AI Safety for AI Agents in Europe Part I : AI Output Is Not Authority to Act — Hallucination-Proof, Cryptographically Non-Completable Execution Control Supporting EU AI Act Human Oversight, Robustness and Record-Keeping

AI agents now send payments, write to databases, export personal data, change networks, deploy code and command machines. An agent can be fully authenticated, run an approved model and behave normally, yet still produce a hallucinated, unsupported, stale or prompt-injected output that becomes a real consequence. Sandboxes, gateways, allow-or-deny policy engines, classifiers and confirmation prompts decide whether an agent may act. None of them proves that this specific output is fit to become this specific effect. This disclosure describes a pre-execution enforcement architecture that closes that gap: Non-effective hold. Every effect-capable AI output is held as a non-effective Candidate Act. Isolated validation. An enforcement domain isolated from the agent checks it first. The checks cover model and workflow integrity, runtime behaviour, output provenance, claim-level factual grounding, a permitted action envelope (blast radius), a dry-run consequence simulation, and policy and revocation freshness. Receipt before release. A tamper-evident validation receipt is committed before any authority exists. Act-bound authority. A single-use, non-bearer authority is then released. It is bound to the act’s hash, the exact execution endpoint, the current policy and revocation state, and a nonce. Structural non-completability. In the strongest form, the endpoint holds only a fragment of the execution material. It cannot complete the act until the matching fragment arrives, so copied tokens, privileged software and bypass paths fail. Escalated release. Elevated-risk acts are not simply denied. They proceed under escalated release: reduced scope, human approval bound to the exact action, canary or sandbox-first execution, two-phase commit and release tokens, or paired rollback capabilities. Further coverage. The disclosure also covers: ephemeral single-use execution environments; enforcement proxies for legacy APIs; anti-downgrade assurance levels; privilege ceilings across multi-agent chains; fragmented or delegated actions; closure of break-glass, fallback and fail-open paths. Latency. Hot-path checks are stated at 1–25 ms, and sub-millisecond to 3 ms on DPU or SmartNIC. This disclosure is based on PCT/IB2026/055760 (WO 2026/150383, filed 7 June 2026, published 16 July 2026), a companion filing in the family built on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration. EU relevance (AI-generated) This section was generated with AI assistance. It is not legal advice and is not a statement that any implementation satisfies EU law. Readers must cross-check it against the original PCT filings on WIPO PATENTSCOPE and against the official legal texts before drawing any conclusion. Naming a company shows topical relevance only. It is not an endorsement, a validation or a statement of infringement, and no company named is affiliated with the inventor. The architecture offers technical mechanisms that map onto several EU obligations. EU AI Act. Possible supporting evidence for the following provisions: risk management (Article 9); automatic record-keeping, through receipts committed before any action (Article 12); human oversight, through approval bound to the exact action rather than a generic click (Article 14); accuracy, robustness and cybersecurity, through claim-level grounding, consequence simulation and resistance to manipulation (Article 15). GDPR. Data protection by design (Article 25) and safeguards around automated decisions (Article 22). This works by holding personal-data exports and decisions until purpose, recipient and data class are verified. DORA and NIS2. ICT risk control and incident containment for AI-driven operations in finance and essential services, through fail-closed and break-glass path closure. Cyber Resilience Act. Secure-by-design products with digital elements that embed AI agents. PSD2, PSD3 and the Payment Services Regulation. Strong customer authentication and authorisation evidence for agent-initiated payments. eIDAS 2 and the European Digital Identity Wallet. Agent mandates and approvals. EU Space Act. Command authorisation for autonomous spacecraft. European organisations working in these areas include: AI developers: Mistral AI, Aleph Alpha. Enterprise software: SAP. Industrial control: Siemens, Schneider Electric, ABB. Security hardware and HSMs: Thales, Infineon, NXP. Payments and banking: Adyen, Worldline, SWIFT, major EU banks. Telecom: Ericsson, Nokia, Deutsche Telekom, Orange. Aerospace and space: Airbus, ESA. For EU bodies such as the EU AI Office, CEN-CENELEC JTC 21 (harmonised AI standards) and ENISA, the disclosure supplies vocabulary for one point in particular: the boundary at which AI computation becomes an external consequence. Keywords: AI safety; agentic AI safety; EU AI Act; human oversight; Article 14; record-keeping; Article 12; robustness and cybersecurity; Article 15; GDPR; data protection by design; DORA; NIS2; Cyber Resilience Act; AI agent guardrails; hallucination prevention; prompt injection containment; tool-call authorization; pre-execution enforcement; non-bearer capability; zero-trust execution; human-in-the-loop approval; blast radius; confidential computing; TEE; HSM; DPU; fail-closed; AI agent payments; trustworthy AI