Enterprise AI agents now operate under four overlapping regulatory frameworks that must be satisfied simultaneously. The EU AI Act — the world's first comprehensive AI legal framework — has its high-risk obligations fully enforceable by August 2, 2026, with penalties up to €35 million or 7% of global annual turnover. GDPR has accumulated over €6.2 billion in cumulative penalties, with Article 22 restricting automated decision-making. HIPAA now mandates encryption and MFA (no longer "addressable" but required) by 2026. SOC 2 2026 now requires AI-specific governance: bias testing, data lineage, and explainability controls. These aren't separate compliance tracks — they overlap, and an agent that touches health data in Europe must satisfy all four.

The EU AI Act classifies AI systems into four risk tiers that determine compliance obligations. Unacceptable risk (banned): social scoring, real-time biometric surveillance, manipulative AI. High risk (Annex III): employment decisions, credit scoring, insurance, law enforcement, critical infrastructure — these require full compliance with quality management, risk management, technical documentation, and human oversight. Limited risk: chatbots and content generation — transparency obligations (users must know they're interacting with AI). Minimal risk: spam filters, recommendation engines — no specific obligations. Most enterprise AI agents fall into high risk or limited risk. The first step is conducting a comprehensive AI system inventory and classifying every system with documented rationale.

High-risk AI systems require comprehensive technical documentation that must exist, be tested, and be defensible by August 2026. This includes: system purpose and intended use (what the agent does and doesn't do), training data documentation (data sources, preprocessing, known biases), model architecture and capabilities (what model, what version, what limitations), risk assessment (identified risks and mitigation measures), testing results (accuracy, fairness, robustness testing), and human oversight mechanisms (who reviews, when, how). The documentation must be maintained as a living system — not a one-time compliance exercise. Version control is essential: every change to the agent should update the documentation.

An audit trail for AI agents must capture every decision the agent makes and why. This goes beyond traditional application logging. For each agent action, log: the input (what triggered the action), the reasoning (what the agent considered, what tools it called, what data it retrieved), the output (what the agent decided or produced), the confidence level (how certain was the agent), and the outcome (what happened as a result). Self-hosted AI models enable complete audit trails and full data control — critical for meeting simultaneous GDPR, HIPAA, and EU AI Act requirements. Cloud-based AI creates structural compliance gaps through data sovereignty loss and limited audit access.

The European Data Protection Board interprets GDPR Article 22 as a prohibition on pure automated decision-making, not merely a right to contest. This means any AI agent that makes decisions affecting individuals — hiring, credit, insurance, service access — must have meaningful human intervention in the decision-making process. "Meaningful" is the key word: a human rubber-stamping agent decisions doesn't qualify. The human must have the authority, competence, and information to override the agent's decision. The EU AI Act reinforces this for high-risk systems, requiring documented human oversight mechanisms that demonstrate real engagement, not just a checkbox. This connects directly to the workflow design principles from Chapter 7 — the review interface must force genuine engagement.

Cloud-based AI creates structural compliance gaps that are difficult to close: data sovereignty loss (where is the data processed?), limited audit access (can you inspect every model interaction?), training data leakage risks (does the provider use your data to train?), and cross-border transfer issues under GDPR. Self-hosted AI models eliminate these gaps by providing complete audit trails and full data control. For regulated industries — healthcare, financial services, government — self-hosting is often the only path to simultaneous GDPR, HIPAA, and EU AI Act compliance. The trade-off is operational complexity: self-hosting requires infrastructure expertise, model management, and security hardening that cloud providers handle automatically.

The EU AI Act requires post-market monitoring for high-risk systems — ongoing surveillance of the agent's behavior in production, not just pre-deployment testing. This means continuously monitoring for bias drift (is the agent treating different groups differently over time?), accuracy degradation (is performance declining as data distributions shift?), novel failure modes (is the agent encountering situations it wasn't designed for?), and compliance violations (is the agent making decisions it shouldn't?). Machine-readable, continuous compliance is now essential rather than optional. Enterprises that embed compliance directly into engineering workflows — treating it as an infrastructure challenge rather than a reporting burden — can turn regulatory mandates into competitive advantage.

The compliance roadmap has three phases. Foundation (months 1–2): form a cross-functional compliance team (legal, technical, data, risk, product), complete the AI system inventory and preliminary risk classification, and conduct a detailed gap analysis against all applicable regulations. Build (months 3–8): implement the quality management system, risk management procedures, data governance framework, technical documentation, and audit trail infrastructure. Validate (months 9–15): conduct robustness testing, fairness testing, and penetration testing; run mock audits; establish post-market monitoring; and prepare regulatory filings. By August 2026, technical documentation, risk management systems, and post-market monitoring must exist, be tested, and be defensible. Chief Compliance Officers must demonstrate that governance works in practice, not just in theory.