ICO and Agentic AI: What Deployers Should Document

The UK Information Commissioner's Office opened a six-week call for evidence on agentic AI on 8 October 2026, closing at the end of 20 November 2026, covering data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. The same day, the ICO reported that ten foundation model developers — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — had made or committed to changes on transparency, individual rights and safeguard assessments, and disclosed ongoing enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agent testing and deployment. Richard Nevinson, the ICO's Director of Technology Regulation, said an agent acting with autonomy "is not an excuse for poor compliance"; the call creates no new duty, as UK GDPR already applies to agent processing under Articles 22A to 22D, and the evidence will feed a statutory code of practice on AI and automated decision-making required since 12 May 2026.

← All posts https://reinvently.co.uk/blog/ Key Takeaways - On 8 October 2026 the ICO opened a six-week call for evidence on agentic AI. It closes at the end of 20 November 2026 and covers data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. - The same day, the ICO reported that ten foundation model developers had made or committed to changes on transparency, individual rights and safeguard assessments. It paused engagement with X.AI after opening a formal investigation into Grok. - The ICO has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agent testing and deployment. These are ongoing enquiries, not findings. - The call creates no new duty. UK GDPR already applies to processing by agents, including the automated decision-making rules in Articles 22A to 22D. The evidence will feed a statutory code of practice on AI and automated decision-making that the regulator has been required to prepare since 12 May 2026. - Deployers can prepare six records now: a controller map, an enforceable purpose, least-privilege access, permitted outbound channels, a test for significant decisions and a searchable trace of agent actions. Sources, checked 13 October 2026: the ICO's announcement ICO secures changes from leading AI developers as scrutiny extends to AI agents https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/ 8 October 2026 ; the agentic AI call for evidence https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/ ; the ICO's Tech Futures analysis of agentic AI data protection risks https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/data-protection-and-privacy-risks ; The Data Protection Act 2018 Code of Practice on Artificial Intelligence and Automated Decision-Making Regulations 2026 https://www.legislation.gov.uk/uksi/2026/425/made ; and the ICO's May 2026 response to government on AI https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/ . On 8 October 2026 the ICO published two things together. It reported that ten of the largest foundation model developers had made or committed to data protection changes after a period of supervision, and it opened a six-week call for evidence on how organisations manage the data protection risks of AI agents. The announcement also disclosed that the ICO has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agent testing and deployment. Richard Nevinson, the ICO's Director of Technology Regulation, said that an agent acting with autonomy "is not an excuse for poor compliance". The call is addressed to developers, deployers and other experts. Its sections show what the regulator will ask organisations running agents, and most of the answers are records a deployer can start keeping now. What the ICO Announced on 8 October - A call for evidence on agentic AI. Open from 8 October until the end of 20 November 2026, through the ICO's Citizen Space survey. Its sections cover data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. The ICO says the evidence will inform future guidance and support its statutory code of practice on AI and automated decision-making. - Commitments from ten foundation model developers. Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI made or committed to clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards. The ICO says it is monitoring progress against the commitments. - X.AI removed from the programme. The ICO paused engagement with X.AI after opening a formal investigation into its Grok system. That investigation is ongoing. - Enquiries into agent testing. According to the ICO, reports indicated that some agents bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face. It has contacted developers and their testing partners to establish what risk assessments and safeguards were in place. What Is Binding Now, and What Comes Later The call for evidence creates no new obligation. UK GDPR applies to processing by an agent in the same way as to any other processing, and the organisation that decides why and how the agent processes personal data remains responsible for it. The ICO's Tech Futures analysis puts it plainly: "AI agency does not mean the removal of human, and therefore organisational, responsibility." The regulator itself changed form on 30 September, when the Data Use and Access Act 2025 replaced the Information Commissioner with a board-led Information Commission. It is still called the ICO, and its powers and open investigations carried over. Two pieces of law already shape what comes next. The automated decision-making rules in UK GDPR Articles 22A to 22D, introduced by the Data Use and Access Act 2025, have applied since 5 February 2026 https://reinvently.co.uk/tools/uk-ai-deadlines/ . They allow significant solely automated decisions using non-special-category data where safeguards are in place, including information for the person affected, a way to contest the decision and access to human intervention. Separately, regulations in force since 12 May 2026 https://www.legislation.gov.uk/uksi/2026/425/made require the regulator to prepare a statutory code of practice on processing personal data when developing and using AI and in automated decision-making, including guidance on children's data. The code has no publication date. It must go through consultation and an expert panel before it is laid before Parliament, and in May the ICO said it would also publish dedicated guidance on agentic AI during 2026/27. A breach of a statutory code does not by itself create liability, but under section 127 of the Data Protection Act 2018 courts, tribunals and the ICO must take relevant provisions into account. The agentic AI evidence gathered now will shape what that code expects. What the Enquiries Tell Deployers The ICO has not said what it found or which incidents prompted each enquiry. The behaviours it lists do match incidents that developers and the AI Security Institute have published, and that our agent incident log https://reinvently.co.uk/tools/agent-incidents/ records from primary reports. OpenAI disclosed in July that evaluation agents escaped their sandbox and reached Hugging Face. The AI Security Institute reported that in 10 of 122 cyber-evaluation runs, agents took 19 unauthorised actions on the live internet, most of them from Anthropic's Mythos 5 under permissive test conditions. OpenAI also reported a research agent that reached an external chatbot through the sandbox's DNS resolver after direct internet access was blocked. These were developer tests, not enterprise deployments, and an organisation running a customer service agent faces different risks from a lab testing cyber capabilities. The regulator's question still carries over. It asked what risk assessments and safeguards were in place. That is a question about records, and it is the one any deployer should expect after an incident involving personal data. Who Should Pay Attention - AI developers. The call seeks developer evidence directly, and the ten commitments show what the ICO's supervision produces in practice: transparency information, rights mechanisms and assessments of whether safeguards work. - SaaS vendors adding agent features. Once a product acts on a customer's data on its own initiative, the split of controller and processor responsibilities needs to be explicit. The ICO's Tech Futures analysis expects suppliers to have governance in place before sale. - Procurement teams. Agent features are arriving inside tools already under contract. The six records below double as questions to put to vendors at renewal. - Privacy officers. A data protection impact assessment written for a chatbot that drafts text may not cover an agent that calls tools, keeps memory and sends data to other systems. The trigger for review is the new capability, not a new product name. Six Records to Keep Before an Agent Acts on Its Own Each record below maps to a section of the call and to a risk the ICO's Tech Futures analysis identifies. None requires new tooling to start, and each is something a regulator, an auditor or a customer could reasonably ask to see. 1. A controller map. For each agent workflow, record who decides the purpose and means of each processing step: your organisation, the agent platform, the model provider or a connected service. Name who handles rights requests at each step. This is the accountability section of the call in practical form. 2. A purpose specific enough to enforce. The ICO warns that "organisations could set purposes too broadly" for agents. Write each agent's task as a list of permitted actions and enforce it outside the model, through tool and data permissions, rather than relying on instructions in the prompt. 3. Least-privilege data and memory. List every data store, credential and scope the agent can reach, with a reason for each. The ICO says access is not justified "just because it might be useful in the future". Set retention periods for agent memory and logs, which hold personal data too. 4. Permitted outbound channels. Record where an agent may send data: named APIs, email domains, file destinations. Block everything else at the network layer, including indirect routes such as DNS. The enquiries concern agents that used channels nobody had approved. 5. A test for significant decisions. Identify where an agent's action could amount to a significant decision about a person, such as shortlisting a candidate, refusing a refund or suspending an account. Where it does, apply the Article 22A to 22D safeguards, and give the human reviewer both the authority and the information to overturn the outcome. Record whether the agent could infer special category data along the way. 6. A searchable trace. Log each tool call, the data read and written, and the model version, linked to the people concerned. Without it you cannot answer an access or erasure request or reconstruct an incident. The ICO calls the alternative "invisible processing". The fourth and sixth records are the ones most deployments lack. Agent platforms tend to log the conversation, not the network calls and data writes that sit behind it. What to Do Before 20 November 1. List the agents you run. Include pilots, internal tools and agent features switched on inside SaaS products you already buy. 2. Write the six records for your riskiest agent first. Start with one that can send data outside the organisation or make decisions about people. 3. Review the DPIA for each agent. Check that it covers tool use, memory, outbound transfers and any significant decisions, not only the model. 4. Add the records to vendor questions. Ask suppliers of agent features for their controller allocation, logging and outbound controls before renewal. 5. Consider responding to the call. Organisations running agents in production have evidence the ICO is asking for. Responses close at the end of 20 November, and the closing date is on our UK AI deadlines tracker https://reinvently.co.uk/tools/uk-ai-deadlines/ . Frequently asked questions When does the ICO's agentic AI call for evidence close? It opened on 8 October 2026 and stays open until the end of 20 November 2026. Responses go through the ICO's Citizen Space survey, and the ICO says it may not consider responses received after the deadline. Which AI developers made commitments to the ICO? Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The ICO says they made or committed to clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards, and that it is monitoring progress. It paused engagement with X.AI after opening a formal investigation into Grok. Is the ICO investigating OpenAI, Anthropic and Meta over AI agents? The ICO has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing and deployment, after reports that agents bypassed protections, used unauthorised communication channels and accessed external systems. The enquiries are ongoing. The ICO has not announced findings or described them as formal investigations. Does the call for evidence create new legal duties for AI agents? No. Existing UK GDPR duties already apply to processing by agents, including the automated decision-making rules in Articles 22A to 22D. The evidence will feed ICO guidance and the statutory code of practice on AI and automated decision-making, which regulations in force since 12 May 2026 require the regulator to prepare. We follow UK AI consultations from opening to outcome. Get new posts by email https://reinvently.co.uk/contact/ . ← All posts https://reinvently.co.uk/blog/