Short answer: when an AI agent enters Europe, buyers mostly ask about two things. First, data processing under GDPR: where data is stored, whether you sign a data processing agreement (DPA), whether customer data trains models and how data is transferred internationally. Second, the EU AI Act: most marketing and support agents mainly face transparency obligations, such as letting people know they are interacting with AI. A ready set of customer-facing compliance materials removes much of the friction in procurement.
This is a directional summary and not legal advice. Laws and implementing rules change; rely on the latest official texts and a lawyer's opinion.
GDPR: the questions buyers ask most
GDPR (the General Data Protection Regulation) applies to organizations that process personal data of people in the EU, even if the company is outside the EU. European buyers typically ask:
| Buyer's question | What to prepare |
|---|---|
| What personal data do you process? | Data types, purposes and retention periods |
| Where is the data stored? | Storage and processing regions, ideally with an EU option |
| Are you a controller or a processor? | In B2B you are usually the processor and the customer the controller, so a DPA is needed |
| Which sub-processors do you use? | A public sub-processor list, including cloud and model providers |
| Do you train models on our data? | A clear statement, also written into the contract |
| How is data transferred internationally? | The transfer mechanism, such as the EU Standard Contractual Clauses (SCCs) |
| How is data deleted? | Deletion process and timelines |
| What happens in a data breach? | Incident response and notification process |
International data transfers
Transferring personal data from the EU to other countries needs a lawful transfer mechanism. The EU has issued adequacy decisions for some countries; for others, Standard Contractual Clauses (SCCs) with a transfer impact assessment are common. US companies can certify under the EU-US Data Privacy Framework (DPF).
Teams based in China commonly store and process European customers' data in the EU and state clearly whether, and when, any access from outside the EU happens.
EU representative
Companies without an EU establishment that offer services to people in the EU and process their data often need to appoint an EU representative.
The EU AI Act: start with the risk level
The EU AI Act entered into force in 2024, with obligations applying in stages: prohibitions from February 2025, obligations for general-purpose AI models from August 2025, and most other provisions planned from August 2026. In late 2025 the European Commission proposed adjusting the timeline for some high-risk provisions, so check the latest official text for final dates.
The Act is risk-based:
| Risk level | Examples | Main requirements |
|---|---|---|
| Prohibited | Social scoring, certain manipulative practices | Not allowed |
| High risk | Recruitment screening, worker evaluation, credit scoring, education scoring | Heavy duties: risk management, data governance, documentation, human oversight |
| Transparency obligations | AI that interacts with people, AI that generates or alters content | Tell people they are interacting with AI; label AI-generated content |
| Minimal risk | Most other applications | No specific obligations; voluntary codes of conduct encouraged |
Most marketing, support and sales-assist agents mainly face transparency obligations. If your agent is used for recruitment screening, worker management or credit assessment, it may qualify as high-risk; talk to a lawyer early.
Marketing and outreach compliance
- Marketing emails to European prospects must follow national e-marketing rules and GDPR. See B2B outbound for AI agents.
- Analytics and advertising cookies usually require prior consent, and cookie banners must make "reject" as easy as "accept".
- In countries such as France, websites must publish a legal notice (mentions légales) identifying the publisher.
Customer-facing compliance materials to prepare before launch
- Privacy policy for website visitors and users
- Data processing agreement (DPA) template
- Sub-processor list
- Security overview (encryption, access control, backups, incident response)
- AI usage statement: which models you use, whether data trains models, how end users are told they are interacting with AI
- Data storage regions
- Data deletion and export process
- Contact for data protection questions
Putting these on a "Trust center" or "Security" page makes European procurement reviews much smoother. Related: Building trust overseas as a team from China.
FAQ
Do small teams have to comply with GDPR?
Yes. GDPR applies to organizations processing personal data of people in the EU regardless of size, although some obligations scale with the volume and risk of processing.
Do we need ISO 27001 or SOC 2?
They are not legally required, but many mid-size and large buyers make them procurement requirements. Early on, prepare a security overview and questionnaire answers, and plan certification when customers need it.
We use overseas model APIs. Do customers need to know?
Model providers are usually your sub-processors. List them in your sub-processor list and state whether data is used for training.