AEPD releases a 10‑point guide on safely delegating tasks to AI assistants and agents

What happened

The Spanish Data Protection Agency (AEPD) published a decálogo offering practical advice for users of AI assistants and agents, emphasizing limited access, explicit confirmations, and memory controls. It also stresses the responsibility of providers to supply clear permissions, audit logs, and easy ways to exercise EU data‑subject rights. The guidance highlights risks to third‑party data and recommends safeguards for minors and shared devices.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guide helps individuals and organisations mitigate privacy and security risks when allowing AI tools to act on their behalf.
• Takes effect October 27, 2026.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Revisit retention schedules and data minimisation for the data involved.
5. Map the security requirements to existing controls and close gaps.
6. Inventory AI or automated decision systems in scope and their assessments.
7. Review age assurance and protections for minors' data.