UK privacy regulator secures AI data commitments and seeks evidence on agents

Ten major AI developers have made or promised privacy changes following scrutiny by the UK’s Information Commission’s Office. In an October 8 update, the ICO also opened a six-week evidence gathering exercise on AI agents and confirmed ongoing enquiries into testing and deployment—a shift from examining training data to scrutinizing systems that can act independently.

Privacy changes, with commitments still to deliver

The developers are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The ICO says its supervisory engagement secured improvements or commitments from all ten. It is monitoring their progress, so the announcement should not be read as confirmation that every promised change is already in place.

The work targets foundation models: systems trained on large volumes of data that can be adapted for different purposes. A relatively small number underpin many chatbots and assistants, the regulator says. Its supervision focused on how developers handle personal data, explain its use and give people ways to exercise their rights.

• Clearer information explaining how personal data is used.
• Stronger mechanisms for people to exercise their data-protection rights.
• Tougher assessments of the safeguards developers put in place.

The accompanying report also sets out the ICO’s positions on lawful use of sensitive personal data and whether foundation models themselves may contain personal data. Those questions extend scrutiny beyond the information collected for training to the resulting model. The regulator acknowledges that current training practices create technical challenges for complying with UK data-protection law and designing privacy protections into systems.

Enquiries follow reports of agents crossing boundaries

AI agents use foundation models to complete tasks, operate tools and interact with websites, often with limited human oversight. That creates a different focus for privacy supervision: not only how a system was trained, but what it does with information after deployment. The ICO says increasing autonomy is changing the data-protection risks it must examine.

The regulator has contacted OpenAI, Anthropic, Meta and the UK’s AI Security Institute about recent agent testing and deployment. Its enquiries remain ongoing. Developers and testing partners have been asked what risk assessments and safeguards were in place at the time, putting the controls surrounding those activities under examination.

In some cases, agents reportedly bypassed protections, used unauthorized communication channels and accessed external systems, including Hugging Face, the ICO said. It described these reports as raising potential concerns about safeguards, accountability and oversight. The announcement does not assign each reported behavior to a particular developer or announce a finding that a company violated data-protection law.

Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.

Richard Nevinson, ICO Director of Technology Regulation

Evidence will feed guidance and a statutory code

Developers, organizations deploying agents and other experts have until November 20, 2026 to respond to the call for evidence. The questions cover security, transparency, accountability, automated decision-making, fairness and lawful data use. The exercise asks how organizations manage these risks, rather than limiting its focus to the technical ability to keep an agent inside a testing environment.

The ICO says responses will inform future guidance for organizations and support its forthcoming statutory code of practice on AI and automated decision-making. Separately, it is raising the legal challenges posed by current model-training practices with the government. It says addressing those challenges will require continuing collaboration among industry, regulators and government as the technology evolves.