AI assistants and agents at work: the usage policy Spain's AEPD expects

What the AEPD has published

On 27 October, the Spanish Data Protection Agency (AEPD) published AI assistants and agents: let AI act for you, not without you, ten recommendations for people using assistants that can manage a calendar, read email, share documents or complete purchases.

The core idea is simple: when an assistant only answers, a mistake is a wrong answer; when it acts, it's an email sent, a file shared, a purchase or a consent given in your name. The AEPD suggests asking five questions before delegating:

• What can it see?
• What can it remember?
• What can it do in my name?
• Where does it send my data?
• Does it affect anyone else?

It also describes a real case: a user who tapped "always allow" and whose agent closed the sale of an item and gave their address to the buyer, who turned up at their home without their knowledge, as reported by Europa Press.

The part that's on you as a company

The guidance is written for individual users, but it includes a section called "If you use it at work" that says, in essence:

• Use only the assistants approved by your organisation and connect only the accounts, apps and data it has approved.
• A tool being fine for personal use doesn't make it suitable for professional use.
• Don't install agents yourself on work devices or connect work email or documents to a personal AI account.
• Customer data remains the organisation's responsibility.

Read the first point the other way round: if your company hasn't approved any assistant, an employee who wants to comply can't use one. And one who doesn't care will use their own, with a personal account and your customers' emails inside. In a small business, the second is what usually happens. That's why you need a usage policy, even a one-page one.

Viewing isn't acting: approve by levels

The AEPD stresses that "reading is not the same as sending, modifying or deleting". It's the most useful test for deciding what to allow:

Two rules from the guidance worth copying straight into your policy:

• No "always allow" unless it's genuinely necessary and its scope is understood.
• No access to sensitive data (health, finances, passwords, verification codes) beyond what's essential.

The combination to avoid

The most technical recommendation is also the most important one for a business. A web page, an email, a PDF or a calendar invite can carry hidden, even invisible, instructions telling the agent to do something else. The AEPD admits no measure removes that risk entirely and concludes that the best protection is to limit what the agent can do if it does get tricked.

In practice, that means not combining these three things in the same task:

1. Content from strangers: incoming email, third-party documents, websites.
2. Access to private information: the mailbox, the CRM, client folders.
3. The ability to act externally: sending, sharing, paying or publishing.

The AEPD's own example is "summarise my new emails and reply to all of them". If a process needs all three (and many customer service processes do), every outward action must go through a person's confirmation. We explain how to design that confirmation without it turning into rubber-stamping in supervising AI agents.

What to ask a vendor before approving a tool

The guidance closes with what users can expect from the vendor, because "responsibility can't rest on the user alone". Use it as a checklist before approving a tool:

• An identified company, with contact details, that lets you exercise data rights in the EU.
• Clear permissions that separate viewing from acting.
• Configurable confirmation for high-impact actions.
• A history of what the agent has done on each user's behalf.
• An immediate stop for the agent and a way to revoke its access.
• Memory management and deletion, with the service's own controls, not just by asking in the chat.
• Clear information on where data is sent and whether it's used to train AI.

If a tool doesn't offer these controls, the guidance itself says to bear that in mind when deciding what to trust it with. For a company, that usually means not approving it for anything beyond level 1.

The policy, on one page

A small business doesn't need a manual. It needs everyone to know:

• Which tools are approved and with which account (the company one, never a personal one).
• Which data never goes in: passwords, health data, customer data not needed for the task.
• Which permission level each tool has, and in which processes it can go beyond level 2.
• Which actions always need confirmation: sending, sharing, deleting, paying, signing up or accepting terms.
• Who reviews active connections, scheduled tasks and activity history, and how often.
• Who to tell when something goes wrong.

With that, employees know what they can do, and the company knows what's happening to its data.

If something goes wrong

The guidance asks you to find out how to stop the agent and revoke its access before you need to. Write the procedure down:

1. Stop the agent and disconnect the affected apps.
2. Change passwords.
3. Check the history, and each app, for what was sent, shared, bought or changed.
4. Warn anyone who may be affected.
5. If personal data is involved, assess with whoever handles data protection whether it has to be notified.

We cover the technical controls behind each of these steps (least privilege, action logging, isolation) in AI agents in business: risks, GDPR and the AI Act.

How we do it at Amud

When a task deserves an agent, the best way to keep staff off their personal accounts is to give them a company one, built with these rules from the start. In our AI agents for business, each agent can access only what its role needs, external content is treated as data and never as an order, anything going out waits for a person's approval and runs exactly once, and everything is logged with its author. It's the AEPD's "the agent prepares, the person approves", turned into a process.