AI remote maintenance: consent, duration, STOP and traceability

Handing a task to an AI on a computer is a form of remote maintenance: someone acts remotely on a machine that holds your data. The CNIL’s personal data security guide (2026 update) sets simple rules for such interventions. Here is how to apply them when the one intervening is an AI.

What the CNIL recommends

• Sheet 15, maintenance: open remote-maintenance access for a duration suited to the job and set in advance, then close it; never leave full or permanent access; record interventions in a logbook; avoid tools that do not encrypt communications.
• Sheet 6, workstations: a remote administration tool gets the user’s agreement before acting, and the user can see when remote control is in progress and when it ends.
• Sheet 16, traceability: log technical interventions and keep those records over a rolling period of six months to a year.

Example: a three-person office

The manager wants her AI assistant to file this month’s supplier invoices on the front-desk computer and prepare a summary table. That computer also holds client folders. Rather than opening access “for the week”, she prepares the job as she would for a contractor.

Before: set the scope and the end time

• Write the task in one sentence, naming the folder: “only Invoices/2026-11”.
• Check that a recent backup exists, or have the AI work on a copy of the folder.
• Set an end: “the job ends at 11 am, or as soon as the table is ready”.

During: agreement given on the computer itself

With SteerLatch, the AI’s first request opens a consent window on the computer concerned, not only in a browser: the person at the desk sees that an AI wants to act and chooses what to allow (files, terminal, screen, mouse and keyboard). Untick what the task does not need: filing documents needs neither the screen nor the keyboard. Your SteerLatch account shows the AI’s activity live, action by action.

After: close the access

This is the step most often forgotten. In SteerLatch, consent stays valid with no time limit until you withdraw it: you are the one who enforces the end time. When it comes, withdraw the computer’s authorization (on a Mac, from the SteerLatch menu bar icon) or revoke the AI or the computer from your account. STOP is the emergency brake: it blocks new actions and interrupts those in progress, but it does not withdraw consent.

Trace: a simple logbook

SteerLatch keeps an activity log (type of action, computer, time, result) for 90 days, without file contents or command text. It helps you check what happened, but it is not a complete logbook, and it is shorter than the six months to a year the CNIL mentions. So record each intervention yourself: date, task, AI used, computer, who agreed, end time and outcome. One spreadsheet row is enough.

Checklist

1. Task written down, folder named, end time set.
2. Recent backup or working copy.
3. Agreement given on the computer, unticking what is not needed.
4. Activity followed live during the job.
5. Authorization withdrawn or revoked at the planned time.
6. Row added to the logbook.
7. Result checked by a person before it is used.

Limits to keep in mind

• STOP and revocation prevent what comes next; they do not undo an action already completed, and an operation already under way may finish.
• The terminal runs commands with the rights of the computer’s account: it is not a sandbox.
• What the AI reads (file extracts, screenshots) goes to its provider, under its own rules. SteerLatch keeps no copy.
• These steps are good security practice; they are neither a certification nor GDPR compliance for your processing.

Read also: STOP, consent and revocation, back up before letting an AI act and the SteerLatch help.