AI Expo Europe 2026: What I Learned About AI Agents, Regulation and Real ROI
Notes from AI Expo Europe 2026 in Bucharest: a practical recipe for AI agents, the AI Act and NIS2 after the 2026 changes, and what is still missing.
On 1 and 2 November 2026 I spent two days at AI Expo Europe, held at the Radisson Blu Hotel in Bucharest. I went as a project manager who coordinates digital projects through Medusa Designs, with one question in mind: what does it take to move AI from an impressive demo to something a team uses every day, safely and legally?
This is not a summary of every session. It is what I took away for the work I do with clients: bringing AI into marketing and operations, and building AI agents that save time without creating new risks.
An event built around implementation, not hype
The line-up was strong. Among the headline speakers were Rod Evans (NVIDIA), Dimitris Andreadis (Red Hat, IBM), Daniel Barbu (Adobe), Alex Mcleman (Alibaba Cloud), Bart Veenman (KPMG Netherlands), Susana Morillas Fresno (Salesforce), Martijn de Grunt (Oracle) and Philipp Gamauf (ING). Two stages ran talks, panels and live demos, and in the exhibition area I watched robots working in real time, including robotics projects built by students, next to software for AI agents, data and security.
The opening keynote set the tone in an unusual way: a live fireside chat with Robot R-1, a humanoid robot, moderated by Peter Hopwood. Later, a robot dog walked between the stands while visitors filmed it.
What I noticed most was the tone of the discussions: fewer promises about what AI might do one day, and more questions about cost, return, data, security and the law.
From AI adoption to ROI
One of the panels I followed, “From AI adoption to ROI: scaling GenAI across startups and enterprises”, with Cristian Onețiu among the speakers, dealt with the step most companies struggle with: moving from experiments to implementation with measurable impact. It matched what I see in projects. A pilot needs a clear goal, success criteria and an owner, or it never leaves the test stage.
A practical recipe for an AI agent
For me, the most useful slide of the event came from Andrei Pața and Sergiu Vasilescu. They described an inbox agent as a simple recipe:
- Input: your inbox, the last 24 hours
- Connectors: Gmail or Outlook, your CRM, your ERP
- Context: who your clients are, open deals and unpaid invoices
- Output: one page sorted into urgent, reply, documents and noise
I like this format because it forces the right questions before any tool is chosen: what goes in, which systems the agent may touch, what it needs to know and what a good result looks like. It is very close to how I scope agents for clients, for example turning a medical practice’s busy inbox into an organised internal dashboard, with a person approving anything that is sent out.
A roadmap for AI agents in marketing
Several conversations came back to the order of work. My notes, in short:
- Map the process and its repetitive steps before buying any tool.
- Start with one agent and one clear job: reporting, inbox triage, content drafts or SEO checks.
- Connect only the data the agent really needs.
- Keep a person in the loop for anything that reaches a client.
- Measure the time saved and the errors, then decide whether to scale.
Where the legal limits are
A large part of the discussion was about limits: what AI may do, what it must not do, and what happens when a company crosses the line. Here is the context I put together after the event.
The EU AI Act after the 2026 changes
The AI Act (Regulation (EU) 2024/1689) works with risk levels. Some practices have been banned since 2 February 2025, such as manipulative techniques that exploit people’s vulnerabilities, social scoring and untargeted scraping of facial images. Obligations for general-purpose AI models have applied since 2 August 2025.
In 2026 the Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk deadlines: obligations for stand-alone high-risk systems now start on 2 December 2027, and those for AI built into regulated products on 2 August 2028. The transparency rules were not delayed. From 2 August 2026, people must know when they are talking to an AI system, and AI-generated or manipulated content such as deepfakes must be disclosed. Fines for prohibited practices can reach €35 million or 7% of worldwide annual turnover.
NIS2: security is a management responsibility
AI agents connected to email, a CRM and an ERP widen the attack surface, and this is where NIS2 comes in. Directive (EU) 2022/2555 was transposed in Romania by Government Emergency Ordinance 155/2024, approved by Law 124/2025. Companies in scope must register with DNSC, the national cybersecurity directorate, assess their risks and apply proportionate security measures, and their management can be held personally liable. Fines depend on the type of entity and the breach, and can reach millions of euros.
Europe, the United States and China take different paths
Europe regulates AI through one horizontal, risk-based law built around fundamental rights. The United States has no comprehensive federal AI law and relies on sector rules, executive orders and a growing patchwork of state laws. China follows a state-directed model, with filing and approval requirements for generative AI services and mandatory labelling of AI-generated content. For a European company this matters in practice: a tool designed for another market may not be usable here as it is.
When AI becomes a legal problem
The tool is rarely the problem; the use is. Cloning a voice or a face to deceive someone, feeding customer data into a tool without a legal basis under GDPR, or letting an agent make decisions about people without human oversight can turn a productivity gain into fraud, a data breach or a regulatory fine. The responsibility stays with the company that deploys the system.
This section is general information from my notes and public sources, not legal advice. Check your own case with a lawyer or your data protection officer.
Healthcare, education and cybersecurity
Three sectors came up again and again. In healthcare, AI is already useful for scheduling, documentation and sorting requests, while anything close to diagnosis falls under the strictest rules. In education, the focus was on teaching people to use AI critically, not just faster. In cybersecurity, AI works on both sides: it helps defenders spot threats, and it helps attackers write more convincing phishing. A whole panel, “The new cyber battlefield: fighting AI-powered threats with AI”, with Sebastian Cochinescu among the speakers, was dedicated to it.
Creativity: what was missing
Creative uses were shown mostly through graphic design, with a realistic view of what AI can and cannot do in that process. What I missed was music and film. None of the sessions I attended dealt with AI in sound, music production or cinema, even though these are some of the fields changing fastest. I hope the next edition makes room for them.
What I am taking into my projects
The emphasis of AI Expo Europe 2026 was on business value and technical implementation, and that is where my focus goes too. I will keep researching the tools and procedures presented, and bring three habits into every AI project: scope each agent like a recipe, check the legal and security side before the pilot, and measure the result before scaling.
If you are planning to bring AI into your marketing or operations, see how I approach AI implementation for business processes and AI agents for business operations. For the next edition of the event, visit the AI Expo Europe website.
Sources and further reading
Let’s turn a good idea into a digital experience that performs.
Strategy, design and implementation — brought together with clarity and purpose.
Start a conversation