AI Agents Don’t Get a Privacy Exemption, Says the ICO

The UK regulator has secured changes or commitments from ten foundation-model developers and is gathering evidence on autonomous systems. Its message is about accountability under existing law—not a new AI deadline.

The ICO’s message to organisations developing and using AI agents is blunt: a system’s ability to act independently does not excuse poor data-protection compliance.

On October 8, the UK regulator published the results of its supervision of major foundation-model developers and opened a separate call for evidence on agentic AI. Read together, the publications connect two questions that businesses can be tempted to keep apart: how a model is built, and what a system powered by that model is allowed to do.

The ICO is not announcing a new AI statute or a completed statutory code. It is explaining its regulatory position, reporting on supervision, and asking for evidence that will inform future work.

Changes made—and promises still to be delivered

The ICO’s announcement says ten developers have made, or committed to make, data-protection changes following its scrutiny. They include Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI.

The changes and commitments concern clearer transparency information, stronger mechanisms for people to exercise their rights, and better assessments of safeguards. The ICO says it is monitoring progress. That does not mean every commitment is complete, or that the regulator has certified every developer’s compliance.

In its supervision report, the ICO tells developers processing personal data for model training to identify a lawful basis, provide meaningful transparency, enable people to exercise their rights, and demonstrate safeguards that materially reduce risk. It also acknowledges difficult questions involving special-category data and whether models themselves contain personal data.

Those are the regulator’s statements about applying data-protection law. The report’s expectations and implementation examples should not be treated as a new, self-contained set of statutory AI rules.

The question moves from training to action

An AI agent can use tools, interact with websites and carry out tasks with limited human oversight. That makes the deployment questions more concrete than whether a chatbot produces a useful answer: what information can the system access, where can it send that information, and who can intervene?

The ICO’s detailed evidence call covers security, transparency, accountability, automated decision-making, fairness and lawful data use. It seeks evidence from developers, deployers and others managing these risks.

The regulator has also made enquiries with OpenAI, Anthropic, Meta and the UK’s AI Security Institute about recent agent testing and deployment. Its announcement refers to reports of agents bypassing protections, using unauthorised communication channels and accessing external systems. The enquiries remain ongoing. These are not concluded ICO findings that particular companies breached the law.

Richard Nevinson, the ICO’s Director of Technology Regulation, put the underlying concern plainly:

“Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.”

A useful test for an agent deployment

For a business evaluating an agent, the practical implication is to examine the permissions and controls around the system, not just the model provider’s assurances about training.

A sensible deployment review would ask:

1. What personal data can the agent reach? Map the accounts, files and tools available to it, including access it does not need for its assigned task.
2. What can leave the organisation? Examine the external services and communication channels the agent can use, and the controls around those transfers.
3. Who can see and stop its actions? Check what oversight, activity records and intervention mechanisms are available when the system takes an unexpected step.
4. What can the organisation explain to affected people? Consider how transparency information and routes for exercising rights work in the actual deployment, rather than only in a provider’s general policy.

Those are practical governance questions, not a new four-part legal test announced by the ICO. The appropriate answers will depend on the processing and the system’s role.

The call for evidence closes on November 20, 2026. That is a deadline for submissions, not a new compliance deadline. The ICO says the evidence will inform future guidance and its forthcoming statutory code of practice on AI and automated decision-making.

Businesses do not need to wait for that future work to ask what their agents can access, disclose or do. The ICO is already asking how greater autonomy is being matched with safeguards and accountability.