AI for workflow and process automation: the European buyer's guide
What the category actually covers
Workflow automation, at its base level, means connecting software systems so that information moves between them without a person carrying it manually. A completed web form triggers a notification in Slack; a new entry in the CRM creates a corresponding project in the task management tool; an invoice received by email becomes a line item in the accounting system with the appropriate fields populated. At that level, there is no AI involved, and the market has been solving this problem since Zapier's founding in 2011. What has changed meaningfully in the last two years is the addition of an AI layer: systems that can parse unstructured input, interpret ambiguous instructions, extract structured data from documents, and route information based on inferred intent rather than explicit rules. The category is now genuinely different from what it was in 2022, which means evaluation frameworks that served procurement teams then are likely to miss the questions that matter now.
The European market and its structural divisions
For European operators, the workflow automation landscape has three tiers that roughly track along the data sovereignty axis. At the cloud-native end, Zapier and Microsoft Power Automate offer the broadest integration libraries and the most accessible onboarding experience, with Zapier's catalogue exceeding 6,000 apps and Power Automate's distribution embedded across Microsoft 365 tenants. Both route execution data through US-based infrastructure by default — credentials, trigger payloads, and execution logs all pass through servers outside the EU — and both require careful contractual management for any workflow that touches personal data under GDPR, particularly given the ongoing complexity of data transfer mechanisms to the US. In the middle tier, Make (the platform formerly known as Integromat, acquired by Celonis in 2023) operates European data centres and provides stronger data-localisation options, though its AI augmentation features remain less mature than the US-based platforms. At the sovereignty-first end, n8n offers self-hosting as a first-class deployment model: operators run the platform on infrastructure they control, workflow data does not pass through n8n's servers unless cloud features are explicitly enabled, and the fair-code licence allows inspection of the codebase.
The AI Act layer that changed the evaluation in 2025
The obligations introduced by the EU AI Act add a compliance dimension to workflow automation procurement that was absent twelve months ago. A platform that incorporates AI features — document classification, entity extraction, automated decision routing, content generation — needs to be assessed against the Act's risk classification framework, particularly when its outputs influence decisions about individuals. Article 26 obligations on deployers apply wherever an AI component falls within the Annex III high-risk categories, which includes systems used in employment management, access to essential services, and similar contexts. Before committing to any AI-augmented workflow tool, operators should request from the vendor its technical documentation covering the AI components embedded in the platform, its statement on Annex III risk classification, and its intended purpose documentation in the format required by Article 13. Most vendors have not yet prepared these documents in a form that satisfies EU requirements, which is directly useful information: it tells the buyer how seriously the vendor has engaged with the regulatory environment in which European operators actually operate.
The questions that sort the field rapidly
The evaluation questions that matter most for EU buyers are operational rather than conceptual. Can the platform be deployed on EU-hosted infrastructure without routing execution data back to the vendor's cloud? What data does the platform vendor retain from workflow runs — credentials, payloads, AI model inputs — and under what retention policy? When the platform makes AI model calls (for entity extraction, classification, or generation), which models are used and through which API, and where are those API calls routed? Does the vendor offer a Data Processing Agreement that meets GDPR requirements, and has it been reviewed in the context of the specific transfer mechanisms applicable to the vendor's infrastructure arrangements? A vendor that cannot answer these questions clearly and specifically — not with a privacy policy link, but with a technical architecture answer — has not invested in compliance readiness at an architectural level. That assessment, made early in the procurement process, saves considerably more time than it costs.