UK ICO Calls for Evidence on AI Data Protection Compliance
The ICO launches a call for evidence on data protection risks in agentic AI.
Why it matters: Legal counsel and compliance officers must monitor evolving AI regulations as data privacy challenges grow with AI technologies. The ICO's actions signal increasing scrutiny on AI developers' data protection practices, impacting future compliance requirements.
- Ten major AI developers, including Google, Meta, and OpenAI, have made data protection commitments.
- The ICO's call for evidence on agentic AI runs for six weeks, engaging developers and experts.
- The ICO's report covers lawful use of sensitive data and personal data in AI foundation models.
- Inquiries into agentic AI testing involve OpenAI, Anthropic, Meta, and the UK's AI Security Institute.
The UK's Information Commissioner's Office (ICO) recently secured commitments from ten leading AI foundation model developers on improving data protection compliance. Companies including Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI agreed to enhance transparency, strengthen user rights mechanisms, and conduct more rigorous data protection impact assessments.
The ICO has now initiated a six-week call for evidence focused on the data protection risks posed by agentic AI systems. This call invites input from AI developers, deployers, and privacy experts to identify regulatory gaps and compliance challenges.
The ICO's latest report elaborates on regulatory positions regarding the lawful processing of special category data and the presence of personal data within foundation models. It emphasizes the need for clear accountability and protections as AI systems become more autonomous.
Additionally, the ICO has launched inquiries into agentic AI testing and deployment activities, targeting firms such as OpenAI, Anthropic, and Meta, as well as the UK's AI Security Institute. These investigations aim to assess compliance risks and enforce data protection standards.
Richard Nevinson, Director of Technology Regulation at the ICO, stated, "AI has huge potential to benefit our society, but that depends on trust and transparency. Our engagement with some of the biggest developers has secured real commitments that will help people better understand and control how their data is used, even in a fast-moving and complex area."
Over the last two years, the ICO's supervision program has covered 11 priority AI developers, signaling a sustained regulatory focus on aligning AI innovation with data privacy laws.
By the numbers:
- 10 — major AI developers who committed to data protection improvements
- 6 weeks — duration of ICO's call for evidence on agentic AI
- 11 — priority AI developers supervised by the ICO over two years
What's next: The ICO will review responses from the six-week call for evidence to identify regulatory gaps and may propose new guidance or rules addressing agentic AI data protection risks.