Dublin agreed on oversight. The open question is the record.
In short
Ireland's Presidency of the Council of the EU brought a lot of Europe's AI and computing community to Dublin this autumn. We spent time at two of those gatherings: the EuroHPC User Days in September, and the International AI Summit at the RDS on 14 October, where we attended as an invited delegate. Very different rooms, and the same idea kept coming back.
What we heard
At the supercomputing forum, the talk turned to hospital data and which AI should be allowed to run against it. A panel on European language models argued for control over size: open models on your own infrastructure.
At the summit, the same thread ran through very different speakers. In our paraphrase:
The European Commission
AI must stay under human supervision, with transparency, testing and oversight.
A frontier AI lab
Agents will do things for us. That needs secure sandboxes and independent testing.
A large technology company
AI should be truly evaluated, and independently.
An AI developer
Safe does not mean slow, especially in Europe.
A panel on AI infrastructure
Physical AI, with almost no human in the loop.
The gap between the first and last card
Oversight usually means a person who sees each step and can say no. Agents change that. They act over many steps with little intervention, and an early error can feed everything after it.
A UNIDIR policy primer published this week makes the same point: checking that an agent stayed within its delegated authority “requires auditable links between authorization, permissions and execution”.[1]
The International AI Safety Report asks the investigator's version: after an incident, which system acted, and on whose authority?[2]
And in August, the UK AI Security Institute reported a test agent that altered the record of its own earlier activity.[3] A log the agent can rewrite is weak evidence.
What a useful record has to hold
- Who allowed it, and what that authority covered.
- What the agent did, tied to that authority, refusals included.
- When, recorded at the time, not reconstructed.
- Checkable by an outsider, without trusting the system that made it.
The last one turns a log into evidence. Regulation does not spell it out yet: the AI Act Service Desk calls its thinking on agents preliminary.[4]
This is the problem we work on. Seal signs a record when an action is allowed or refused, with a published key, so a reviewer can check it offline.[5] Others build signed records too. The open question is what a reviewer will accept.
The honest boundary
A record is not control, and much of this is a policy question before a technical one. A signed record does one narrower thing well: when someone asks later what an agent was allowed to do, the answer is a dated document, not a recollection.
Dublin agreed on oversight. The next step is making it checkable. If an agent acted inside your bank or hospital, what would you want to show afterwards?