The Spanish Data Protection Agency (AEPD) has recommended users to set “clear limits” for artificial intelligence (AI) assistants under the premise that “the agent prepares and the person approves”, and has advised against granting permanent authorizations, in addition to reviewing the memory, history, and privacy of these tools to protect personal data.
The authority has published the document “AI Assistants and Agents: Decalogue for Users”, a set of tips and recommendations to leverage the potential of these tools without lowering security guarantees. As explained by the AEPD, artificial intelligence assistants and agents can perform tasks autonomously, a capability it considers useful, but which also modifies the nature of errors when the system not only responds, but acts.
“When the assistant only responds, an error is a wrong answer. When it acts, it is an email sent, a file shared, a purchase, a contract or a consent given on your behalf,” details the Agency, which proposes asking five questions before delegating any task:
Real risks and indicative limits
The AEPD warns that “these are not theoretical risks” and gives the recent example of a user who tasked their agent with selling an object and chose the option “always allow”, thinking that it would continue to ask for authorization before accepting offers. The system closed the deal and provided its address to the buyer, who appeared at the seller's home without the seller knowing that the appointment had been arranged.
Therefore, the Agency recommends clearly indicating what the agent should and should not do, although it reminds that “these limits are indicative, but do not replace permissions and confirmations”.
Identified providers, memory controls and third-party protection
Among the advice in the document is to review who provides the service and choose clearly identified providers, who allow exercising rights in the European Union and, preferably, process data on the device itself. The Agency also recommends using the service's memory, history, and privacy controls to delete information, without relying solely on asking the assistant within the conversation.
The AEPD also points out that a website, an email, a document or a calendar invitation may contain hidden instructions, even invisible to the naked eye, such as white text on a white background, intended for the agent to do something different from what the person asked, such as sending data or approving an operation. “Since no measure completely eliminates this risk, the best protection is to limit what the agent can do if it manages to be deceived,” the document emphasizes.
The text also reminds that emails, calendars or photos may contain information from other people who have not decided to interact with that AI, so it calls for equally protecting third-party data.
Shared devices, minors and work use
On shared devices, the Agency advises using separate profiles and, if used by minors, creating specific profiles and accompanying them during use. In terms of security, it recommends protecting the account and device, installing only add-ons and connectors from known sources, supervising the agent, knowing how to stop it and withdrawing its accesses before needing it.
In the workplace, the AEPD highlights the importance of using only the assistants authorized by each organization and not connecting professional email or documents to a personal AI account.
Responsibility does not fall solely on the user
The decalogue emphasizes that responsibility for AI assistants and agents cannot fall solely on the user. According to the document, those who offer tools capable of acting on behalf of people should incorporate clearer controls, including understandable permissions that distinguish between consulting and acting, configurable confirmation for high-impact actions, a history of what the agent has done, an immediate way to stop it, memory management and deletion, information on who the data is sent to and whether it is used to train the AI, and a simple way to exercise rights.