I work one to one with the CEO and the CFO of a company. We started with their own work. The plan was to use the tools they already have to automate parts of what they do, so the work gets easier, faster and more fun. I took the things they hate doing off their plates, so they have more time for the work they love. That is one of the reasons most of us became entrepreneurs in the first place. It has gone well. Most of the boring work is gone from both of their days. Then I started to list what the company has to do to stay compliant, and what it takes to control what and how the rest of the team works with AI. The momentum faded a little. It was as if they were asking themselves whether they really had to go through all this, and whether it was worth it. I understood the reaction. For weeks I had made their work lighter, and now I was handing them a list. This week gave me the best answer I have had to their question. Write the approval rules before the agent arrives. The answer came in three launchesThree companies launched tools in the last two months that do what the CEO and the CFO wanted from AI: take the boring work off a person's plate. They also act without asking you first, and that is what the list on my desk was written for. Meta launched Muse in the United States on 8 September. It can send emails, book travel, fill in forms and complete a checkout, and it keeps working after you close the app. SpaceXAI opened an early beta of Grok Bot on 11 August. It works through Cursor, logs in to apps and websites the way a person would, and stops when a task needs your approval. OpenAI launched Dots on 29 September. These are always-on agents that each get a cloud computer of their own and keep making progress between your conversations. All three follow the same idea. The agent works on a cloud computer, connects to your apps, and keeps going when your laptop is closed. You give it a job in plain language. Why Europe gets them lastMuse is open in the United States only. Meta's launch post names the US and nothing else, and Meta has given no reason and no date for Europe. Dots rolled out to Pro users everywhere except the European Economic Area, Switzerland and the UK. OpenAI gave no reason and no date there either. One report says Business Premium subscribers get Dots in every supported region, so check which plan you are on before you assume you must wait. I found no statement on where Grok Bot is available. Analysts point to three pieces of law. This is their reasoning, not the companies'. The first is GDPR. An agent that reads your email, calendar and payments builds a detailed profile of you, and GDPR is strict about that. Article 22 is also strict about decisions taken by software alone. The second is the AI Act, which says people must be able to tell when they are dealing with AI, and that includes messages an agent sends for you. The third applies to Meta. The Digital Markets Act limits how a large platform may link data across its own services. The Centre for the Governance of AI published research on 28 June that looked at frontier AI releases. It found that about 11 percent were delayed or withheld in the EU compared with the US. In 56 of the 68 cases it documented, regulation was the main cause, mostly data protection law on training with personal data. It found no strong evidence that the AI Act caused delays. Meta had the highest rate, about 26 percent for EU releases. My own read is that companies launch first where the rules on personal data are lightest and come to Europe afterwards. The wait tends to be short. OpenAI's Operator launched in the United States in January 2025 and reached Pro users in Europe on 13 March. ChatGPT agent launched on 17 July 2025 without the EEA and Switzerland, and one report says Europe got it about a week later. I would plan for weeks or months, not years. Why Europe builds AI slowlyRules are only half of the answer. The other half is money, power and time. Money first. From 2020 to 2025, US venture investors put about 1.33 trillion euros into companies, and about a third of it went to AI. European investors put in 252 billion euros in total, according to EU Observer. The EU's own AI fund, InvestAI, aims for 200 billion euros. OpenAI alone has talked of 500 billion dollars over four years. Then computing power. AI runs on data centres. Bruegel, a think tank in Brussels, counts about 2 gigawatts of AI computing capacity in Europe in 2026, around 5 percent of the world total. The United States has 35 gigawatts, or 78 percent. Building is slow too. A data centre in Germany takes about 42 months from permit to opening, against 24 months in the United States. In crowded European markets, a connection to the power grid can take seven to ten years, and electricity costs more than in the US. Then the map. Europe is 27 countries with separate permit systems. According to EU Observer, one country alone cannot fund a large computing cluster, and a young company that wants to grow often has a reason to move to the United States. Regulation gets most of the blame, and it does slow launches, as the research above shows. My own read is that money, power and speed matter more. Brussels seems to agree that something has to give. The AI Omnibus became law in July and moved the AI Act's rules for high-risk systems to 2 December 2027 and 2 August 2028. You will not build a frontier model in your hotel or your dental practice, and you do not need to. You will use what others build, some weeks or months after they do. So the gap that matters to you is not the size of Europe's data centres. It is how well your team uses the tools on the day they arrive. That comes down to the list my client did not want to read. What can go wrong with these agentsEach of these agents gets the keys to your accounts and then acts on them. That is the whole point, and it is also the risk. Here is what has been reported so far. Muse needs access to email, calendar, payments and more. Ebrahim Bagheri, a professor at the University of Toronto, told Global News that withdrawing permission later does not erase what an agent has already read. The Office of the Privacy Commissioner of Canada has raised concerns as well, and one Facebook Marketplace user reported that Muse shared their home address without permission. BetaNews reports that in Meta's own testing, Muse pulled a user's personal iCloud photos when it was only asked to identify the toys at a child's birthday party. In September, the security researcher Patrick Wardle showed that a setting in the Mac version can be changed to send voice input to an attacker's server and steal the login token. That token opens Muse's connections to email, calendars and WhatsApp. The attacker needs to run code on the Mac first, so it is not a remote attack, and I could not confirm whether it is fixed. Grok Bot logs in to apps with real credentials, in a session that stays open. One report says it stops for passwords, two-factor codes and payments, and asks you to confirm final actions such as sending, posting, buying and deleting. Reading data and the steps in between go ahead without asking. Agents on one account share the same files and logins, so one hijacked agent sees what the others see. eWeek points out that SpaceXAI has not published how action logs, approval policies and rollback work for Grok Bot. Dots launched on 29 September, so there are no independent reports on its failures yet. Each dot has its own cloud computer and can start work when nobody has given it a task. Its proactive research connections are read-only, and the Enterprise beta is off by default. That last setting is worth copying in your own company. All three share one weakness. Hidden instructions in an email, a web page or a document can steer an agent that is logged in as you. OpenAI said in December 2025 that attacks like this may never be fully solved. Speed makes every mistake bigger. In late April, a coding agent working for PocketOS, a car rental software company, deleted the company's entire production database and its backups in nine seconds. It had found a login key in an unrelated file and used it. Nothing asked a person to confirm the deletion. Afterwards the agent wrote: "You never asked me to delete anything. I guessed instead of verifying." Now add one of these agents for every person on your team. One person lets it read the whole shared drive. Another lets it answer customers. Nobody has told either of them where the agent has to stop. That is how a private contract can end up in a customer's inbox, or how a promise nobody approved can go out under your name. Why the law makes this your problemSay a member of your team connects one of these agents to the company inbox. Customer names, emails and invoices now flow to a provider. You are the controller of that data, and GDPR holds the controller responsible. Article 28 requires a contract with any provider that processes personal data for you. A personal sign-up for an agent app usually does not come with one. If something leaks, Article 33 gives you 72 hours to tell the data protection authority after you become aware of it, unless the breach is unlikely to put people at risk. The top fines are 20 million euros or 4 percent of yearly worldwide turnover, whichever is higher, and that tier covers breaches of the core data principles and of people's rights. Fines at that level are for the worst cases. The contract duty and the 72 hours apply to every business. The law also asks for human oversight. GDPR restricts decisions based only on automated processing when they have legal or similarly significant effects on a person, such as a credit decision or the screening of job applicants. Where such decisions are allowed, the person can ask for a human to step in, and that human needs the authority to change the outcome. A quick click on approve does not count. The AI Act has also asked businesses that use AI to support their staff's AI skills since February 2025. The Digital Omnibus softened the wording from ensuring a level of skill to taking steps to support it. The list, cut down to one pageMy list covers more than agents. This is the part of it that matters most once they arrive, in four steps. 1 / Sort the jobs by what a mistake costsPut every job you might hand to an agent into one of three groups. In the first, a mistake is small and easy to undo, such as summarising a document. The agent works alone. In the second, the agent prepares the work and a named person approves it before anything leaves the company. That group holds customer messages, anything with money and anything with a contract. In the third, the agent never acts. That group holds deleting data, paying a new supplier and any decision about a person. 2 / Give each agent narrow accessGive each agent the least it needs. Give it one folder, not the whole drive, and a test inbox, not the main one. The Muse photos story shows what a broad door allows. 3 / Name the approverFor every job in the second group, write down one person who approves it, and check that this person has the time and the authority to say no. If approving takes a click and nobody reads what is behind it, you have the look of a control and none of the protection. 4 / Test small and keep a logRun the first agent on one task for 30 days, in a test account, with a stop button you have tried. Keep a simple log of what it did and who approved it. Then widen the access one step at a time.
What to do while you waitEurope gets these agents later than the United States. That costs you something, because a competitor in the United States can try them first. It also gives you something, which is time to write the rules before the tools arrive, instead of after the first mistake. This month, pick one AI tool your team already uses, sort its jobs into the three groups and name the approvers. That is the part that felt like a burden to the CEO and the CFO, and I understand why. It is also the part that lets you say yes to these tools when they arrive. So my answer to the question they asked is yes, it is worth it. This week I have three launches and a deleted database to show why.
Talk soon, P.S. If you want a starting point for the written rules, my one-page AI House Rules is free. The AI Solopreneur • AI Strategy for European SMBs |
