The Spanish data protection authority (AEPD) has published a recommendation guide aimed at users of artificial intelligence (AI) assistants and agents for secure management of personal data.

The document, titled "Assistants and AI agents: Let AI act for you, not without you," emphasizes that these tools can now act on behalf of users, turning a simple response error into an undesired action such as a purchase or file sharing. The AEPD recommends granting only essential access, requiring confirmation before any significant action, and being wary of hidden instructions that could deceive the agent. It is also advised to manage the assistant's memory to avoid creating detailed profiles, protect third-party data, and, in a professional context, use only tools authorized by the organization. One case is cited where an agent finalized a sale and communicated the user's address without their consent.

The guide specifies that responsibility does not rest solely on users. Providers of these tools should integrate clear controls, such as permissions distinguishing consultation from action, configurable confirmation for high-impact operations, a history of the agent's actions, and a means to stop it immediately. They must also inform about data transfers and their possible use for AI training, while ensuring a simple way to exercise rights.