There is a demo where everything works. Someone types a question, the agent does seven things in a row, and a tidy answer appears on screen. I have watched dozens of them and built a few myself.
What never appears in a demo is the case where it goes wrong. Not because that does not happen, but because it spoils the demo. And that is exactly the gap between showing something and running it.
Part one of this series was about what survives when a supplier falls away. This part is about something nearer and more frequent: your agent keeps running, and says something that is not true.
The case that settles it
A man booked a flight with Air Canada after a death in the family. The airline’s chatbot told him he could apply for a discount afterwards. That policy did not exist. The bot had invented it.
When he later asked for the money, he was refused and took it to the tribunal. There, Air Canada argued that the chatbot was a separate legal entity responsible for its own actions. The tribunal called that a remarkable submission, and held that a customer is not responsible for cross-checking information between different parts of the same website.
That draws the line. What your agent says, you said. There is no intermediate layer where liability comes to rest, not even when the model invented something that appears nowhere in your documentation.
And since 2 August there is a fine for staying quiet
Since 2 August 2026 the transparency duty in the AI Act binds directly. You have to make clear that a person is dealing with an AI system, and synthetic output has to be marked as such. The penalty ceiling sits at fifteen million euro or three percent of global turnover, whichever is higher, with the lower of the two applying to smaller companies.
There is a misunderstanding here that I heard in the webinar behind this series, and have run into a few times since. The Digital Omnibus package moved the deadline for high-risk systems under Annex III to 2 December 2027. Article 50 was deliberately kept out of that. Confuse the two and you think you have another eighteen months while the transparency duty already binds you.
Two tracks, two dates. Dull to remember, expensive to mix up.
| What | From when | About |
|---|---|---|
| Article 50, transparency | 2 August 2026 | Disclosing it is AI, marking synthetic content |
| Annex III, high risk | 2 December 2027 | Heavier duties for risky applications |
Five gates
The framework the speakers use for this has five steps: see, constrain, interrupt, review, recover. What makes it usable is that these are not abstract principles but things you can point at in a system.
The hinge is a decision log per agent action, with five fields: who did it, what went in, which action followed, what the result was, and at which value it has to go to a human.
Almost everything else follows from that one log.
See is the log itself. Without it you do not know what happened, and the other four gates are theoretical.
Constrain hangs off the actor field. If you know which identity performed the action, you can attach rights to it: which data, which tools, which actions are and are not allowed.
Interrupt hangs off the escalation criterion. The speakers used a threshold as their example: below a value of 250 the agent decides on its own, above it a human has to approve.
Review is reading along periodically. Not sampling at the moment something breaks, but as a standing habit.
Recover is policy sitting ready for the moment that review turns up something that should not have happened. Report, escalate, roll back.
My own read: in most organisations I see up close, gate one is reasonably in order, because logging is part of the trade. Gate five is usually thinnest. There is an incident process, but it was written for systems that break, not for systems doing something the technology allowed and the organisation did not.
The question buyers now ask
What struck me is that the speakers presented this as something they get grilled on. The two questions they say keep coming back from procurement: show us how you stop the agent, and show us what work the agent has done.
Those are gate three and gate one, and they are precisely the two a demo tells you nothing about. Anyone selling an agent to an organisation that is sharp on this cannot get by with a video where things go well.
At the same time, this is where the framework sells itself. It came from a vendor webinar, and a list of gates you fail on is a fine reason to buy something that fills them in for you. That does not make the structure less useful, but it is worth knowing whose toolbox you are borrowing.
The caveat
The log moves the problem to the person reading it. Five gates look like five controls on paper, but gate four is a habit rather than a mechanism. A system that records everything and that nobody reviews is not controlled, it is documented. That distinction disappears easily into an audit report noting that logging is present.
The threshold is a choice dressed as a fact. Below 250 the agent may decide, above it may not. Where that number came from is a trade-off between harm and convenience, and the moment it sits in a config file it reads as policy. Mine is not an amount but an action: I publish by hand, I let scheduling be automated. Just as arbitrary, except I can explain it.
And then the part that shifts toward the user. Article 50 makes you disclose that a machine is on the other end. That is a gain, and it also relocates work: someone who knows they are talking to an AI is expected to factor that in. The Air Canada ruling pointed the other way, holding that the customer does not have to check. Those two lines do not clash yet, but the day a company argues that the on-screen disclosure made the customer partly responsible is coming.
What I am doing
I do not run a customer-facing agent, so Article 50 does not touch me directly. What does sit on this site is work a model helped with, and I have my own rule for that: the approach goes in the article itself, not in a footnote afterwards.
The gate I take seriously for myself is the third. My project instructions state hard that nothing goes live directly: everything is scheduled, publishing is manual, and a scheduled publication can still be stopped. That is exactly one human interruption at the point where a mistake becomes visible to other people.
Gate five is thinnest here too, and writing that down is more honest than pretending I have a procedure. If something wrong goes live, my recovery is a commit and a cache purge. That works for a blog. It is not an incident process.
Frequently asked questions
Does Article 50 apply to a small site or a sole trader?
Yes, the transparency duty looks at the application rather than the size of the company. For smaller companies and start-ups the lower of the two amounts applies to a fine. Practically: if visitors talk to a chat function driven by a model, that belongs on the screen.
Is a decision log not just the logging we already have?
Partly. The difference is in the fields. Ordinary application logging records that a call happened and whether it succeeded. A decision log records who acted, on what, with which result, and when it should have gone to a human. That last field is the one you usually do not have.
What if the agent promises something that is in our policy but out of date?
The outcome is probably no different. The reasoning in the Air Canada case was that a customer does not have to work out which part of your information is correct. Outdated policy is still your information, so that argument does not help.
Why is high risk now set at December 2027?
The Digital Omnibus package moved that deadline. Article 50 was deliberately not moved with it, so the transparency obligations bind earlier than the heavier duties for risky applications.
Sources
- Webinar “Sovereign AI in the enterprise: from data residency to operational control”, Freeday, 20 August 2026 — linkedin.com/events
- Moffatt v. Air Canada, British Columbia Civil Resolution Tribunal, accessed 20 August 2026 — bccrt.ca
- Transparency obligations under Article 50 of the AI Act, in force since 2 August 2026, accessed 20 August 2026 — digital-strategy.ec.europa.eu
Checked on 20 August 2026. The five gates and the decision log come from the webinar, which I read via the English caption file LinkedIn ships with it; that file contains machine errors in names, so no direct quotes from the speakers appear here. The start date of Article 50, the penalty amounts and the move of the Annex III deadline to 2 December 2027 I verified separately. The tribunal ruling in the Air Canada case is public and dates from 2024; the account above follows the substance of that ruling rather than the phrasing used in the webinar. What I could not verify is the claim that procurement departments ask these two questions as a matter of course: that is the speakers’ experience, shared without numbers, and I have no second source for it. The mapping between the five gates and specific articles of the AI Act was mentioned in the webinar but not worked out, so it does not appear above.