My AI agent, your responsibility? Data protection principles in an agentic context

In 2026, agentic AI has moved from being a trendy tinkerer’s experiment to a tool of mass appeal, with corporate AI agents being deployed increasingly often and most high-profile AI labs launching personal AI agent offerings one after another, over the course of just a few months. The period in which I wrote my previous piece on agentic AI (from April 2025) feels remote compared to today’s period of smooth, consumer-grade digital products. Yet the key questions remain largely the same: when an AI agent processes personal data, who is responsible for that processing and what does that entail in practice?

Allocating roles between AI agent provider (making available a tool) and user (giving an instruction to that tool) is an awkward exercise, because of the very autonomy – or “agency” – given to the AI agent in the course of its operation. Yet it is a fundamental and necessary exercise, as without it the concept of “controller” can lose all meaning.

Laws such as the GDPR are designed to be technology-neutral. Even so, the fundamentals of agentic AI challenge assumptions about how to interpret certain core data protection concepts. Ultimately, everything should revolve around the instruction, and the brand-new Digital Fairness Act proposal has shown that the instruction can even extend to contractual execution delegation (as will be seen in section 1).

This analysis is built around five questions:

1. Who is responsible for an AI agent’s processing of personal data – the user or the provider?
2. How should the principle of data minimisation be applied to an AI agent’s operation?
3. Can “human-in-the-loop” be kept workable, and what is actually required by law?
4. Is data concerning non-users personal data for the AI agent provider, and what can be used for AI training?
5. Can a private user of an AI agent avoid GDPR obligations through the household exemption?

The answers to these questions are not obvious, nor are they necessarily settled, but the GDPR and case law of the EU Court of Justice, together with the AI Act and even the Digital Fairness Act provide useful elements and inspiration.

---

1. Who is responsible for an AI agent’s processing of personal data – the user or the provider?

AI agents act on behalf of users. They are a form of digital representative of the user and are granted an authorisation to access information, interact with digital services and take certain steps on the user’s behalf.

The user maintains authority over the AI agent’s actions, by virtue of the initial instruction.

Without anthropomorphising AI agents, parallels can be found in the relationship between employer and employee, or the relationship between principal and (non-AI) agent. In each of these cases, a person or entity (the employer or principal) gives a general task to another person or entity (the employee or agent), and the latter has a certain degree of freedom as to how to execute that task. Yet in data protection terms, any processing of personal data carried out by the employee or agent in that context will be considered to be taking place under the authority of the employer or principal. In other words, the employee or agent has autonomy, but within the framework of subordination.

Similarly, AI agents have autonomy within the framework of subordination. These systems act with a certain degree of “freedom”, yet always within the scope of objectives defined by their users. The defining feature of the AI agent is then not its “independence” but rather a form of delegated autonomy to carry out user-defined purposes.

The proposal for a Digital Fairness Act or DFA (of 11 November 2026) echoes this idea, stressing that “automated systems that can be used by consumers to conclude and perform contracts on the consumers’ behalf” are subject to certain rules – and systematically emphasising that these systems are acting “on the consumer’s behalf”.

Yet the AI agent is not a natural person or legal entity, and it does not have legal personality. It is the creation of the AI agent provider. What then is the role of the AI agent provider in this context?

The AI agent provider trains the AI agent and defines its capabilities in broad terms. It sets out boundaries, implements filters and more. Without the provider, the AI agent would not exist.

This does not mean, however, that the provider is fully responsible for the use of the AI agent by the user. On the contrary: the user’s own instructions and purposes have a direct impact on the actual operation of the AI agent. In other words, the provider creates the means; the user selects those means (i.e. one AI agent instead of another tool, process or third party) and determines the purposes of the AI agent’s tasks.

In this regard, it is important to consider the potential impact of the recent Russmedia judgment (C‑492/23). In that judgment, the EU Court of Justice (CJEU) held that the provider of an online marketplace can be a (joint) controller for personal data contained in an advertisement published on that online marketplace, even though the content of the advertisement in question was entirely made by a user. The CJEU’s reasoning includes a wide range of elements, from the rights the platform provider had reserved contractually to use/distribute/modify/etc. the content to the very idea of allowing advertisements to be placed on its marketplace, as well as the control the platform had over the parameters for the dissemination of advertisements. [CJEU, 2 December 2025, Russmedia, EU:C:2025:935, paras. 67 to 75]

This judgment does not mean that the AI agent provider is a controller for the AI agent’s processing of personal data. In the case of AI agents, the provider also enables and facilitates the processing, but the only purpose to which the provider contributes is “fulfilling the service requested by the user, whatever it may be” – with certain guardrails to limit abuse. The versatility of the AI agent (its possibility to be used for virtually any digital task) makes it much harder for any court or authority to reasonably hold that the provider actually exercises influence over a specific purpose. [And if an authority were to claim that a tutorial explaining how to use an AI agent for a specific purpose leads to joint determination, this would have the perverse effect of discouraging any provider from providing practical examples in tutorials.]

Instead, it is useful to draw from broader case law on liability (such as the YouTube and Cyando judgment [C‑682/18 & C‑683/18]) and a recent Opinion of 3 November 2026 by Advocate General Szpunar in a case on generative AI and copyright. Considering that “an LLM-powered online chatbot may be used for very different purposes, and that a certain use of that chatbot occurs at the initiative of an individual user”, AG Szpunar wrote that “where such a user directs the chatbot to carry out a copyright-relevant act, the ‘primary’ liability for the carrying of that act should generally lie with the user concerned” [Advocate General Szpunar, Opinion of 3 November 2026, C‑250/25, Like Company v Google, EU:C:2026:919, para. 219].

According to AG Szpunar, should these actions initiated by users be “attributed to the chatbot provider, an excessive burden of liability would be borne by the latter”, because the provider cannot prevent in advance “any possible use that could be made of the chatbot” yet cannot either be held “strictly liable for any resulting [copyright] infringement”. Any strict liability for providers would notably be detrimental to “the developers’ freedom to do business under Article 16 of the [EU Charter of Fundamental Rights]” and to “the freedom to impart and receive information online, as guaranteed under Article 11 of the Charter” [para. 220].

Yet this does not mean that there should be no liability for chatbot providers, says AG Szpunar. He foresees provider liability “where the latter deliberately intervenes to facilitate such acts”, for instance as a result of “the very design of the chatbot services, where the carrying of such acts is inherent to the business model of the provider” or of the failure by the provider to “[put] in place the appropriate measures that can be expected from a reasonably diligent operator in its situation in order credibly and effectively to counter […] infringements being committed by way of the chatbot” [para. 221]. The AG’s examples of such measures include access restrictions, output filters and more.

Could something similar be foreseen in relation to data protection? The answer is unambiguously yes.

If an AI agent is built in a manner that is geared towards processorship, with limitations to mitigate the risk of processing of personal data that the user might not have intended (e.g. no reuse of the personal data, user verification prior to data sharing, etc.), the risk of (re)classification of the AI agent provider as a controller can be strongly limited. The existence of “master prompts”, i.e. core operational instructions set by the provider, does not alter this, as they provide context and influence the means of processing but not the actual purpose of processing. [For more on the allocation of roles in AI systems, see Blinded by the LED: smart glasses, GDPR, and the illusion of hardware indicators, which also draws parallels with other digital services.]

One illustration concerns connectors with third-party services and data sources (such as to allow an AI agent access to e-mails, a calendar or datasets). Allowing the user to activate such a connector cannot create responsibility for the processing of personal data made available through that third-party service or data source, especially if the connector is provided by the user or such third party.

Any different approach would in practice make the provider responsible for processing activities that the provider might not even have been able to anticipate, simply because of the user’s significant and predominant influence on the AI agent’s actions.

---

2. How should the principle of data minimisation be applied to an AI agent’s operation?

The user’s influence on those actions can come from a long instruction, just as it can be based on a short one. “Prepare my list of work to-dos for today”. Less than ten words, sufficiently clear for an AI agent to commence an analysis, but operationally significant, such an instruction would lead an AI agent to examine a wide range of data sources. Coupled with connectors giving the AI agent access to specific datasets or apps, such as access to a mailbox, it could lead to an analysis of hundreds of e-mails, one or more calendars, a list of tasks, and more. Repeated daily, it could lead to extensive, additional processing. Yet some of the e-mails or other items examined may not include any tasks.

This inevitably raises the question as to whether an AI agent, making a choice between different ways of achieving a particular instruction, is acting in a manner that is compatible with the principle of data minimisation. That principle requires the processing to only relate to personal data that are “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” (Art. 5(1)(c) GDPR). In practical terms, it often comes down to whether there is a less data intensive or intrusive way of achieving the same purpose.

Yet how can this be assessed?

The “necessity” test, with its proportionality component, has been interpreted by the CJEU as not being an abstract test but one based on checking whether there are any “workable, less intrusive alternatives” (Bundeskartellamt [C‑252/21], HTB Neunte Immobilien [C‑17/22 & C‑18/22], Mousse [C‑394/23]). While ostensibly an assessment from the perspective of contractual necessity as a legal ground (Art. 6(1)(b) GDPR) in those cases, the CJEU coupled this reasoning with that regarding the principle of data minimisation (Art. 5(1)(c) GDPR) in the Mousse judgment. The CJEU also combined data minimisation and necessity for another legal ground, legitimate interest, in the KNLTB judgment [C‑621/22], using similar wording.

In the case of agentic AI, whether a particular route towards an outcome is indeed the least intrusive alternative should not be examined in the abstract. Instead, analysis of compliance with data minimisation requires taking into account all of the information available to the relevant AI agent and assessing whether there is a rationale behind opting for a route that might involve the processing of more or less personal data. AI systems are not built around unpredictability but rather statistical analyses, so choices operated are not arbitrary but can in principle be traced. Which route appears to be the best way to achieve a certain purpose is thus a result of a statistical assessment based on the information available to the AI system in question.

In fact, on the AI model training side, scientific studies in relation to large language models have regularly shown that more data can lead to better outcomes. In Training Compute-Optimal Large Language Models, DeepMind researchers considered that smaller models trained on more data could outperform larger models; in Scaling Laws for Downstream Task Performance in Machine Translation, researchers from various AI companies and academia together found that an increase in pretraining dataset size improved metrics; similar findings were discussed by a LAION-led team in Reproducible scaling laws for contrastive language-image learning. While these studies relate to training of AI models, it is not hard to see how similar observations can be made in relation to the relevance of outcomes of agentic AI functionality: the more data is included in relation to a specific user’s context, the more accurate any outcomes are likely to be.

As a result, compliance with data minimisation through agentic AI must be considered as inherently tied to (and a function of) the scope of the instruction and the surrounding context given to the AI agent. For instance, if a user gives an AI agent access to more data through connectors to third-party services or other data sources, the assessment of data minimisation may be different than before such access was granted, provided the additional data opens up possibilities for more effective means of attaining the objective of the instruction.

Moreover, AI agents’ memory can be an important quality and safety safeguard supporting the instruction (and thus belonging to the broader context that influences the instruction). Previous interactions with the AI agent can therefore ensure that an instruction is better understood and adhered to. Implicit instructions (regarding background information, preferences, things to do or not to do, etc.) are taken into account, and certain mistakes can thus be avoided. In other words, more data also regarding past interactions makes the overall instruction more precise and helps mitigate risks regarding the actual manner of operation or outcome of the AI agent’s tasks.

In general, the more precise an instruction is (including context and memory, as appropriate), the easier it will be for the user to demonstrate necessity and proportionality; the vaguer it is, the likelier it is that the user will have to examine steps of the reasoning if challenged regarding the processing of personal data.

This does underline the importance of explainability: agentic functionality should go hand in hand with traceability, to help the user track what the agent did precisely along the way to the outcome. Explainability notably helps the user document data sources (e.g. accessed through connectors, web searches or uploaded data) and when such data sources are taken into account, making it an important compliance tool for the user as well.

It is worth noting that the existence of a connector does not necessarily mean that the data to which the connector is pointing is being processed by the AI agent (provider). Theoretical access does not equate to processing. It does however create at least a likelihood of processing, such that its relevance must also be assessed on a regular basis, in accordance with both the data minimisation principle and the storage limitation principle (Art. 5(1)(e) GDPR). It is therefore important that the existence and active nature of such connectors is made visible to the user on a regular if not permanent basis (for instance, through the “thinking process” of the AI agent or other explainability implementation).

Ultimately, in the context of the operation of AI agents, instructions are the key element when assessing data minimisation, with explainability being needed as a tool to help the user document compliance. The AI agent seeks to achieve the outcome sought by the user, and must be capable of presenting to the user explanations on the (potential) relevance of the data used to that end.

---

3. Can “human-in-the-loop” be kept workable, and what is actually required by law?

The principle of “human-in-the-loop” is important to many forms of use of AI systems, including agentic AI. Yet a strict application of the principle significantly limits the usefulness of AI agents. Constant “stop, confirm, go” interruptions can create cognitive overload and may create the impression for the user that the AI agent is incapable of any “agency”. Fortunately, the statutory framework does not require granular oversight, even for high-risk AI systems.

First, under the GDPR, human oversight is not required as such, but there is the right not to be subject to automated decision-making, unless the decision is (a) necessary for conclusion or performance of a contract, (b) authorised by law or (c) based on consent (Art. 22(1) & (2) GDPR). The “decisions” covered are ones that produce “legal effects” concerning the natural person or “similarly significantly” affect that person.

In the contract or consent situations, the GDPR states that there must also be “the right to obtain human intervention” (Art. 22(3) GDPR). In an agentic context, this means that where the AI agent’s output directly leads to a decision affecting other natural persons’ rights or “similarly significantly” affecting them, the user must be able to truly review, and if necessary override, the decision in question.

It is worth pointing out that the decision might not be inherent to the functioning of the AI agent but rather to the actions taken by the user as a direct result of the AI agent’s tasks. In the Schufa judgment [C‑634/21], the CJEU held that a probability value (i.e. the outcome of an assessment, which could be carried out by an AI system) can play a determining role in a decision taken subsequently, in which case Art. 22 GDPR applies even in relation to the creation of that probability value. In the case in question, the requester of a credit scoring analysis had not been sufficiently autonomous in taking a decision regarding the person to whom the score related, and had relied too much on the credit score itself.

In other words, the concern of automated decision-making arises if even the outcome of the user’s actions surrounding the agentic instruction – not just the outcome of the AI agent’s tasks or output – is a decision that affects other natural persons.

Next, Art. 14(1) of the AI Act requires human oversight for “high-risk” AI systems, stating that they must be “designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use”.

For that oversight to be “effective”, Art. 14(4) AI Act includes various requirements, such as the need to understand the AI system’s capabilities and limitations and awareness of automation bias. One highly relevant part for the purposes of this analysis is Art. 14(4)(e) AI Act, which states that the high-risk AI system must be provided in such a way that the human overseer is enabled “as appropriate and proportionate” to notably “intervene in the operation of the high-risk AI system or interrupt the system through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state”. This requirement does not mean that a systematic human involvement is required even in the case of high-risk AI systems. Instead, the possibility of a stop must be present.

The proposal for the DFA is even more explicit on the moments at which human intervention has to happen, with the following obligation in its Article 26(2):

“on the first use of an automated system [note: which can include AI agents, but also rule-based purchasing tools], consumers are required to expressly choose one of the following: (a) whether they wish to confirm all contracts proposed by the automated system before being bound by such contracts; (b) whether they wish to confirm only a certain type of contracts, based on specific criteria to be set by the consumer, including a maximum price and a time limit for the applicability of this choice; (c) whether they wish no confirmation of contracts before being bound by them.” [One important caveat is that this Article 26 of the DFA proposal would “not apply to the provision of financial services”.]

In other words, human intervention is needed before any action is taken that could for the first time change the legal situation of the user, with the possibility for the user to set the scope of the authorisation granted.

In combination, the DFA’s proposal (grounded in consumer rights and fairness),the GDPR (protection of personal data) and the AI Act (product safety and risk management) appears to point towards the practical importance of human confirmation before the first time that any action is taken that could change the legal situation or “similarly significantly” affect a natural person – whether the user or a third party. That importance becomes a statutory requirement when these laws apply, but it appears to be a reasonable suggestion in many other situations. Such a confirmation might not have to depend on the identity of the affected person or on the type of action taken, but a first confirmation could help mitigate various risks in one go.

Significantly, none of these laws or proposals require incessant requests to users.

With this in mind, the guiding principle of empowerment (through giving agency to an AI system) should be coupled with some degree of user awareness, but not a requirement to treat the user as unable to take decisions or to scope the autonomy granted to the AI agent.

---

4. Is data concerning non-users personal data for the AI agent provider, and what can be used for AI training?

Just as the issue of responsibility in the context of AI systems and agentic AI is fundamental, so too is the question of whose data gets processed.

As indicated above, the AI agent provider has control over its own processing for own purposes, such as training, while it appears more logical based on case law of the CJEU to consider the user as controller for the processing carried out by the AI agent in accordance with the user’s instructions.

This could lead in practice to a dual role for AI agent providers: controller for own purposes such as AI training, and processor for the performance by the AI agent of the tasks entrusted to it by the user (see section 1 for some suggestions in this respect).

For information concerning the user, the AI agent provider can most likely consider the AI agent’s processing to be processing of personal data. Yet when that information concerns others, this assessment may be significantly more difficult, because “personal data” means information relating to an “identified or identifiable” natural person – and case law has confirmed that this is a relative notion, where the perspective of the potential controller is relevant. [See SRB (C‑413/23 P), following up on Breyer (C‑582/14), Scania (C‑319/22) and OC v Commission (OLAF) (C‑479/22 P). On 5 November 2026, Advocate General Szpunar confirmed this further in his Opinion in the Undelam case (C-654/25), highlighting that even identification through a recipient requires some form of awareness that the recipient can identify the natural person in question.]

If the AI agent is led to process information from a user’s e-mails and contact list, the natural persons whose data is being processed (third parties who are not the user) are likely unidentifiable purely from the AI agent provider’s perspective. Even being a large company does not mean that identifiability is a given. For instance, if the AI agent provider is a “gatekeeper”, Article 5(2) of the Digital Market Act (DMA) prohibits cross-use or combination of data without consent, making it illegal for the gatekeeper to leverage information from one of its so-called “core platform services” to identify an individual in the absence of his or her consent. And if identifying data happens to be contained within the dataset and the natural person becomes identifiable, see below on technical, organisational and contractual measures that can be taken to limit the risk.

The fact that the natural person is (most likely) identifiable from the user’s perspective does not change this circumstance, because the identifiability in question is inherently tied to the user and does not extend to any processing taking place for the AI agent provider’s own purposes. The Danish authority illustrated this even in the case where an entity without means of identifying a natural personal data acts both as processor and separate controller:

If a processor wishes to process personal data pseudonymised by the controller for its own purposes – and thus beyond what the instructions dictate – it follows from the context (data processing structure) that the data is still personal data for the original controller. Therefore, the original controller must have the legal basis to disclose the personal data to the processor – the new controller – for its own purposes, regardless of whether the data in the new processing context may fall outside the definition of what constitutes personal data in the circumstances. [Datatilsynet, 22 October 2025, “Mere nyt om EU-Domstolens afgørelse om pseudonymiserede personoplysninger“, machine translation]

In other words, the third party whose data is being processed might be identifiable from a user’s perspective, but not (separately, for own purposes) by the AI agent provider. [For more on the issue of identifiability, see EDPB Guidelines on Anonymisation: where unforeseeable is reasonable?]

Given that non-personal data is not subject to data protection rules, information relating to individuals other than users could in theory be processed for AI training purposes by the AI agent provider without the GDPR applying.

The privacy risk of such AI training, and the likelihood of regulators holding that there is processing of personal data, can be further mitigated by the AI agent provider if it creates a separate training dataset in which the raw data is fed only after robust (and documented) processes for pseudonymisation – with a view to proper anonymisation. This can for instance be achieved by replacing patterns of data that could constitute personal data or at least identifying data from the user’s perspective with synthetic data (e.g. replacing “my red house in Main Street” with “my blue house on High Street” and replacing “Bob Church” with “Will Chapman”), putting in place separate access controls regarding the initial raw data on the one hand and the training dataset on the other hand, strong internal policies coupled with sanctions (in line with employment law) and organisational segmentation (with team separation). Such measures will likely make even an attempt to match the raw data to the training dataset unreasonable in practice, irrespective of whether it is even permitted in theory.

The practical implications are not that training can take place with no regard for data protection rules, though, as AI agents will likely process a mix of information: both data concerning the user and data concerning others. It does mean, however, that the main responsibilities for GDPR compliance in relation to data subjects other than the user rest upon the user’s shoulders. [Provided the household exemption does not apply – see below.]

It is therefore critical for AI agent providers to ensure that users are made aware of how their personal data can be processed for the AI agent provider’s own purposes, and to provide clear input to the user on how the AI agent might process personal data relating to third parties on the user’s behalf.

Some of this can be made clear to the user when activating a connector (as the connector allows the AI agent to process new types or sources of data), some can be made clear upon first use (more general information) or depending on the instruction (more granular information).

The relevance of providing such information comes not only from the AI agent provider’s own data protection obligations as controller, but also from its obligations in the context of its processing on the user’s behalf. Article 28(3)(e) GDPR requires a processor to assist the controller “by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights” – one such data subject right being the right to information under Art. 14 GDPR.

Under Article 14 GDPR [insofar as the household exemption does not apply – see below], a controller must inform a data subject about data sources where the controller did not obtain the personal data in question from the data subject – and it must do within at the latest a month:

“(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.”

The words “after obtaining the personal data” should not be interpreted as meaning that the one-month period starts only once the user receives output from the AI agent that includes such personal data. It follows from the analysis of data protection roles that the AI agent (and thus the AI agent provider) is acting on the user’s behalf, and that the user thus acts as controller for the provider. In this context, the AI agent’s actions will be viewed as the user’s own actions for various purposes under the GDPR – including the “obtaining” of personal data contemplated under Article 14 GDPR.

Rather, this provision means in practice that if an AI agent processes personal data regarding others on the user’s behalf, the user is required to inform those data subjects in question at the latest one month after the AI agent obtains or uses such personal data for the first time in relation to the relevant data subjects, but earlier in case of disclosure or communication with the data subject – and therefore that the AI agent provider has to make information about data sources available to the user, to enable the provision of such information.

---

5. Can a private user of an AI agent avoid GDPR obligations through the household exemption?

An important question for private users of AI agents is whether the household exemption can apply, as a result of which the GDPR would be inapplicable.

According to the CJEU, “the [household] exception must be interpreted as relating only to activities which are carried out in the course of private or family life of individuals”. [CJEU, 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, para. 44]

This position was confirmed in the Ryneš case: “the processing of personal data comes within the exception […] only where it is carried out in the purely personal or household setting of the person processing the data” (CJEU, 11 December 2014, František Ryneš, C‑212/13, EU:C:2014:2428, para. 31).

The use of what would normally be viewed as a “processor” (if the GDPR were to apply) does not appear to stand in the way of the application of the household exemption to the user’s processing of personal data. For instance, even though a personal (non-professional) mailbox might involve exchanges with various individuals, it stands to reason that its use will still be considered as “in the course of private or family life” even if it is not on a self-hosted mail server.

In the same vein, where a user uses an AI agent for own private and personal reasons for activities “in the course of private or family life of individuals”, it remains possible for the household exemption to apply.

It is important, though, to note that the household exemption does not apply to all private use of all possible data. The processing of personal data of professional contacts, prospects etc. can trigger the application of the GDPR; in most cases, processing of personal data of friends and family will not. Use of an AI agent to prepare and contact a list of personal contacts for a side hustle would then be subject to the GDPR, while using the agent to prepare and contact a similar list for holiday greetings would not.

And AI model training in all this? Just as explained above, where the AI agent provider carries out such processing, this is for own purposes, not on behalf of the user. In such a case, the provider will act as controller, and it is thus responsible for compliance with data protection rules.

[For more on the household exemption, see Slippery arguments: how the EDPB’s positions on smart glasses could affect smartphones and more]

---

A workable framework just requires pragmatic interpretations

The analysis of those five questions shows that although the GDPR was not designed with agentic AI in mind, it can work even in relation to the operation of AI agents – provided the core concept of delegation (with some degree of autonomy) is properly recognised.

Acknowledging that the user acts as controller for AI agent operation, and the AI agent provider as controller for own purposes such as training, reflects the actual distribution of responsibilities and purposes between user and AI agent provider.

Similarly, the principle of data minimisation need not be an obstacle to agentic AI, if one takes into account the entirety of the instruction, including context and data available through connectors. The more data the AI agent has to draw from, the more accurately it can achieve the user’s purpose. In any event, evidence of the data sources, context and chosen route is critical, to allow an objective assessment of whether the AI agent took the least intrusive route available.

Next, human oversight and intervention does not need to be as systematic as the “human-in-the-loop” label suggests. Different laws regulating agentic AI already only foresee human intervention in specific scenarios, not constant popups (GDPR, AI Act and even more explicitly, the newly proposed Digital Fairness Act). The question of user awareness of AI agent operation is then just as important (or even more so, from a statutory perspective) as that of user empowerment.

The scope of data protection obligations depends on what counts as “personal data”, and while user data will typically be personal data from the AI agent provider’s perspective, this may not be the case for data that the AI agent processes concerning third parties. It is crucial for both providers and users to understand which types of data will be processed in the course of performance by an AI agent of its tasks, as certain obligations for controllers under the GDPR will apply to the user in relation to such third parties.

The use of AI agents in a private context can benefit from the GDPR’s “household” exemption, but not every situation is covered, and it is highly context-dependent. Sticking to the processing of personal data of friends and family helps limit the likelihood of GDPR obligations applying to the user.

Together, these conclusions show that existing legislation already provides solutions to many questions concerning AI agents, and newly proposed legislation can further cement the possibility of proper delegation. Key challenges remain the issue of transparency and user understanding of own obligations, explainability of agentic functioning (notably regarding data sources), and sufficiently comforting technical, contractual and organisational measures in relation to AI training to mitigate the risk of training by AI agent providers constituting processing of personal data.

While the future of law and policy making might be adapted by agentic AI to a certain extent, many laws themselves do not need to be adapted to agentic AI in order to apply usefully to AI agents.