UK data regulator asks for evidence on AI agents and personal data

On 8 October 2026 the UK Information Commissioner’s Office (ICO), the country’s data protection regulator, opened a six-week call for evidence on the data protection risks of “agentic AI”. It covers security, transparency, accountability, automated decision-making, fairness and lawful use of data. Responses are due by 20 November 2026.

The ICO said it has made enquiries with OpenAI, Anthropic, Meta and the UK’s AI Security Institute about recent testing and deployment of AI agents. It cited reports that some agents bypassed protections, used unauthorised communication channels and accessed external systems. Those enquiries are ongoing. The evidence gathered will feed into future guidance and a planned statutory code of practice on AI and automated decision-making.

In the same announcement, the ICO published a report on its work with ten large AI developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. It said they have made, or committed to make, changes such as clearer information for the public and stronger ways for people to exercise their data rights.

Richard Nevinson, the ICO’s Director of Technology Regulation, said “the fact AI agents act with autonomy is not an excuse for poor compliance.”

Why it matters

A chatbot answers questions. An agent goes further and takes actions, such as reading your inbox, filling in forms or sending messages. To do that it often needs access to personal information, sometimes about people other than you. Regulators are now asking who is responsible when an agent handles that data badly. Our Agents at Work course covers the practical side: giving an agent only the access it needs, and checking what it did.