The AEPD's decalogue for AI assistants and agents: 'Let AI act for you, not without you'

The Spanish Data Protection Agency (AEPD) has published the document "AI assistants and agents: Decalogue for users", under the motto "Let AI act for you, not without you". The Agency's press release, of 27 October 2026, starts from an observation: AI assistants and agents have stopped limiting themselves to answering questions - they can act on a person's behalf, from managing the calendar or email to completing purchases or bookings -, and providers are offering them on a massive scale. The decalogue proposes deciding from the outset what is entrusted to them and how far they may act.

The five questions before delegating

The document structures its approach around five questions that anyone should ask before delegating to an assistant: what it can see, what it can remember, what it can do on our behalf, where it sends the data and whether it affects other people. Ten tips are articulated around that scheme.

The ten tips of the decalogue

1. Before delegating, check whom you are giving the keys to. An assistant with access to email, calendar, files or payments is a key to a good part of one's digital life. The Agency advises choosing clearly identified services that allow the exercise of rights in the EU and that inform where data is sent; reviewing privacy, memory and history options; distrusting assistants of unknown origin, especially those asking for access to the whole device; prioritising those that process data on the device itself; and choosing assistants that inform what data they keep - including profiles and inferred data - and allow consulting and deleting it.

2. Grant access, not blank cheques. That the assistant can access something does not mean it needs to: reading is not the same as sending, modifying or deleting. The AEPD recommends giving the minimum access when the service allows it, periodically reviewing what is connected and disabling what is not used.

3. Give it the minimum and protect what is delicate. The more information the system has, the greater the damage if it makes a mistake or if someone enters the account. The tip includes two concrete rules: do not write passwords, verification codes or card numbers in the conversation, and remove from documents the data the assistant does not need for the task.

4. Decide what it may remember about you. Memory makes the assistant more useful, but it gradually builds a profile with tastes, relationships, routines and concerns. The Agency recalls that deleting a chat, deleting a memory or removing a connected application do not have the same effect, that services keep data for other purposes - security, technical records, profiles - and that against this there are the rights of access and erasure. It recommends using temporary conversations for delicate matters and separating personal, family and professional uses.

5. Also tell it what it must not do. An agent can pursue a goal, divide it into steps and decide how to carry them out: "check my email and take care of everything" amounts to giving it carte blanche. The decalogue advises setting express limits - whom it may write to, how much it may spend, when it must stop and ask - and starting with small, reversible tasks.

6. Confirm what matters. When the assistant acts, an error is no longer a wrong answer: it is an email sent, a purchase or a consent given in your name. The AEPD advises activating prior confirmation for sending, publishing, sharing, deleting, paying, contracting or accepting terms; not granting permanent authorisations ("always allow") unless they are necessary and their scope is understood; actually reading what is approved - recipient, amount, date, attachment -; and not leaving unreviewed decisions with legal, economic or health consequences. The note insists: one can be responsible for the actions one has allowed the agent to execute.

7. Also distrust what it reads. A website, an email, a PDF or a calendar invitation can contain hidden, even invisible, instructions for the agent to do something other than what was asked. Since no measure completely eliminates that risk, the best protection is to limit what the agent can do if it is deceived: the more third-party content it handles, the less access and capacity to act it should have.

8. Also protect other people's data. In email, calendar or contacts there is information about third parties who have not decided to interact with that AI. Authorising the agent does not give free rein to use other people's information: scope must be limited, extra caution taken if the assistant uses the user's voice, image or identity, and separate profiles used on shared devices.

9. Protect your account and your device: they are the key to everything else. Unique password, two-step verification or passkey, sign-in alerts, add-ons and connectors only from known sources, separate sessions for delicate tasks and very sensitive information encrypted and decrypted only with the agent deactivated.

10. Supervise it, learn to stop it and withdraw its access. Delegating is not disengaging: one must know how to stop the agent and withdraw its access before needing to, check that updates do not change the configuration, review the activity history and pay special attention to scheduled or periodic tasks that keep running without the user's presence.

A risk that is not theoretical

The Agency's note stresses that the risk is not hypothetical and cites already known cases, such as that of an agent that closed a sale and provided its user's address to the buyer without the user knowing. The cross-cutting recommendation is clear: grant only the essential access, do not press "always allow" without understanding its scope, require confirmation before sending, sharing, paying or contracting, and bear in mind that the assistant could execute hidden instructions in emails, websites or documents.

Relevance for law firms

For the legal profession, the decalogue is doubly useful: as an internal use guide - firms deploying assistants with access to client email and documents will find here the supervisory authority's standard of prudence - and as advisory material for clients integrating agents into their processes. The tips on third parties (tip 8) and on confirmation of acts with legal effects (tip 6) have a direct translation into compliance policies.

Frequently asked questions

What has the AEPD published?

The document "AI assistants and agents: Decalogue for users", with five prior questions and ten tips for delegating tasks without losing control over personal data.

What are the five questions before delegating?

What it can see, what it can remember, what it can do on my behalf, where it sends my data and whether it affects anyone else.

What does it advise about confirmations?

Activate prior confirmation for sending, publishing, sharing, deleting, paying, contracting or accepting terms, and do not grant permanent authorisations without understanding their scope.

Related reading

• The AEPD warns a company considering AI to analyse CVs
• The AEPD policy on generative AI in law firms
• AI Regulation and digital omnibus: the calendar for firms
• Council of Europe Framework Convention on AI

Sources

• AEPD, "Asistentes y agentes de IA: Decálogo para personas usuarias" (PDF): https://www.aepd.es/guias/decalogo-usuarios-asistentes-agentes-ia.pdf
• AEPD, press release (27 October 2026): https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-aepd-publica-un-decalogo-para-delegar-tareas-en-asistentes