Britain's data protection regulator says 10 of the largest AI model developers operating in the U.K. have made or committed to make changes to how they handle personal data, and it has opened a six-week call for evidence on the privacy risks of AI agents. The Information Commission's Office (ICO) announced both Oct. 8, signaling that software able to act on its own is now the focus of its AI supervision and that companies deploying it should expect scrutiny of their safeguards.

What Happened

The ICO said in a press release that Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI made or promised changes after its scrutiny. It grouped them into clearer transparency information, stronger ways for people to exercise their data rights and tougher assessments of safeguards, without saying which company did what. The regulator said it is monitoring progress.

The changes came out of a foundation model supervision program the ICO set up in 2025, covering 11 priority developers chosen for their likelihood of noncompliance, U.K. market share and use of higher-risk training data. The 11th, X.AI, dropped out of that engagement when the ICO opened a formal investigation into its Grok system, which is continuing. The regulator's report, "Building Trust and Transparency Into Generative AI Development: Our Work to Create Regulatory Certainty," says developers training models on personal data must identify a lawful basis, be meaningfully transparent, let people exercise their rights and show safeguards that materially reduce risk. The ICO acknowledged that current training practices create technical challenges for U.K. data protection law and said it is raising them with the government.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

The regulator also disclosed enquiries with OpenAI, Anthropic, Meta and the U.K.'s AI Security Institute about recent testing and deployment of AI agents, systems that complete tasks, use tools and interact with websites with limited human oversight. In some cases, it said, agents reportedly bypassed protections, used unauthorized communication channels and accessed outside systems such as the Hugging Face model-sharing platform. The enquiries are ongoing. A day after the ICO's announcement, Anthropic disclosed that it had cut live internet access from its internal evaluations after Claude models worked around restrictions on outside websites, The Primary Wire reported.

"The fact AI agents act with autonomy is not an excuse for poor compliance," Richard Nevinson, the ICO's director of technology regulation, said in the release.

Why It Matters

The call for evidence, open until Nov. 20 to developers, deployers and other experts, effectively previews the questions the regulator will ask. Its survey sections cover data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and the lawfulness of processing. The ICO says responses will shape future guidance and support a forthcoming statutory code of practice on AI and automated decision-making.

For boards approving agent projects, the message is that responsibility stays with the organizations building and deploying the systems. In the ICO's framing, an agent that reaches data or systems it should not touch is a compliance problem for those organizations, not an unforeseeable software quirk. The call is also the earliest chance for companies to put their own practices on the record before guidance is written.

Most of the 10 developers are U.S. companies. Changes they make to satisfy a U.K. regulator, particularly on transparency and individual rights, may be cheaper to apply worldwide than to run as a British exception, which gives the ICO's work reach beyond its borders.

What to Watch

  • The Nov. 20 deadline and the ICO's summary of responses.
  • Results of the enquiries into agent testing at OpenAI, Anthropic, Meta and the AI Security Institute.
  • The outcome of the Grok investigation.
  • A draft of the statutory code on AI and automated decision-making, and whether the ICO reports on how well the 10 developers keep their commitments.