A bank’s mortgage-decision agent retrieves a document containing an indirect prompt injection. It leaves its expected workflow, accesses information it does not need and exfiltrates confidential customer data. The regulatory reporting deadlines start running.

EU law does not tell the bank which controls to install. It expects the bank to have answers.

That one agent falls under the AI Act, DORA, the GDPR and the Cyber Resilience Act (CRA). Our whitepaper sets out what each of them requires, article by article, and how teams deploying agents can meet it.

Five questions to test yourself

  1. Which agents are live, and what can each one reach?
  2. Would you notice the agent going off script, and would the right person hear about it?
  3. Can you reconstruct what the agent did across every system it touched?
  4. Can you decide, on the clock, whether you have to report the incident?
  5. Can you turn what the agent did into better risk assessments and security controls?

If any of these gave you pause, the whitepaper shows where each question comes from and how behavioural monitoring can help answer it.