The National Commission on Informatics and Liberty (CNIL) and the AI and Digital Council (CIANum) have published a joint exploratory note on the challenges of agentic artificial intelligence (AI) for data protection.
This analysis highlights that agentic AI, through its ability to access multiple data sources, act on behalf of the user, and use persistent memories, amplifies risks to personal data. The complexity of the data flows generated promotes the creation of hyper-personalized profiles and can lead to a loss of control for individuals, putting the principles of the GDPR under strain. The autonomy of these systems also raises questions about the sharing of responsibilities among the actors involved and extends cybersecurity risks. The note concludes that, although the current legal framework is applicable, an adaptation of its implementation is necessary to address the specificities of these technologies.