Any EU operator using external LLM providers

When an AI agent without egress filtering sends internal data to a third-party LLM provider, it moves personal or proprietary data to an external server with a different data controller. Under GDPR Article 33, this is potentially a reportable data breach requiring notification within 72 hours. The fine for a breach -- and for failure to notify within the window -- reaches 4% of global annual turnover. Most companies do not know the breach happened until long after the reporting window has closed, compounding the liability.