The Norwegian Data Protection Authority (Datatilsynet) warns about the risks related to the emergence of autonomous artificial intelligence agents and makes recommendations for their proactive management by companies.

The authority highlights that artificial intelligence is evolving from simple tools to autonomous agents capable of performing tasks, accessing information systems, and processing personal data. This autonomy creates a risk of "shadow AI," where automated processes, referred to as "digital ghosts," continue to operate without supervision after an employee leaves, without clear ownership of the process or the data processed. Other challenges include the agents' ability to accumulate large amounts of information and the interaction of multiple agents within "swarms," creating internal data processing ecosystems that require clear guidelines.

To regulate these uses, Datatilsynet advocates a proactive approach rather than a ban. Companies must establish a systematic overview by identifying the AI tools used, precisely defining the access and actions authorized for each agent, and clearly designating those responsible for monitoring, process ownership, and deactivation. Each AI agent must thus have a defined identity, a clear access framework, and assigned responsibility.