CLAIM-2026-09-18-03

The AEPD states that use of a particular AI model does not imply the model or its provider's infrastructure was compromised, nor that the tool was designed for malicious activity; what matters is that a third party used the agent as an instrument to chain the phases of the attack.

Why it matters

It closes off the provider framing. If the model was not compromised and was not built for this, no duty moves to the model provider and Article 32 stays with the controller.

Sources

• agenciaespa2026primera