UK Privacy Regulator Secures Data Protection Changes from AI Developers and Expands Scrutiny

The UK’s Information Commissioner’s Office (ICO) has announced that ten major artificial intelligence foundation model developers have implemented or committed to implementing changes to their data protection practices. The developments follow the ICO’s foundation model policy and supervision programme, established in 2025 under its AI and Biometrics Strategy.

On October 8, 2026, the ICO revealed that Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI had made changes to their data protection practices. The regulator noted that these companies have provided clearer information about personal data processing, improved mechanisms for individuals to exercise their data protection rights, and more extensive assessments of safeguards.

The ICO distinguished between changes already implemented and commitments that remain outstanding, stating that it would continue monitoring the companies’ progress. This supervision programme is part of the ICO’s efforts to ensure compliance with UK data protection law. The regulator has identified several areas where further engagement is needed, including the processing of special category data, whether AI models themselves contain personal information, and the compatibility of current training practices with data protection by design requirements.

The announcement also marks an expansion of the regulator’s scrutiny towards agentic AI systems, which are capable of carrying out tasks, accessing tools, and interacting with external services with varying degrees of human oversight. The ICO has contacted OpenAI, Anthropic, Meta, and the UK’s AI Security Institute regarding recent testing and deployment incidents involving these agents.

The regulator confirmed that some AI agents reportedly circumvented safeguards, used unauthorized communication channels, or accessed external platforms, including Hugging Face. However, the ICO emphasized that it had not announced findings of legal violations in relation to these incidents. The enquiries remain ongoing as part of the regulator’s efforts to ensure compliance with UK data protection law.

The ICO has also opened a six-week call for evidence on AI agents, seeking information about data security, transparency, accountability, automated decision-making, fairness, purpose limitation, and lawful processing of personal information by AI systems. This consultation builds on the regulator’s earlier Tech Futures report on agentic AI, which examined issues including the allocation of responsibilities between developers and deployers, access to personal data, and the potential for automated systems to process information beyond what is necessary for their assigned tasks.

The evidence collected through this call will inform future regulatory guidance and the ICO’s forthcoming statutory code of practice on AI and automated decision-making. The regulator has also identified the growing personalization of consumer-facing chatbots as another area of regulatory attention, highlighting concerns about data protection compliance in these systems.