ICO reports AI developer privacy commitments and seeks evidence on agents

Commitments under continuing supervision

The UK’s Information Commissioner’s Office says ten foundation-model developers have made, or committed to make, data protection changes after its supervisory work. The regulator’s October 8 statement describes improvements to transparency, mechanisms for exercising rights and assessments of safeguards.

The ICO says it is monitoring progress against those commitments. That distinction matters when reading the announcement: a commitment to make a change is different from evidence that the change has already been completed and verified in a particular service.

Questions about agents after deployment

The ICO has opened a six-week call for evidence on agentic AI. It is seeking views on how organizations manage data protection risks when systems use tools and interact with external services with limited human oversight.

The regulator also confirms enquiries concerning recent agent testing and deployment. Its statement describes those enquiries as ongoing. This announcement does not establish the outcome of an investigation or determine that a particular company has breached the law.

Evidence that would make the discussion useful

The ICO lists security, transparency and accountability among the subjects of the call. An organization contributing evidence could describe a concrete workflow, the personal information it involved and the controls applied when an agent took an action.

That account would be more informative than a general assertion that the system is safe. Explain who authorized access, how an unexpected action was detected, and what evidence a reviewer could examine afterward. Those are practical questions suggested by the regulator’s stated concerns. Organizations should consult the actual statement and applicable guidance when deciding how the announcement relates to their obligations; this report summarizes the announcement rather than supplying a compliance determination.