Security when deploying artificial intelligence in the enterprise: GDPR, the EU AI Act and AI agents

Security is the concern that comes up most when a leadership team considers deploying artificial intelligence: where does the data go, what can the AI do on its own and what happens if it gets something wrong. These are reasonable questions, because an AI agent does not just respond, it also acts on the company’s systems. This guide explains the real risks, the controls we apply in every project and what the GDPR and the EU AI Act require.

Why security changes when AI moves from responding to acting

An assistant that drafts text carries a limited risk: if it gets something wrong, a person corrects it before using it. An AI agent connected to the ERP, the CRM or the switchboard can log an order, change a record or give information to a customer without anyone reviewing it beforehand. That is why the security design of an agent centres on three questions: what it has access to, what it can do without approval and how what it did can be demonstrated afterwards.

These are the risks we see most often in audits:

• Data leakage: customer or company information sent to tools with no contract or control.
• Incorrect actions: the model misreads a request and executes something it should not have.
• Impersonation: someone pretends to be a customer or an employee in order to obtain data or trigger an action.
• Malicious instructions (prompt injection): an email, a document or a message contains text designed to manipulate the AI.
• Fabricated answers: the model confidently replies with something that is not in the company’s data.
• Shadow AI: employees using AI tools on their own, with company data and no usage policy.

The principle: the AI converses, the rules decide

A language model is very good at understanding requests and not at all reliable as the final judge of a sensitive action. That is why we separate the two functions: the AI understands, converses and proposes; a fixed rules engine, written and tested by the team, decides whether the action can be executed. If the rule is not met, the action does not happen, whatever the conversation says.

Eight controls for deploying AI agents securely

1. 1Minimum permissions: the agent uses its own service account, with access only to the data and actions it needs, and read-only where that is enough.
2. 2Deterministic rules for sensitive actions: payments, refunds, data changes, access or discounts are validated with fixed rules and limits.
3. 3Identity verification: check that the phone number or email matches the record and ask for a one-time code before sharing personal data or executing actions.
4. 4Data in the European Union: European hosting and model providers with a data processing agreement that do not use your data for training.
5. 5Minimisation: only the information needed for each request reaches the model; everything else stays in your systems.
6. 6Defence against malicious instructions: external content (emails, documents, websites) is treated as data and never as commands, and the agent can only use a closed list of tools.
7. 7Logging and audit: every conversation, query and action is recorded with the date, user and result.
8. 8Human oversight: the agent escalates when it is unsure or when the case requires it, and a person can step in at any time.

A real example: an AI receptionist that opens doors

In AI Reception 24h, an artificial intelligence receptionist that answers by phone and WhatsApp 24 hours a day, the agent can open doors through the access control API. This is a sensitive action, so it does not depend on the conversation: the system checks that the phone number matches the record, sends a one-time code and, only if the code is correct and the schedule and permission rules are met, carries out the opening. Every step is logged and any doubtful case goes to a person.

GDPR: what must be settled before you start

• A legal basis for each processing activity the agent carries out, normally contractual relationship or legitimate interest.
• Clear information for customers and employees about the use of AI and their data.
• Data processing agreements with every supplier involved: hosting, AI model, telephony or messaging.
• An impact assessment where the processing requires it, because of volume or type of data.
• Retention periods for conversations and recordings, and a procedure for handling individuals’ rights.

The EU AI Act: what it means for an agent in the company

The EU AI Act classifies systems by level of risk. Most customer service, sales or back-office agents are considered limited risk: the main obligation is transparency, meaning that the person must know they are talking to an AI. High-risk uses, such as recruitment or creditworthiness assessment, have much more demanding requirements for documentation, oversight and risk management.

The regulation also requires that staff who use AI systems have adequate training. In practice, this means explaining to the team what the agent does, what its limits are and how to intervene. In Spain, supervision falls to the Spanish Artificial Intelligence Supervisory Agency (AESIA). This guide does not replace legal advice: if your use case may be high risk, it is advisable to review it with your legal adviser.

Internal usage policy: the other half of security

A large part of the risk lies not in AI projects but in informal use. A simple policy avoids most problems: which tools are approved, which data is never pasted into an external tool, who approves new uses and who is notified if something goes wrong. Offering approved, useful tools reduces the incentive to use others on one’s own.

Checklist before putting an AI agent into production

• It is documented what the agent can do on its own and what needs approval.
• The agent uses its own account with minimum permissions.
• Sensitive actions go through fixed, tested rules.
• There is identity verification before personal data is given out.
• Data is hosted in the European Union and there are contracts with all suppliers.
• Every conversation and action is logged and can be consulted.
• There is a clear path for handing the case over to a person.
• It has been tested with real cases and manipulation attempts before launch.
• The team knows how the agent works and how to intervene.