An agent that runs unattended for eight hours is eight hours nobody witnessed. The compliance clause that lands first is not the one in the AI Act.

Writer published Palmyra X6 on 14 August. Its own post: the model "can work unattended toward a single goal for up to eight hours, sustaining coherent reasoning across long, multi-stage objectives."

The numbers are why teams will ship it. An average of 0.87 across nine evaluations, at $2 per million input tokens and $8 output — against Claude Opus 4.8 at 0.86 for $15 and $75. The harness upgrades claim 52% lower cost, 48% faster, 10% better quality.

Now the European part, and the correction.

Reach for the AI Act and you land on Article 26(2): "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." A real duty — on deployers of high-risk systems. The Digital Omnibus, Regulation (EU) 2026/1744, moved Annex III high-risk to 2 December 2027.

The clause that binds this morning is older. GDPR Article 22(1): the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects the person. In force since 2018. No risk tier. No grace period.

Then read SCHUFA, C-634/21, decided 7 December 2023. The Court gave "decision" a deliberately broad scope and treated an automated value as one where it plays a determining role in what follows — a later human signature does not undo that.

That is the trap in an eight-hour run. Approving the goal at hour zero feels like human involvement. Article 22 asks who interrogated the decision, not who authorised the session.

What I'd do Monday:

1. Log decision points, not just tool calls. A trace of API calls is not a record of who decided. 2. Name the natural person who can overturn an agent output. Article 26(2) asks in December 2027. Your DPO can ask today. 3. Checkpoint any step producing a legal or similarly significant effect on a person. 4. List which steps in your longest run are solely automated. If you cannot list them, that is the finding.

Autonomy got cheap this month. The record of who decided did not.

Which step in your longest agent run could you name a human for this morning?

#AgenticAI #GDPR #EUAIAct #AIEngineering #Berlin