconsulting.com/apply
- Free AI audit: https://agenticengineeringconsulting.com/audit
- Book a brief: https://calendar.app.google/sdYkXF3ny2kvbvp39
- Email: henryvantieghem@agenticengineeringconsultingllc.com

---
Canonical page: https://agenticengineeringconsulting.com/wiki/ai-agents-eu-ai-act-gdpr