Governance work has a reputation for slowing projects down. In our experience it slows down exactly one thing: connecting an agent to data nobody has permission to use.
Answer four questions first
Before an agent reads a single record, we write down the answers to four questions. What personal data does it touch. On what legal basis. How long is anything retained. Who can see the logs.
None of these require a lawyer to draft the first version. They do require somebody to own the answer, and they belong in the scoping document rather than in a review three weeks before launch.
Retention is a design decision
Teams often discover late that their agent has been keeping full conversation history indefinitely because that was the default. Retention has to be chosen: how long, where, and who can purge it.
We default to the shortest window the process tolerates, keep prompts and retrieved passages separate from personal data where we can, and make deletion a tested operation rather than a promise.
Auditability is the point, not the paperwork
The requirement that changes system design most is being able to explain a decision after the fact. That means logging the inputs, the documents retrieved, the tools called, and the output, in a form somebody can replay.
Build that in from the start and the compliance conversation becomes a walkthrough. Bolt it on afterwards and it becomes a rewrite.