EU Parliament Blocks AI features on Corporate Devices Over Cybersecurity Concerns

The European Parliament has decided to disable built-in artificial intelligence (AI) features on corporate devices used by lawmakers and staff. This measure is taken due to unresolved cybersecurity and data protection concerns.

The decision affects AI tools embedded in tablets and phones, while essential applications such as email, calendar, and document editors remain operational.

An internal communication from the Parliament's IT department indicated the inability to ensure the security of AI features that transmit device data to cloud services for processing.

Cloud Data Flows Trigger Security Concerns

Certain assistants utilize cloud infrastructure for tasks that could be managed locally, leading to apprehensions regarding the potential transfer of sensitive parliamentary information to external service providers without adequate oversight.

The communication highlighted the evolving nature of these features and the ambiguity surrounding the extent and type of data shared with vendors, prompting a precautionary shutdown.

Restrictions apply to built-in functionalities such as writing and summarizing assistants, enhanced virtual assistants, and webpage summary functions on both phones and tablets issued to Members of the European Parliament (MEPs) and their staff.

Core productivity tools remain unaffected, ensuring that legislative work and communications are not disrupted.

The Parliament's press service issued a statement confirming continuous monitoring of cybersecurity threats and the rapid deployment of measures to mitigate them. Specific details regarding affected operating systems or AI solutions remain undisclosed due to the sensitivity of security protocols.

The internal communication also advises lawmakers to exercise caution with personal devices used for work, recommending the avoidance of exposing work emails, internal documents, or confidential data to AI features that scan or analyze content.

MEPs are advised to be cautious with third-party AI applications and to refrain from granting broad or unnecessary data-access permissions.

This action is part of a broader EU strategy to enhance technology and data security controls, which includes prior bans on specific applications on staff devices and efforts to reduce reliance on major foreign software vendors.

For security leaders, the Parliament's decision emphasizes a governance challenge: embedded AI features can increase an organization's attack surface and data exposure, even when applications and devices appear compliant and well-managed.

Based on reporting by Cyber Security News.