Spain’s data protection authority (AEPD) has received the first breach notification involving an AI agent under the General Data Protection Regulation (GDPR). The case represents a significant development in regulatory oversight of artificial intelligence systems and their handling of personal data. The incident highlights how existing data protection frameworks are being applied to emerging AI technologies.