Reco CEO Ofer Klein says European firms often miss AI access in many tools

A July 2026 IAPP investigation of 2,400 business software providers found 63.6% failed to disclose all AI sub‑processing activities, and nearly a third admitted involvement in sensitive‑data processing or automated decision‑making. Recent guidance from Spain’s data‑protection authority and the UK’s ICO stresses the need for clear reasons why an AI agent can access personal information, and calls for strict permission controls, monitoring and human oversight. Klein recommends firms maintain a live inventory of AI agents, map their permissions and data sources, and regularly audit access to stay compliant with GDPR and the EU AI Act.

For entrepreneurs selling AI‑enabled solutions, buyers are increasingly demanding evidence of data‑access controls, turning AI governance into a sales differentiator rather than just a compliance checkbox.