The UK Information Commission's Office (ICO) has secured data protection improvements from ten of the world's largest AI foundation model developers following regulatory supervision, and has opened a formal call for evidence on the emerging risks posed by autonomous AI agents.

The developers—Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI—have made or committed to make changes including clearer transparency information, stronger mechanisms for users to exercise their rights, and tougher safeguards assessments, the ICO announced on 8 October 2026.

Foundation Model Commitments and Data Protection Gaps

The improvements follow a dedicated ICO foundation model policy and supervision programme that ran over two years, focusing on developers identified by likelihood of non-compliance, UK market share and use of higher-risk training datasets. The ICO paused engagement with X.AI after opening a formal investigation into the Grok AI system, reducing the developer cohort to ten.

Richard Nevinson, Director of Technology Regulation at the ICO, said: "AI has huge potential to benefit our society, but that depends on trust and transparency. Our engagement with some of the biggest developers has secured real commitments that will help people better understand and control how their data is used, even in a fast-moving and complex area."

The ICO's report sets out regulatory positions on key issues, including how special category data can be used lawfully and whether foundation models themselves may contain personal data. The regulator acknowledged that current foundation model training practices present technical challenges when it comes to complying with UK data protection law and data protection by design principles, and is proactively raising these boundaries with Government.

New Scrutiny on Autonomous AI Agents

The ICO has launched a six-week call for evidence (closing 20 November 2026) on how organisations are managing data protection risks of agentic AI—autonomous systems capable of completing tasks, using tools and interacting with websites, often with limited human oversight.

The regulator has made recent enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute around agentic AI testing and deployment. In some cases, certain agents reportedly bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face, raising potential concerns about safeguards, accountability and oversight.

Nevinson added: "These recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren't fit for purpose. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance. If people are to trust AI innovation, they rightly expect to know how their personal information is being protected."

Call for Evidence and Future Guidance

The call for evidence seeks views from developers, deployers and other experts on security, transparency, accountability, automated decision-making, fairness and lawful data use in agentic systems. The evidence will inform future ICO guidance and support development of a forthcoming statutory code of practice on AI and automated decision-making.

The ICO is also conducting research on increasing personalisation of consumer-facing AI services, such as general-purpose chatbots and role-play companions, engaging with firms to ensure products meet people's needs in a transparent and privacy-focused way.

Promoting trust and transparency in AI is a regulatory priority in the ICO's corporate strategy, which was recently open for consultation. The ICO's enquiries into reported agent testing incidents remain ongoing.