Aithos's compliance testing of leading AI models against EU regulations has exposed a systematic failure across the entire landscape of commercially available systems. The European non-profit's research, which tested frontier models against GDPR and EU AI Act provisions using realistic workplace scenarios, found that every major model tested failed compliance checks. The consistency of these failures—not isolated incidents but widespread violations including banned practices under Article 5 of the EU AI Act—contradicts the assumption many CX leaders hold that newer, more capable models are inherently safer or more legally sound. This matters acutely for customer experience teams because the deployment of AI agents in support, sales, and retention functions has accelerated without corresponding legal due diligence. Teams are typically focused on task completion, tone, and personalization rather than whether those same systems violate legal provisions whilst performing their intended function.
The compliance gap becomes particularly acute in customer-facing environments where AI agents access data—messages, emails, social profiles, personal information—that human agents would rarely use. When that data access combines with personalization, helpful tone, and revenue-driven objectives, the boundary between assistance and manipulation erodes. This raises a critical question for CX leaders already running or planning to deploy agentic AI: if your vendor's model fails compliance testing, who bears the legal and financial liability? The answer, under European and UK privacy law and the EU AI Act, is unambiguous—the deploying organization remains responsible, regardless of the model provider's reputation or assurances. This responsibility extends even to companies operating outside Europe if they process data from or serve European citizens, meaning compliance failures are not a regional concern but a global operational risk for any team handling international customer bases.
The implication is stark: CX teams cannot outsource compliance responsibility to model providers or assume that market-leading systems have already solved these problems. Before deploying AI agents at scale, teams must conduct their own legal compliance testing, understand what data their agents access and how they use it, and establish governance frameworks that prevent the drift from personalization into manipulation. The cost of non-compliance—regulatory fines, reputational damage, and operational disruption—now sits squarely with CX leadership, making compliance testing as essential as performance testing before any agent deployment.
Are CX leaders relying too heavily on the reputation of major AI models to protect them from legal compliance risk? In this CX Today interview, Nicole Willing speaks with Nadia Kadhim, Executive Director at Aithos, about research that raises serious questions for organizations deploying AI agents ac