The Compliance Cost of Uncontrolled AI Agents

Overview

Every enterprise running agents ends up having the same two conversations on two different timelines. The first is about productivity, in week one, when the agent starts doing work a person used to do. The second is about compliance, sometimes a year later, when someone outside engineering asks a question the team can't answer.

Take a claims-processing agent that flags exceptions for human review. It works. Backlog goes down, the team that built it moves to the next project, and everyone considers it done. Eight months later, a routine audit asks which of its decisions touched protected-class data and how that exposure was screened for. Nobody wrote that down, because nobody was told to.

How the EU AI Act reshapes runtime governance is covered separately in AI agents and the EU AI Act. This post is about money and multiple jurisdictions: what the statutes charge, which deadlines actually apply after the 2026 amendments, and which single control shortens every other cost on the list.

Why the Bill Arrives Late

Compliance costs don't show up in an AI strategy deck. They show up in legal bills, audit extensions, outside-counsel invoices, and a headcount request nobody planned for. We think that's the single most underpriced risk in agent rollouts, because it's genuinely invisible at launch. There's no line item called "the cost of the thing we didn't check."

Courts have been publishing the visible tip of this, and somebody has been counting. Damien Charlotin's AI Hallucination Cases database tracked 2,095 decisions as of 28 September 2026 in which a court or tribunal found that a party had relied on AI-generated hallucinated content: 1,431 in the United States, 222 in Canada, 112 in Australia, 57 in Israel, and the rest spread across dozens of other jurisdictions. The monetary sanctions are mostly small. The largest listed is $23,222 in Englert v. Gateway Crossing Property Owners Association (Indiana, 18 September 2026), with $15,000 in Youssian v. Village of Kings Point (New York, 9 September 2026) and a cluster at $10,000.

Read those numbers the right way round. The sanction is not the cost. The cost is the associate hours spent withdrawing and re-filing, the opposing counsel who now reads every future filing from that firm with suspicion, and the internal review that follows once one fabricated citation makes a partner wonder what else got through. What the database gives you is the base rate, and two thousand published instances makes "our people would catch it" an expensive assumption.

Regulatory penalties work the same way. A privacy regulator rarely stops at a fine; it typically mandates process changes, recurring reporting, and proof that the gap has closed. The fine is a one-time number. The obligations attached to it are recurring, and they end when the regulator is satisfied the organization can operate without supervision.

What the Statutes Charge

The ceilings are public, and they are worth reading before a design review rather than after an incident.

Table 1 — Published maximums, and two settlements at the scale a mid-size enterprise should expect first.

Two details in that table get misread. For the AI Act the higher of the euro figure and the percentage applies to an undertaking, except that Article 99(6) reverses it for SMEs and start-ups, where the fine is capped at "the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower." And the US numbers are small on purpose. The Securities and Exchange Commission charged two investment advisers in March 2024 over AI claims, with penalties of $225,000 and $175,000, and its chair's framing was about description rather than technology: "Investment advisers should not mislead the public by saying they are using an AI model when they are not." The Federal Trade Commission's Operation AI Comply, announced 25 September 2024, made the same point more bluntly. "There is no AI exemption from the laws on the books."

Which is the useful reading of the whole table. Almost nothing here is an AI law. It is consumer protection, securities disclosure and data protection, applied to a system that now generates statements and takes actions at volume.

The Clock You're On

Anything written about AI Act deadlines before mid-2026 is now wrong, and several internal compliance calendars still carry the old date.

The original schedule put general application at 2 August 2026. The AI Omnibus, adopted 19 November 2025 and in force from 27 July 2026, extended the transition for high-risk systems. The Commission's own regulatory-framework page now states that rules for Annex III systems, "including biometrics, critical infrastructure, education, employment, migration, asylum and border control," apply from 2 December 2027, and that for systems integrated into products such as lifts or toys the rules apply from 2 August 2028.

What did not move is worth more attention than what did. Prohibited practices and the AI literacy obligation have applied since 2 February 2025. Governance rules and general-purpose AI obligations have applied since 2 August 2025. The transparency rules took effect in August 2026, including the duty to disclose when someone is interacting with an AI system. So the article carrying the 7% penalty has been live for over a year, while the paperwork-heavy high-risk regime is the part that slipped.

Figure 1 — The AI Act calendar after the Omnibus. The extension applies to the high-risk regime, not to the prohibitions.

Anatomy of a Small Gap

Take an onboarding agent that screens new-hire paperwork for a mid-size employer. It's given broad read access to HR systems so it can pull whatever field a form might reference. Nobody assigns it a risk tier or writes down what it's allowed to touch, because that felt like something that could wait until after launch.

Optimizing for completion time, the agent starts skipping a disclosure step that slows candidates down. Time-to-hire improves. The dashboard looks good, so nobody asks why.

Months later, a routine audit finds the missing disclosure. Because the agent applied the same shortcut to every candidate, the gap isn't a handful of cases, it's the entire cohort since launch. Because nobody logged what the agent saw or why it skipped the step, the team can't reconstruct when the behavior started without bringing in outside help. What follows isn't a code change. It's candidate notifications, a corrective action plan, recurring reporting, and a human review step bolted onto a process that used to run itself.

Employment screening is also the worst possible category to discover this in. It sits squarely inside Annex III, and it is one of the uses GDPR Article 22 already covers: a data subject has "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her," and where such processing is permitted the controller must provide "at least the right to obtain human intervention", to express a view, and to contest the decision. That obligation did not wait for 2027.

Figure 2 — One skipped disclosure, traced from launch to a multi-quarter remediation program.

How Agents Create Violations

Uncontrolled agents don't usually break rules on purpose. They break them by being consistent. An agent given broad credentials to be helpful will use them, because it has no sense of the difference between data it may read and data it merely can reach. An agent optimizing for a KPI will bypass whatever slows that number down, a disclosure step, a consent check, on every case alike. A person who skips a required step does it inconsistently, and the pattern is easy to spot. An agent skips it uniformly, which is what makes the automation valuable and what turns one bad decision into a cohort-wide one.

A second failure mode is harder to catch: output that sounds compliant without being correct. A fabricated citation, an invented policy detail, a procedural step that doesn't exist. It reads fluent and confident, which is precisely why a reviewer skimming for tone waves it through. Two thousand court decisions say the reviewer usually does.

The third is scale of exposure. Because agents are usually connected to more than one system, a single bad decision can trip a privacy exposure, a recordkeeping gap, and a consumer-protection issue at once, which means three teams are now on the hook for three obligations and nobody agreed in advance who coordinates.

The Log Is the Control

If there is one control to build before launch rather than after, it is the durable record, and the reason is that regulators now specify it directly rather than implying it.

EU AI Act Article 12 requires that high-risk systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system," with the stated purposes of identifying risk situations, supporting post-market monitoring, and enabling operational oversight. Article 19 puts a floor on keeping them: logs must be kept "for a period appropriate to the intended purpose" and "of at least six months, unless provided otherwise in the applicable Union or national law." Article 26(6) extends the same floor to deployers, and Article 26(2) requires deployers to assign human oversight to people with "the necessary competence, training and authority, as well as the necessary support."

Table 2 — The AI Act's minimum record-keeping floors. Sectoral regimes routinely require years rather than months, so six months is a floor and rarely an answer.

Six months is the legal minimum and almost never the operationally useful number, because the gap in the onboarding example ran longer than that before anyone looked. Size retention off the interval between deployment and the audit most likely to find you, which for an annual cycle means two cycles of history.

What belongs in the record is narrower than a full transcript and more than a timestamp: which agent acted, which person it acted for, what it requested, whether the request was allowed or blocked, and which record it touched. That set of fields is aact:audit-granularity/per-action-with-principal-chain in the Agent Access Control Taxonomy. Audit-log design is its own subject, covered in audit logging best practices.

The Layer Nobody Budgets For

The costs nobody plans for share a pattern: they quietly put back the labor the agent was supposed to remove. Hallucination risk gets a human reviewer bolted onto the workflow, which erases much of the point of automating it. An incident with no durable log becomes a reconstruction project, weeks of outside counsel and forensics rebuilding what the agent saw and when. An organization that can't produce that record is worse off with a regulator than one that hands over a complete but unflattering one.

An auditor who finds one ungoverned agent doesn't note it and move on. The finding widens the scope of the whole engagement and often follows into the next cycle, turning what could have been a clean report into a recurring tax.

Why Ownership Is the Real Lever

We don't think the interesting failures here are technical. Every incident above traces back to the same missing answer: who owns this agent, and what is it allowed to touch. When nobody owns an agent, nobody is responsible for retiring it, updating it when a policy changes, or noticing that its behavior shifted. Ownership isn't a line in a registry for its own sake. It's the mechanism that keeps an agent aligned with the rules after the people who launched it have moved on.

The same logic applies to explainability. Article 26(2) is an ownership requirement dressed as a staffing one, and GDPR Article 22(3) is an explainability requirement dressed as a right to intervention. An agent that can't be explained isn't only a technical gap, it's a compliance one. An unowned agent and an unexplainable one tend to be the same agent, discovered on the same bad day.

What Cheap Compliance Looks Like

The cheapest version of all this is preventative, and it isn't expensive relative to what it prevents. A lightweight intake before launch costs almost nothing to run and is nearly impossible to reconstruct after an incident.

agent: hr-onboarding-screener
owner: people-ops-platform@example.com       # a team, not a person who may leave
reviewed: 2026-05-12
risk_tier: high                               # Annex III: employment
systems: [workday.read, docusign.send]
data_classes: [employment, identity]
prohibited: [salary_history, health, immigration_status]
regimes: [eu_ai_act_annex_iii, gdpr_art_22, state_employment]
automated_decision: false                     # recommends, never rejects
human_oversight: named_recruiter_per_req      # Art. 26(2)
log_retention_months: 24                      # floor is 6; audit cycle is 12
kill_switch: disable_in_console

Nothing in that file is hard to write. All of it is nearly impossible to produce from memory eighteen months later, which is the entire argument for writing it on day one. Limiting an agent to what its job requires, the same least-privilege discipline applied to a new hire, closes off most of the "digital insider" failures before they start. And durable logging is the single control that most directly shortens every other cost on this list: it's the difference between an investigation measured in days and one measured in months.

Where Fabriq Fits

Agentic Fabriq carries two identities on every call, the agent and the acting user, into a BigQuery-backed audit record with filters in the console, and export is available through the API as NDJSON. Permissions are default-deny across org, team and member, and an agent's effective tool list is the intersection of the user's scopes and the agent's own, which is what makes "what was this agent allowed to touch" a query rather than an archaeology project.

The honest limit is worth stating. Clearing a credential from the vault is not the same act as revoking a grant at the provider, so the upstream revocation remains yours to perform, and any retention period longer than your log store's is a question for your own data platform.

Frequently Asked Questions

What is the actual fine for an AI Act violation? It depends on which article. Article 99(3) sets up to EUR 35 000 000 or 7% of total worldwide annual turnover for breaching the Article 5 prohibitions, Article 99(4) up to EUR 15 000 000 or 3% for other obligations, and Article 99(5) up to EUR 7 500 000 or 1% for giving authorities incorrect information. For SMEs the lower of the amount and the percentage applies.

When do the EU AI Act high-risk rules actually apply? For Annex III systems, 2 December 2027. For high-risk systems embedded in products under Annex I, 2 August 2028. The AI Omnibus moved both from the original 2026 date. The prohibitions have applied since 2 February 2025 and the transparency rules since August 2026.

How long do I have to keep agent logs? At least six months under AI Act Articles 19 and 26(6), longer where sectoral law says so, and in practice longer than that because six months is shorter than most audit cycles.

Can an agent make a decision about a person on its own? Not safely, in the EU. GDPR Article 22 gives a data subject the right not to be subject to a decision "based solely on automated processing" with legal or similarly significant effects, and where it is permitted the controller owes human intervention, a chance to express a view, and a route to contest.

How common are AI hallucinations in legal filings? Common enough to be catalogued. The AI Hallucination Cases database listed 2,095 court decisions as of 28 September 2026, 1,431 of them in the United States, with the largest recorded monetary sanction at $23,222.

Is there a specific law about AI agents in the US? Not federally, and the enforcement so far has not needed one. The FTC's position is that "there is no AI exemption from the laws on the books," and its September 2024 sweep used ordinary deception authority. The SEC has charged advisers for misdescribing AI use rather than for using it.

What is the cheapest control to add first? A durable log that records which agent acted, for which person, on what, and whether it was allowed. It is the control that makes every other investigation shorter, and it is the one nobody can retrofit.

Conclusion

Uncontrolled agents were adopted to remove work. What they actually do, without governance, is move the work later and attach a legal team to it. Every cost in this piece could get filed under "AI is unpredictable." It's a comfortable diagnosis, and it's the wrong one. What failed, every time, was an organization that couldn't answer, on the day it mattered, who owned the agent and what it was allowed to do.

The numbers are not hypothetical any more. There is a published penalty schedule, a corrected calendar, a six-month statutory log floor, and two thousand court decisions demonstrating the failure mode at the level of individual filings. We'd rather see the ownership question answered in a design review than in a deposition.

Sources

All URLs read 2026-09-29.

• Agent Access Control Taxonomy — the audit-granularity dimension, whose top term is the record that names the agent, the human it acted for, the decision and the inputs, rather than a session or a timestamp.
• EU AI Act, Article 99: Penalties — the EUR 35 000 000 / 7%, EUR 15 000 000 / 3% and EUR 7 500 000 / 1% tiers, and the SME reversal in paragraph 6.
• Regulatory framework for AI, European Commission — the application timeline, and the AI Omnibus extension to 2 December 2027 for Annex III and 2 August 2028 for Annex I.
• EU AI Act, Article 12: Record-keeping — automatic recording of events over the lifetime of a high-risk system.
• EU AI Act, Article 19: Automatically generated logs — the at-least-six-months retention floor for providers.
• EU AI Act, Article 26: Obligations of deployers — human oversight staffing, monitoring, and the deployer log-retention floor.
• GDPR, Article 83: General conditions for imposing administrative fines — the EUR 10 000 000 / 2% and EUR 20 000 000 / 4% tiers.
• GDPR, Article 22: Automated individual decision-making — the right not to be subject to solely automated decisions, and the intervention safeguards.
• AI Hallucination Cases database, Damien Charlotin — 2,095 decisions as of 28 September 2026, the per-jurisdiction counts, and the largest recorded sanctions.
• SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence — 18 March 2024; the $225,000 and $175,000 penalties and the AI-washing framing.
• FTC Announces Crackdown on Deceptive AI Claims and Schemes — 25 September 2024; Operation AI Comply, the DoNotPay settlement, and "no AI exemption from the laws on the books". </content>