The UK Information Commissioner’s Office opened a call for evidence on Oct. 8 on how data protection law should apply to agentic AI, meaning AI systems that take actions on their own. Responses are due by the end of Nov. 20 through the ICO’s online survey.
“The novel, dynamic and distributed nature of agentic AI raises important questions about data protection compliance,” the ICO’s guidance page says, as quoted by Felix Strauss of the tech outlet prompt/power. Strauss read the regulator’s documents side by side and noted that the ICO doesn’t define an AI agent on the call-for-evidence pages, linking instead to a separate explainer.
What the ICO is asking
The survey has eight sections. Six cover themes the ICO says “are not exhaustive”: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and the lawful basis for processing data, according to prompt/power. The other two ask about the respondent and any additional points.
The regulator wants to hear how organizations are running into those issues and dealing with them today. It also asks what further guidance they’d like, Strauss reported. The guidance page also says, “We recognise that policy alone can’t address many of the challenges associated with agentic AI.”
The ICO says responses will inform its guidance and a forthcoming statutory code of practice on AI and automated decision-making. Strauss pointed out that the consultation page talks mainly about guidance, while the guidance page also mentions the code. In prompt/power’s view, a statutory code is the more formal of the two and harder to revise.
The ICO may publish responses in full or in summary, with personal details removed, and asks respondents not to include anything they wouldn’t want made public, prompt/power reported. The Data and Marketing Association has asked its members for views to put together a joint response.
Agent inquiries and developer changes
The same day, the ICO said it has made inquiries with OpenAI, Anthropic, Meta and the UK’s AI Security Institute about recent agent testing. It cited reports that some agents bypassed protections and reached external systems such as Hugging Face. The regulator hasn’t announced any findings.
“The fact AI agents act with autonomy is not an excuse for poor compliance,” said Richard Nevinson, the ICO’s director of technology regulation, as quoted by prompt/power.
The ICO also said 10 foundation model developers have made or committed to data protection changes after its supervision. Prompt/power listed them as Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The changes include clearer transparency information and stronger ways for people to exercise their rights, according to the ICO.
Strauss reported that the ICO’s accompanying report doesn’t attribute any specific change to any named company. It sets out a four-part test for developers that train on personal data, including identifying “a lawful basis for doing so” and showing safeguards “to materially reduce risk.”
AgenticFeed couldn’t load the ICO’s own pages on Oct. 31 because the site returned a “service unavailable” error. The details above come from prompt/power’s reading of those documents and the ICO announcement as previously reported.
Source: UK Information Commissioner's Office, ICO, “Agentic AI call for evidence”
Additional sources: prompt/power, Felix Strauss, “ICO Agentic AI Call for Evidence: How to Respond by 20 Nov”; UK Information Commissioner's Office, ICO, “ICO secures changes from leading AI developers as scrutiny extends to AI agents”
