The EDPB Is Asking About Your AI Agents. Most Teams Can't Answer.

On March 19, 2026, the European Data Protection Board launched its fifth Coordinated Enforcement Action - and 25 Data Protection Authorities across Europe started contacting organizations with a specific question about their data processing. The question sounds straightforward. For teams running AI agents, it exposes a gap that logs alone cannot close. The question: can you document what personal data you processed, in which sessions, on what legal basis, and with what protections in place? For a standard web application, this is answerable.