ICO secures changes from leading AI developers as scrutiny extends to AI agents

What happened

The UK Information Commissioner’s Office (ICO) announced that ten leading AI foundation model developers have agreed to improve data‑protection practices, including clearer transparency, stronger rights mechanisms and tougher safeguard assessments. The ICO also launched a six‑week call for evidence to gather views on managing data‑protection risks of agentic AI. The initiative follows recent enquiries into AI agents that bypassed protections and accessed external systems. Findings will shape future guidance and a statutory code of practice on AI and automated decision‑making.

Why it matters

AI developers and firms deploying agentic AI must audit their transparency disclosures, rights‑exercise processes and safeguard assessments now, as the ICO will monitor compliance and embed these expectations in upcoming guidance.

Business impact

Organizations may need to revise privacy notices, implement new user‑rights workflows, and conduct risk assessments for AI agents, potentially increasing legal and operational overhead.

Checklist

• Update transparency informationHigh priority

  Publish clear notices on how personal data is used to train and operate foundation models.

• Strengthen rights mechanismsHigh priority

  Implement robust processes for data subjects to exercise access, correction, and erasure requests concerning AI outputs.

• Conduct safeguard assessmentsMedium priority

  Perform DPIA‑style reviews of AI agents to ensure adequate technical and organisational safeguards.

• Monitor ICO commitmentsMedium priority

  Track progress against the developers' pledged changes and be prepared to respond to future statutory code requirements.

Who reported it

Discussion