AI Governance / Privacy / Security
Norway's Datatilsynet warns AI agents left running after staff move on can become 'digital ghosts'
The Norwegian data protection authority urges organisations to map their AI agents and give each one a defined identity, access limits and a clear owner before automations escape oversight.
Norway’s data protection authority, Datatilsynet, has published guidance on the privacy and security risks of AI agents that can retrieve information, update business systems and carry out routine tasks on their own. It accompanies a talk by Eirik Gulbrandsen and Sara Rossebø on what they call “digital ghosts”.
The authority describes a scenario in which an employee builds an automated agent workflow against a business system, then changes role or leaves. The automation may keep running, querying the system and processing personal data, with no clear owner. Datatilsynet notes that such shadow AI can also sit inside already approved software, and that risks grow when several agents interact in “agent swarms”.
Its recommendation is a systematic overview of agents, stating that an AI actor needs a defined identity, clear access boundaries and clear accountability. The authority stresses that the aim is not to ban AI.
Why it matters
Datatilsynet is treating AI agents like staff with system access, which means joiner-mover-leaver processes, access reviews and records of processing should cover agent workflows, not just people. Governance teams should be able to name an owner for every automation that touches personal data and confirm it is reassigned or switched off when its creator leaves. The authority also links agent readiness to data quality and access control, so catalogue and stewardship programmes are part of the control set.
Status: Published. Non-binding recommendations accompanying a recorded talk
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- AI governance lead
- CISO
- Data stewards