AI Governance / Privacy / Security
Spain's AEPD publishes ten-point guide on delegating tasks to AI assistants and agents
The decalogue asks users five questions before delegating, from what an agent can see to where it sends data, and says providers must also supply permissions, activity logs and a way to stop agents.
The Spanish Data Protection Agency (AEPD) has published ‘Asistentes y agentes de IA: Decálogo para personas usuarias’, guidance on using AI assistants and agents that act on a person’s behalf. It proposes five questions before delegating: what the tool can see, what it can remember, what it can do on the user’s behalf, where it sends data and whether it affects others.
The AEPD advises granting only essential access, avoiding “allow always”, requiring confirmation before sending, sharing, paying or contracting, and limiting what an agent can do if hidden instructions in emails, websites or documents deceive it. At work, staff should use only organisation-approved assistants and not connect professional email or documents to personal AI accounts.
The agency stresses that responsibility cannot rest solely with users: providers should offer permissions distinguishing viewing from acting, configurable confirmations, an action history, an immediate stop function and memory deletion.
Why it matters
Although aimed at individuals, the decalogue sets out what a European DPA expects agent providers to build in: separate read and act permissions, logs of agent actions, kill switches, memory controls and disclosure of whether data trains models. Organisations deploying or procuring agents can use this list as a baseline for vendor assessment. The workplace advice also signals that connecting corporate mail or documents to personal AI accounts is a shadow-AI risk worth addressing in acceptable-use policies and access reviews.
Status: Published. Non-binding recommendations aimed at users, with expectations for providers
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- AI governance lead
- CISO
- Legal & compliance