The Spanish Agency for Data Protection (AEPD) advises citizens to establish "clear limits" on the use of assistants and artificial intelligence (AI) agents, under the idea that "the agent prepares and the person approves." The agency discourages granting permanent authorizations and encourages frequently reviewing its memory, history, and privacy settings to safeguard personal information.
These guidelines are included in the document "Assistants and AI Agents: Decalogue for Users," where the Agency offers recommendations to take advantage of these technologies with the highest possible level of security.
The AEPD reminds that assistants and AI agents can perform tasks autonomously. It acknowledges their "usefulness," but warns that "the leap from responding to acting changes the nature of errors."
"When the assistant only responds, an error is an incorrect answer. When it acts, it is an email sent, a file shared, a purchase, a contract, or consent given on your behalf," explains the Agency. Therefore, it raises five key questions before delegating decisions to these systems: what it can see, what it can remember, what it can do on behalf of the person, where it sends the data, and whether its actions affect third parties.
In this regard, the AEPD insists that "these are not theoretical risks." As an example, it mentions the case of a user who ordered their agent to sell a product and selected the option "always allow," thinking it would continue to request confirmation before accepting offers. The agent closed the transaction on its own and provided the seller's address to the buyer, who showed up at their home without them knowing that the appointment was arranged.
Therefore, the Agency recommends precisely defining what tasks the agent can perform and which it cannot. "These limits are indicative, but do not replace permissions and confirmations."
Choosing the provider well and controlling memory
Among the recommendations, the AEPD suggests checking who is behind the service and opting for clearly identified providers, who allow exercising rights within the European Union and, if possible, process data directly on the user's device.
It also urges actively using memory, history, and privacy management options to delete sensitive information, without limiting oneself to asking the assistant within the chat itself.
The Agency warns that a webpage, an email, a file, or even a calendar invitation may include hidden instructions, invisible at first glance (for example, white text on a white background), designed for the agent to execute actions different from those requested, such as sending data or authorizing a transaction.
"As no measure completely eliminates this risk, the best protection is to limit what the agent can do if it manages to be deceived," emphasizes the AEPD.
Protecting also the data of other people
The document reminds that in emails, agendas, or photographs there is often information about third parties who have not decided to interact with that AI, so the protection of their data must be heightened.
On shared devices, the Agency advises creating differentiated profiles and, when minors use them, setting up specific accounts for them and accompanying them while they use these services.
Security, supervision, and use at work
Regarding security, the AEPD recommends reinforcing the protection of both the account and the device, and installing only add-ons and connectors from reliable sources. It also encourages continuously monitoring the agent's performance, knowing how to stop it immediately, and revoking its accesses before they are no longer necessary.
In the professional environment, the Agency emphasizes that only AI assistants authorized by each organization should be used and that corporate email or work documents should not be linked to personal AI accounts.
More responsibility for AI companies
The ten-point document stresses that the burden of responsibility for the use of assistants and AI agents cannot fall exclusively on the user. "Those who offer tools capable of acting on behalf of individuals should also provide controls: understandable permissions that distinguish between consulting and acting, configurable confirmation for actions of greater impact, a history of what the agent has done, an immediate way to stop it, management and deletion of memory, information on who the data is sent to and whether it is used to train the AI, and a simple way to exercise rights," concludes the AEPD.