Eight hours, nobody watching — unattended agent runs meet GDPR Article 22

Writer's Palmyra X6, announced 13-14 August 2026, is described by its maker as able to work unattended toward a single goal for up to eight hours. The duty engineers reach for is AI Act Article 26(2), which requires deployers to assign human oversight to named natural persons with the competence, training and authority to exercise it - but Article 26 binds deployers of high-risk systems, and Regulation (EU) 2026/1744 moved the Annex III high-risk obligations to 2 December 2027. The clause that binds an eight-hour unattended run this morning is GDPR Article 22(1), applicable since 25 May 2018, with no risk tier and no transitional period. SCHUFA (C-634/21, 7 December 2023) closes the obvious escape: the Court read 'decision' broadly and treated an automated value as a decision where it determined what followed, so authorising the goal at hour zero is not the same as a human interrogating the decision at hour six.

Post

An agent that runs unattended for eight hours is eight hours nobody witnessed. The compliance clause that lands first is not the one in the AI Act.

Writer published Palmyra X6 on 14 August. Its own post: the model "can work unattended toward a single goal for up to eight hours, sustaining coherent reasoning across long, multi-stage objectives."

The numbers are why teams will ship it. An average of 0.87 across nine evaluations, at $2 per million input tokens and $8 output — against Claude Opus 4.8 at 0.86 for $15 and $75. The harness upgrades claim 52% lower cost, 48% faster, 10% better quality.

Now the European part, and the correction.

Reach for the AI Act and you land on Article 26(2): "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." A real duty — on deployers of high-risk systems. The Digital Omnibus, Regulation (EU) 2026/1744, moved Annex III high-risk to 2 December 2027.

The clause that binds this morning is older. GDPR Article 22(1): the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects the person. In force since 2018. No risk tier. No grace period.

Then read SCHUFA, C-634/21, decided 7 December 2023. The Court gave "decision" a deliberately broad scope and treated an automated value as one where it plays a determining role in what follows — a later human signature does not undo that.

That is the trap in an eight-hour run. Approving the goal at hour zero feels like human involvement. Article 22 asks who interrogated the decision, not who authorised the session.

What I'd do Monday:

  1. Log decision points, not just tool calls. A trace of API calls is not a record of who decided.
  2. Name the natural person who can overturn an agent output. Article 26(2) asks in December 2027. Your DPO can ask today.
  3. Checkpoint any step producing a legal or similarly significant effect on a person.
  4. List which steps in your longest run are solely automated. If you cannot list them, that is the finding.

Autonomy got cheap this month. The record of who decided did not.

Which step in your longest agent run could you name a human for this morning?

#AgenticAI #GDPR #EUAIAct #AIEngineering #Berlin

First comment

Sources, primary first —

Writer, 14 August 2026 — the model itself: the "up to eight hours" unattended claim, the 0.87 average across nine evaluations, the $2/$8 pricing, 26 seconds per task and 82 tokens per second. Date taken from Writer's own post; SiliconANGLE covered it on 13 August, so treat the announcement as 13–14 August. https://writer.com/blog/palmyra-x6-major-harness-release/

SiliconANGLE, 13 August 2026 — independent coverage, same figures, the earlier of the two dates https://siliconangle.com/2026/08/13/writer-launches-major-agentic-ai-improvements-palmyra-x6-flagship-model/

GDPR Article 22 — the text itself. Read paragraph 1 against your longest agent run. https://eur-lex.europa.eu/eli/reg/2016/679/oj

CJEU, Case C-634/21 SCHUFA Holding (Scoring), judgment of 7 December 2023 — "decision" given broad scope, and the determining-role test https://curia.europa.eu/juris/liste.jsf?num=C-634/21

AI Act Article 26 — paragraph 2, the deployer's duty to assign oversight to named natural persons https://artificialintelligenceact.eu/article/26/

One point cut for length: Article 22(2)(a) lifts the prohibition where the decision is necessary for entering into or performing a contract — but 22(3) then still requires human intervention, a right to express a point of view and a right to contest. The exception buys you the automation, not the silence.

Claims

Sources

Corrections

None for this edition. The announcement date is published as a 13-14 August range because Writer's own post displays 14 August while independent coverage is dated 13 August.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.