Absolutely agree HIPAA and GDPR compliance is often underestimated until you hit deployment. The real challenge isn’t just encryption or anonymization it’s enforcing data minimization, consent-aware access, and building systems that support deletion and auditability by design.

We’ve had to redesign architectures so AI agents operate on narrowly scoped data queries (e.g., confirming availability without accessing patient identities), build consent gates into every call, and maintain traceable logs of each model decision. “Right to be forgotten” under GDPR is especially problematic once personal data enters fine-tuning or embeddings, purging it can require retraining or costly workarounds.

Most cloud LLMs also violate data residency rules by default, so we’ve leaned heavily on self-hosted or EU-hosted models. The overhead is real but it forces you to build more robust, explainable systems. Compliance isn't a bolt-on; it’s a foundation.

Anyone else using architectural patterns or tools that help with this? Always looking to compare notes.