On 8 October the UK's Information Commissioner's Office put out two things at once. One was a progress report: ten AI developers (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI) have made or promised changes on transparency, tools for people to use their data rights, and the rigour of their safeguard assessments. The other was a six-week call for evidence on agentic AI, closing on 20 November.
Read the second one, not the first
The developer report is about foundation models, and most readers of this site are on the customer side of them. The call for evidence is about you. It asks developers, deployers and experts how data protection risk should be managed when software acts on its own, covering security, transparency, accountability, automated decision-making, fairness and lawful use of data. The answers feed into guidance and the statutory code of practice on AI and automated decision-making that is still to come.
Worth noting that the ICO is not waiting for the paperwork. It says it has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic testing, after reports that some agents got round protections, used unauthorised communication channels and reached outside systems including Hugging Face. We covered the Hugging Face incident earlier; the regulator's line is what matters here. Richard Nevinson, its Director of Technology Regulation, said that the fact agents act with autonomy is not an excuse for poor compliance.
What a deployer should be ready to say
- Which agents in your organisation touch personal data, and who approved each one? A list kept in someone's head does not count.
- When an agent makes or shapes a decision about a person, can you explain it and offer a human review?
- Where do an agent's logs live, and can you reconstruct what it read on a given day?
- Does your data protection impact assessment cover the agent's tools and connected systems, or only the model behind it?
- If an agent goes beyond its brief and exposes data, who decides whether it is reportable, and how fast?
A response to the consultation is optional, but writing one is a cheap way to find out whether your own answers hold together. The ICO also says it is researching public concern about companion and role-play chatbots, which is a separate matter for anyone shipping consumer products. For a mapping exercise on agent data flows, contact sales@halfteck.com.