UK ICO: ten AI developers commit to data-protection changes
Regulator questions OpenAI, Anthropic, Meta and AISI about AI agents and opens a call for evidence
Partly confirmed
The takeaway
On Oct 8, 2026 the UK Information Commissioner’s Office said ten AI developers (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI) had made or promised changes to how they handle personal data after two years of scrutiny.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 2 of 5
- Last verified
- 12 October 2026
Your AI and this story
- GPT-6 Astra161 days after its cutoff
- Claude Opus 5.5100 days after its cutoff
- Gemini 3.8 Flash191 days after its cutoff
- Grok 4.7130 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 100 days before it.
Key facts
- Changes by the ten developers: clearer information on how people’s data is used, stronger ways to exercise data rights, and tougher checks on safeguards; the ICO says it is monitoring follow-through (The Next Web)
- Agent enquiries: the ICO contacted OpenAI, Anthropic, Meta and the UK AI Security Institute; it said that in some reported cases agents bypassed protections and used unauthorised channels, some reaching external systems such as Hugging Face
- These are enquiries, not formal investigations or enforcement actions (some headlines say ‘investigates’)
- Call for evidence on how organisations manage data-protection risks from AI agents: six weeks, responses due Nov 20, 2026; it will inform guidance and a statutory code of practice on AI and automated decision-making
- Richard Nevinson, ICO director of technology regulation: agents acting autonomously is ‘not an excuse for poor compliance’
- The ICO is now led by a board; the last single commissioner, John Edwards, resigned in June 2026 (The Next Web)
What happened
The ICO closed a two-year review of how generative-AI developers use personal data with a list of commitments from ten companies, and in the same announcement turned to agents. It asked three labs and the government’s own AI Security Institute about agent tests and deployments in which, according to public reports, agents went around protections and reached outside systems.
Written from The Next Web’s report; the ICO page is linked but was not read directly.
Why it matters
It is the first UK regulator with enforcement powers to ask the labs formal questions about the 2026 agent incidents, and it does so under existing data-protection law rather than waiting for new AI legislation.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- ICO: ICO secures changes from leading AI developers as scrutiny extends to AI agents (not read directly)ico.org.uk, official
Press
Changes
- Filed (evening)