Adopting AI agents safely: a checklist including data protection

Key points

It starts with an inventory: which agents, which actions, which access.
Every agent receives mandates per task with limits, an expiry date and revocation.
Actions with consequences are checked outside the model before execution and recorded afterwards.
Data protection under the Swiss Data Protection Act and GDPR belongs from the start, not after deployment.

1. Inventory

Which agents are in use or planned, developed internally or purchased?
Which actions do they carry out, and which of them have consequences, such as payments, orders, changes to data or submissions to authorities?
Which systems, accounts and data do they access, and with which credentials?
Who is responsible for each agent, functionally and technically?

Without this overview, all further measures remain piecemeal. Keep it current, because new agents often appear faster than new policies.

2. Define authority

Every agent receives its own mandate per task instead of shared credentials.
Every mandate has action types, amount limits, permitted counterparties and an expiry date.
Mandates reference a status list so they can be revoked at any time.
Issuing mandates follows the same internal rules as authorizations and signatures.

The principle of least privilege limits the damage if an agent makes a mistake or is manipulated.

3. Control before execution

Actions with consequences are checked against the mandate before execution by a component outside the model.
Above defined thresholds, a person decides, and this approval is recorded as well.
When in doubt, the action is denied (fail-closed), for example if a status list cannot be reached.
Third-party content is treated as data, not instructions, to contain prompt injection.

4. Secure the evidence

Every executed action creates a signed execution receipt referencing decision and mandate.
Receipts are stored in a receipt chain whose state is regularly anchored with a timestamp.
Evidence packs can be exported for audits and disputes.
Samples are verified independently, for example with KYA in the browser or in the pipeline.

Agents often process personal data: customer data, contacts, orders. The Swiss Data Protection Act and, where the EU is involved, the GDPR set requirements for this. Particularly important are:

Principles: proportionality and purpose limitation (Article 6 of the Data Protection Act, Article 5 GDPR); an agent should receive only the data its task requires.
Data protection by design: privacy-friendly default settings (Article 7 of the Data Protection Act, Article 25 GDPR), such as selective disclosure.
Data security: appropriate technical and organizational measures (Article 8 of the Data Protection Act, Article 32 GDPR).
Processors: contracts with providers of models and agents (Article 9 of the Data Protection Act, Article 28 GDPR) and rules for disclosure abroad.
Automated individual decisions: information and hearing rights (Article 21 of the Data Protection Act) or specific rules (Article 22 GDPR) when an agent makes decisions with legal effect on individuals.
Impact assessment: for high risk, a data protection impact assessment (Article 22 of the Data Protection Act, Article 35 GDPR).

6. Operations and contracts

Denied actions and escalations are monitored; clusters are investigated.
There is a rehearsed procedure for compromised agents: revoke mandates, block keys, secure receipts.
Contracts with customers and suppliers define how actions by agents are handled and which evidence is required.
Staff who configure or approve agents are trained and know their responsibility.

Adoption does not have to solve everything at once. Start with the actions that could cause the most damage, usually payments and orders, and expand step by step.

A roadmap for the first 90 days

Days 1 to 30: inventory of agents and their actions with consequences, name those responsible, roughly classify risks. Days 31 to 60: for the most important use case, introduce mandates with limits, place a decision service before execution and create receipts. Days 61 to 90: verify evidence independently by sampling, rehearse the procedure for compromised agents, update data protection documents and secure the next use case following the same pattern.

Frequently asked questions

Where should a company start?

With an inventory of its agents and their actions with consequences. Then secure the areas with the greatest possible damage first, usually payments and orders.

Do agents require a data protection impact assessment?

Not always. It is required when processing may pose a high risk to the individuals concerned. Whether that applies depends on data, purpose and scale.

May agents work with customer data?

Yes, within data protection law. Purpose limitation, proportionality, data security and clear contracts with the providers involved are important.

How often should mandates be reviewed?

Regularly and whenever task, agent or provider change significantly. Mandates that are no longer needed are revoked.

Who in the company should be responsible for agents?

For each agent, one person functionally and one technically responsible. The functional side sets tasks and limits; the technical side takes care of mandates, keys and receipts.

How do I test whether the controls work?

With targeted tests: an action above the limit, a revoked mandate, an unreachable status list. In all cases, the action must be denied and this must be recorded.

What to do if an agent is compromised?

Revoke mandates immediately through the status list, block keys, secure receipts and review affected actions. The procedure should be rehearsed beforehand.

How many mandates does an agent need?

As many as there are tasks with different limits. An agent that pays invoices and books travel should have two mandates with their own limits for this, instead of one broad mandate for both.

What does introducing mandates and receipts cost?

That depends on the number of agents and systems. KYA's engine is free; effort arises mainly for the mandate service, the decision service and integration into existing processes.

General information, not legal advice. The statutes and the circumstances of each case are decisive.

Sources

Bundesgesetz über den Datenschutz (DSG): https://www.fedlex.admin.ch/eli/cc/2022/491/de
Datenschutz-Grundverordnung (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj
NIST: Least Privilege: https://csrc.nist.gov/glossary/term/least_privilege