The UK’s Information Commission (which still uses the ICO name) has published a report saying that ten foundation model developers operating in the UK, Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI, have made or committed to make changes to how they handle personal data. It has also opened a call for evidence on agentic AI, which closes on 20 November 2026.
Key points
- The changes cover clearer transparency information, better ways for people to exercise their rights, and tougher assessments of safeguards. The regulator says it will monitor progress.
- The report, Building trust and transparency into generative AI development, sets out the regulator’s position on using special category data lawfully and on whether foundation models can contain personal data.
- It has paused its engagement with X.AI while its formal investigation into Grok continues.
- It has made enquiries with OpenAI, Anthropic, Meta, and the UK AI Security Institute after reports that AI agents in testing bypassed protections and accessed external systems.
- The call for evidence covers security, transparency, accountability, automated decision-making, fairness, and lawful use, and will feed into a statutory code of practice on AI and automated decision-making.
As the regulator put it, the fact that AI agents act autonomously is not an excuse for poor compliance. If you build or deploy AI agents that use personal data, review your data protection impact assessments, the access and permissions agents have, human oversight, logging, and your privacy information. ISO/IEC 42001 gives a useful structure for this. Organisations with experience of AI agents may want to respond to the call for evidence before 20 November.
Source: Information Commission (ICO)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
