For a couple of years, "using AI" meant, for most companies, talking to a model: asking a question and getting an answer. That's changing fast. The new generation of tools doesn't just respond: it acts. It reads your email and replies, checks your calendar and books, browses, fills in forms, chains steps towards a goal. These are AI agents.
The Spanish Data Protection Agency (AEPD) hasn't waited for the phenomenon to mature: in February 2026 it published Inteligencia artificial agéntica desde la perspectiva de protección de datos (V1.2, in Spanish), guidance that presents itself as an introduction to the data protection issues that may arise when controllers and processors use these systems. It's worth reading because it puts precise words to what changes, and to what doesn't: the risks it studies are not inherent to every agent or to every use of agentic AI.
Article 26 series → This guidance reads agents through the GDPR; what the AI Act asks of the deployer of a high-risk system, paragraph by paragraph, is in the map of all twelve paragraphs.
What makes an agent different
The guidance describes what sets an agent apart from a language model that only responds, and studies its risks in blocks. Four traits have a direct data protection reading:
The reasoning chain. The agent breaks a problem down into successive, linked logical steps until it reaches a decision or a final answer. Consequence: personal data can pass through intermediate stages that are not aimed at the user and may go unnoticed by the user and by the controller itself; and the guidance points to the lack of transparency of internal reasoning processes when decisions emerge from chains of inference spread across several agents and tools.
Persistent memory. Unlike a conversation that gets forgotten, an agent can remember across sessions: preferences, data, context. That is processing with a vocation for permanence, which raises the classic questions of retention and minimisation with a new intensity: what does it remember, for how long, and how is it deleted?
Autonomy. The agent makes intermediate decisions without consulting on every step. That does not turn every action into an Article 22 decision, and the guidance says so expressly: bringing agents into a processing operation may involve automation, but it will not always involve automated decisions within the meaning of Article 22 GDPR. Article 22 comes in where there is a decision based solely on automated processing that produces legal effects concerning the person or similarly significantly affects them; and, where such a decision is allowed by contract or explicit consent, with safeguards that include at least human intervention, the right to express one's point of view and the right to contest the decision.
Service integration. Agents usually have access to many services — email, CRM, messaging, project management. Each connection is a door through which personal data flows, and each connected service has a role that has to be identified: according to the guidance, it may act as a processor, and then it needs the Article 28 contract; it may receive the data as another controller; or it may have no role at all in data protection terms. And the attack surface, it warns, is considerably wider than that of a language model.
Human oversight, and the governance that holds it up
The guidance pays attention to human oversight: with agents it becomes more complex, especially where no specific mechanisms have been designed and implemented that allow, and in some cases enforce, effective, continuous and meaningful oversight. Where oversight is needed, it isn't enough for someone to be theoretically "able to review" what the agent does: the design has to allow its actions to be understood, interrupted and corrected in time. An agent whose decisions nobody can follow isn't supervised just because a human sits at the end of the org chart.
But the guidance doesn't put oversight at the centre. What it calls the most important measure an organisation can adopt is an information governance framework that includes agentic AI systems, and it warns against shifting all responsibility onto whoever does the oversight.
For an SME, that principle translates into very concrete questions before granting an agent any permissions: what exactly can it do, and what is off-limits? Who reviews what it does, how often, and with what record? What happens — and who is accountable — when it chains together a wrong action?
How to govern agents without stopping them
The AEPD's guidance is exactly that, guidance: it presents itself as an introductory study with no claim to be exhaustive, not as a new layer of obligations. The obligations are the usual GDPR ones — transparency, lawful basis, minimisation, processing contracts, security, the Article 22 safeguards — applied to a subject that tests them in new ways. The sensible response isn't to ban agents or adopt them blindly, but to govern them with the same method as the rest of AI, raising the bar by one notch:
- Inventory the agents for what they are. Not as "just another tool": the inventory must capture which services each agent connects to, what permissions it holds, and what data it touches. An agent without a record is a blind spot with hands.
- Register the relationships, not just the pieces. An agent's risk lies in its connections — who orchestrates whom, which system feeds which. Documenting that map is what makes it possible to explain the data processing end to end.
- Assign oversight with a name and a method. A specific person, a specific scope, a record of reviews, without that replacing the controller's own diligence, which the guidance recalls no overseer can take over. It's the agentic version of a principle you already know if you follow this blog: diffuse responsibility is no responsibility at all.
At Alethexis we dedicate a specific module to agent governance precisely because this map of identities, relationships and oversight doesn't honestly fit into one more box in the general inventory. Agents are coming into your company either way; the only variable under your control is whether they arrive governed.
This article is for informational purposes only and does not constitute legal advice.