European AI research non-profit Aithos has found that the leading AI models routinely fail key legal compliance tests under EU law, raising concerns for enterprises deploying AI-powered customer service and support agents.
The findings come from LARA (Legal Assessment for Real-world Agents), a publicly available testing framework that Amsterdam-based Aithos has developed to evaluate how AI systems behave when faced with real-world tasks that could trigger obligations under the General Data Protection Regulation (GDPR) and the EU AI Act.
According to the research, all 12 frontier AI models tested failed compliance assessments across a range of scenarios involving data protection, manipulation, emotion inference, psychological profiling and human oversight requirements. Even the highest-performing model violated applicable regulations in nearly half of the test runs, while the lowest-performing model failed in 93 percent of scenarios.
For customer experience teams investing in AI agents to automate customer interactions, the findings highlight a widening gap between AI capabilities and regulatory readiness. Nadia Kadhim, Executive Director of Aithos, said:
"These are not abstract legal violations and the results should concern anyone interacting with an AI system, not just the businesses deploying them. These laws are in place because AI can cause real harm to real people. Our autonomy, privacy and other fundamental human rights are at play."
Compliance Responsibility Sits With Deployers
The research highlights the risk to enterprises building customer-facing AI experiences, as legal responsibility does not primarily rest with model developers.
Aithos pointed out that under both the GDPR and the EU AI Act, “[b]usinesses—not the AI model’s creator—building AI agents and putting them on the market bear primary legal responsibility for compliance with the EU AI Act and GDPR. Organisations that then deploy that agent carry accountability as well.
The potential penalties for failing to comply are substantial, with GDPR violations incurring fines of up to €20MN or 4 percent of annual global turnover, while breaches of the EU AI Act could result in penalties of up to €35MN or 7 percent of worldwide revenue.
The regulations also have extraterritorial reach, meaning that businesses processing European customers’ data or deploying AI systems that affect people in or from the EU are subject to enforcement regardless of where they are headquartered.
Customer Interactions Expose Legal Risks
LARA evaluates AI agents in simulated workplace environments where models can access tools such as email, messaging platforms, calendars, customer databases and social media channels.
Rather than measuring model performance through static benchmarks, the system assesses how agents behave when responding to realistic requests that could create legal or ethical concerns.
