AEPD guidance on agentic AI (AEPD agentic AI guide)

AEPD guidance on agentic AI

Regulator guidanceAEPD agentic AI guide

Summary

It is one of the first guides from a European authority on AI agents that act on their own. It asks organizations to bring agents into governance under the data protection officer's oversight, limit their memory and autonomy, prevent staff from deploying uncontrolled agents, and assess model, API and cloud vendors.

Who it applies to

Organizations using AI agents that process personal data.

Penalties

The rule has no penalty regime of its own, or it does not apply.

Official name: Inteligencia Artificial agéntica desde la perspectiva de protección de datos (orientaciones de la AEPD)
Official reference: Agencia Española de Protección de Datos, febrero de 2026
Regulator: Spanish Data Protection Agency (AEPD)
Official source: Check the sourceHow we verify sources

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Govern AI agents: permissions, memory and oversight	AEPD, orientaciones sobre IA agéntica (2026)	Regulator guidance	Already applicable	If you use AI agents that take actions (send emails, query systems, buy, answer customers).	Verified in the official source on November 4, 2026

Govern AI agents: permissions, memory and oversight

AEPD, orientaciones sobre IA agéntica (2026)Regulator guidance

Already applicable

When it relates: If you use AI agents that take actions (send emails, query systems, buy, answer customers).
What the rule provides: Review controller and processor roles, legal basis and processing records for each agent.
Limit permissions, memory and autonomy to the minimum needed and design to fail safely.
Ban unauthorized staff agents and keep an agent inventory.
Run a DPIA where needed, especially if the agent makes automated decisions.
Typical evidence: Approved agentic AI policy.
Agent inventory with permissions.
Related base documents: AI Agent Policy: Autonomy, Memory and Permissions
Supporting documents: Human Oversight Procedure for AI Systems
AI System Inventory
AI Vendor Due Diligence Checklist
Data Protection Impact Assessment (DPIA) for AI
AI Integrations and API Map
Verification: Verified in the official source on November 4, 2026Checked in the official PDF on aepd.es (version 1.2, February 2026): roles and responsibilities, processing records, impact assessment, GDPR Article 22, fail-safe principle, memory control and the risk of deployments outside governance. The guide recommends a service catalog and the GESTIONA RGPD tool for the inventory; it does not literally use the term "agent inventory".