Skip to main content
Praxikon
DPIA intake

Free agent check · AI Act and GDPR

Agent check: which rules apply to your AI agent?

By , AI and privacy legal adviserUpdated

The short answer

An AI agent is usually an AI system within the meaning of the AI Act (Article 3(1)) and falls under the GDPR as soon as personal data is processed with it. What exactly applies depends on your role, the agent's task and what it may do on its own. This check sets that out for you.

Answer nine questions about the use case and five about the agent. You see straight away which duties under the AI Act and the GDPR are likely to apply, with the article behind every conclusion, an assessment of five risks that come with agents and a prefilled entry for your agent register. You can then receive the DPIA intake and the FRIA draft as Word files by email.

  • Free
  • Five minutes
  • Calculated in your browser

Background: the guide AI agents and the law

About the use case

Nine questions from the DPIA intake: who you are, what the agent does and with which data.

1. What kind of organisation uses the system?

Open: unknown stays an open question

2. What is the role of that organisation with regard to the AI system?

Open: unknown stays an open question

3. Is it an AI system: does it infer the outcome from data itself (machine learning, language model), rather than only applying fixed rules written by a human?

Fixed rules drawn up by people, such as a calculation rule or a written-out decision tree, are not. A model trained on examples is, even if it stops learning once in use. An expert system that draws its own conclusions from encoded knowledge can be too.

Open: unknown stays an open question

4. Are personal data processed (data about identifiable people)?

Open: unknown stays an open question

5. What is the system used for?

Areas of Annex III or Annex I of the AI Act. For other insurance than life or health, or for fraud detection, choose none.

Open: unknown stays an open question

6. Does the system produce a score, ranking or prediction about persons (profiling)?

Scoring businesses (establishments, declarants, licence holders): yes only if sole traders or other natural persons are among them; only legal persons: no.

Open: unknown stays an open question

7. Is the decision about a person taken without a human assessing the case on its merits?

Also yes if a human only sees part of it, such as the top ten, and the rest get a decision, such as a rejection, without human review. Merely not being selected for closer checks is no decision.

Open: unknown stays an open question

8. Does the outcome have legal effects or affect people significantly (benefit, job, loan, investigation, exam)?

Open: unknown stays an open question

9. Does the system do one or more of these things?

About the agent

Five questions about what the agent can do on its own. That is where the risks sit that an ordinary check misses.

1. What can the agent do on its own, without a person stepping in?

Choose everything that applies.

2. Which outside content does the agent read?

Content you do not control. A hidden instruction can sit in it.

3. Can the agent see confidential data?

Personal data, customer files, trade secrets or credentials.

4. Where does a person approve before the agent acts?
5. Is what the agent does logged, and can you stop it?

How it works

From questions to an entry in your register

  1. 01

    The use case

    Nine questions from the DPIA intake: your role, the agent's task and the data.

  2. 02

    The agent

    Five questions about what the agent can do on its own: actions, outside content, confidential data, approval and logging.

  3. 03

    The assessment

    Five points about the agent, the case check assessment under the AI Act and the GDPR, and your entry for the agent register.

Frequently asked questions

About the agent check

What is the agent check?

A free Praxikon tool that shows which rules of the AI Act and the GDPR are likely to apply to an AI agent, and where it stands on five risks that come with agents: the dangerous triangle, human approval, disclosing that it is AI, logging and kill switch, and vendors. It uses the same fixed rules as the DPIA intake, plus five tests for agents.

What happens to my answers?

The assessment is calculated in your browser. Your answers about the agent never leave your browser. Your answers about the use case only go to the server if you request something by email yourself, such as the DPIA intake or the report below the assessment.

What is the dangerous triangle?

An agent that can see confidential data, reads outside content and can send things outside on its own can be made to send data away through a hidden instruction in an email or web page. Remove one of the three, or have a person approve every outbound message.

Is this legal advice?

No. The check gives a first assessment based on your answers, the legal text, the Commission guidelines, the Dutch Data Protection Authority's warning and the OWASP list for agents. If you want a legal adviser to review it and sign off the assessment, Praxikon can arrange that.