AEPD urges clear limits for AI agents handling data

In “Alarms are raised over possible AI security breaches: the AEPD calls for clear limits to protect personal data,” ElConstitucional.es reports that the Spanish Data Protection Agency (AEPD) has published a ten-point guide for users of AI assistants and agents. The authority reportedly recommends applying the principle that “the agent prepares and the person approves,” avoiding permanent authorisations, and reviewing memory, history and privacy settings. The account describes user recommendations, rather than enacted legislation or a regulatory decision imposing general AI obligations.

According to the same account, the AEPD warns that websites, emails, documents and calendar invitations can contain hidden instructions intended to make an agent transmit data or approve a transaction. Users are therefore advised to restrict available actions in advance, protect third-party data and, at work, use only tools authorised by their organisation. The authority also reportedly calls on providers to offer understandable permissions, configurable confirmation for high-impact actions, activity histories, an immediate stop mechanism, memory deletion and information about data recipients and possible use of data to train AI. The primary text of the guide was not consulted, so the content and scope of these recommendations have not been independently verified beyond the ElConstitucional.es account.