Your AI Trains on Unmasked Data.

It depends on how you use Agentforce. The EU AI Act focuses on AI systems. Combinations of AI models, software, and business processes. If your Agentforce deployment makes automated decisions about individuals that have significant effects (credit scoring, insurance pricing, employment screening, service prioritization), it likely qualifies as a high-risk AI system under Annex III. General-purpose use for content generation or summarization faces lighter obligations.

Article 10 requires that training, validation, and testing datasets for high-risk AI systems meet data governance standards: relevance to intended purpose, representativeness of the deployment context, and minimization of personal data. For Salesforce teams, this means customer records used to train or fine-tune AI models should be masked before use. Replacing real PII with realistic synthetic data that preserves the patterns the model needs.

Partially. GDPR requires a lawful basis for processing personal data, including for AI training. Using customer records to train AI models without explicit consent or another lawful basis is a GDPR risk. Separate from the EU AI Act. The EU AI Act adds additional obligations around technical documentation, data quality, and bias management for high-risk AI systems. CC addresses both simultaneously: DataMasker masks training data for GDPR compliance; the masking audit log satisfies EU AI Act documentation requirements.

High-risk AI system obligations (including training data governance requirements) apply from August 2026. General-purpose AI model obligations apply from August 2027. Organizations should begin classification and compliance work now. Data governance infrastructure typically takes 3-6 months to implement properly.

Yes. DataMasker's masking logs provide timestamped documentation of: which Salesforce objects and fields were included in training data exports, which masking rules were applied, and when the masking job ran. This output can be incorporated directly into the EU AI Act Article 11 technical documentation package for high-risk AI systems.

EU AI Act Article 10 requires that training data for high-risk AI systems be relevant, representative, and free from errors or bias, and specifically prohibits training on personal data beyond what is necessary for the intended purpose. When Agentforce or Einstein models reason over your Salesforce org, they access your full data landscape. Stale records, excess PII, and unmasked sandbox data all expand your AI Act exposure. Cloud Compliance addresses this at the data layer: Data Retention Manager deletes obsolete records before they reach AI training pipelines, and Sandbox DataMasker ensures AI models in development environments train on masked data, not live personal data.