Current AI agent and model architectures cannot technically satisfy GDPR Article 17 right-to-erasure because trained weights are not row-deletable, and the achievable substitute — un-indexing — requires protocol-layer components (revocation lists, per-query consultation, logged refusals, third-party audit) that do not yet exist. Regulators are beginning to enforce erasure rights against deployed agent systems, creating urgent legal liability. A new category of compliance infrastructure is needed that operates at the retrieval and serving layer rather than the training layer.

AI agents cannot satisfy right-to-erasure requests because no protocol exists to propagate revocation signals across retrieval, serving, and downstream agent chains — creating acute legal liability as regulators begin enforcement.

Compliance leads and platform engineers at companies deploying customer-facing AI agents in EU-regulated markets (fintech, healthtech, SaaS with EU users).

GDPR fines scale to 4% of global revenue and regulators are actively targeting AI systems; companies will pay significant premiums for compliance infrastructure that shields them from existential penalties, similar to how they already pay for SOC2/privacy tooling from OneTrust and BigID.

MVP is an open protocol spec plus a hosted revocation registry service: agents register data-subject identifiers at ingestion, erasure requests propagate as signed revocation tokens that participating agents must consult pre-query, with logged refusal receipts for audit — built on a lightweight API gateway with webhook subscriptions, no blockchain needed.

Global data privacy management market is ~$3B growing to $25B+ by 2030; the AI-agent-specific compliance slice is nascent but every company deploying agents in regulated markets (tens of thousands) becomes a buyer as enforcement ramps.