← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

A DPO checklist for AI agents

An LLM agent processes personal data in more places than a normal application: in prompts, in retrieved documents, in tool arguments, in model output and in logs. It may also take decisions. This checklist is meant for the review meeting before go-live.

Purpose and legal basis

• [ ] What is the agent for, and what is it explicitly not for?
• [ ] What is the legal basis for each processing activity it performs?
• [ ] Does it take decisions with legal or similarly significant effects on people (GDPR Art. 22)? If yes, where is the human?

Data flows

• [ ] Which personal data enter prompts, and from where?
• [ ] Which tools can read or write personal data?
• [ ] Which model providers receive the data, in which region, under which terms, and do they train on it?
• [ ] Are sub-processors listed in the record of processing?

Logs

• [ ] Which events are logged, and is prompt and output content included?
• [ ] Could content be replaced by hashes or references while keeping traceability?
• [ ] Retention period, and how it reconciles storage limitation with the AI Act's minimum of six months for high-risk systems (see Article 26)
• [ ] Who can read the logs, and is access itself logged?
• [ ] Can the logs be shown to be unaltered, if needed for a complaint or an authority?

Risk and rights

• [ ] Is a DPIA required (GDPR Art. 35)? For high-risk AI, deployers use the provider's instructions for use to carry it out.
• [ ] How are access, rectification and erasure requests handled for data inside logs and retrieval corpora?
• [ ] What stops the agent from disclosing personal data to the wrong person (policies on outbound tools, PII patterns)?
• [ ] How are incidents detected and how fast can affected runs be identified (see Article 73)?

Evidence to request

• [ ] A sample run log, and a demonstration that tampering with it is detected
• [ ] The policy file enforced at runtime
• [ ] The vendor's instructions for use (see Article 13)

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 49 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.