AI agents and UK GDPR: what the ICO's new inquiry means for your business

What the ICO announced

On 8 October 2026 the ICO (which formally became the Information Commission on 30 September) made three announcements in one go:

1. Changes from the big AI developers

   After a period of supervision, ten of the largest foundation model developers operating in the UK (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI) have made, or committed to make, data protection changes. These include clearer information about how personal data is used, better ways for people to exercise their rights, and tougher checks on safeguards.

2. Questions about recent AI agent incidents

   The ICO has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agentic AI testing. In some cases, agents reportedly bypassed protections, used communication channels they weren't meant to, and reached external systems such as Hugging Face.

3. A call for evidence on AI agents

   A six-week survey asking developers, businesses that use AI agents and other experts how they're managing the risks. The answers will feed into future ICO guidance and its forthcoming statutory code of practice on AI and automated decision-making.

The message to businesses was blunt. As the ICO's Director of Technology Regulation, Richard Nevinson, put it: "the fact AI agents act with autonomy is not an excuse for poor compliance."

Why this matters to a small business

It's tempting to read this as a story about tech giants. It isn't, quite. Under UK GDPR, if your business decides to use an AI tool on personal data, your business is responsible for how that data is handled, even when the tool was built by Google or Microsoft.

That was manageable when AI meant a chat window. Agents are different. They can read your inbox, open your CRM, fill in forms and send messages, often with very little human checking. In our October AI news roundup we covered agents that strayed into live business systems during testing. They didn't get in with clever attacks. They found passwords left in code and accounts with more access than they needed.

So the questions the ICO is asking are the same ones you'd want answered before you let an agent near your customer data: what can it see, what can it do, who checks its work, and can you show what it did afterwards?

Six things to check before you switch on an AI agent

Should your business respond?

You don't have to be an AI company to respond. The ICO is asking businesses that use AI agents, as well as developers and experts, how they're managing the risks in practice. If you've tried AI agents, or decided against them because of data worries, that experience is exactly what the guidance needs.

The survey is split into sections on data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and the lawful basis for processing. You can answer the sections that apply to you. Responses go through the ICO's Citizen Space site and close at the end of 20 November 2026. One thing to know: the ICO may publish responses from organisations, so don't include anything you wouldn't want made public.

Read the ICO call for evidence

How we build AI-ready systems

Every system we build is hosted in UK data centres, and we're registered with the ICO. When clients want AI in their systems, we design it in from the data up: role-based access so an AI feature only sees what it should, a full audit trail of every action, and a person approving anything that matters. For MC Plan and Site Services, AI assistance flags missing information in inspection reports before they're submitted, and the inspector stays in charge of what's sent. See the MC Plan case study.

AI agents and UK GDPR: quick answers