Information Commissioner’s Office seeks evidence on agentic AI privacy risks

What happened

• The UK Information Commissioner’s Office issued a call for evidence on 8 October 2026 regarding the application of existing data protection rules to agentic AI.
• The consultation invites input on privacy challenges such as data subject rights, consent and automated decision‑making.
• The ICO will use responses to shape future guidance or regulatory proposals.
• No immediate compliance deadline was announced.

Why it matters

Organizations deploying autonomous AI should prepare to assess how current privacy obligations—like lawful basis, transparency and rights fulfilment—apply to their systems and be ready to submit evidence if required.

Business impact

Failure to anticipate how data protection rules intersect with agentic AI could lead to future enforcement actions or costly redesigns once guidance is formalised.

What to check

1. 1

   review AI data flowsHigh priority

   Map how personal data is collected, processed and shared by autonomous AI systems to identify gaps with GDPR principles.

2. 2

   prepare evidence submissionMedium priority

   Gather documentation on privacy impact assessments and consent mechanisms for potential inclusion in the ICO’s evidence request.