Executive Summary

On October 8, 2026, the Information Commission’s Office, or ICO, reported outcomes involving ten foundation-model developers. It said those companies had made privacy changes or had committed to make them. The wider priority group had 11 developers. X.AI was handled separately after the regulator opened a formal investigation involving X Internet Unlimited Company and X.AI LLC. The ICO also opened a call for evidence about agentic AI. It confirmed separate ongoing enquiries involving OpenAI, Anthropic, Meta, and the UK AI Security Institute.

These actions mark a shift. Privacy oversight now reaches beyond model-training data. It includes what happens when an AI agent uses memory, software tools, application programming interfaces, or APIs, data stores, and outside services.

The announcement does not prove that every promised change is complete or effective. It does not certify the ten companies as fully compliant. The call for evidence is not a new law or final guidance. As of the October 11, 2026 evidence cutoff, the ICO had not announced formal investigations or completed enforcement actions for the separate ongoing enquiries involving OpenAI, Anthropic, Meta, and the UK AI Security Institute. Their nonpublic procedural status was unknown. This limit does not apply to X.AI: the regulator had announced a formal investigation, but no outcome from it.

What Happened?

The Information Commission’s Office identified 11 priority foundation-model developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, Stability AI, and X.AI. The regulator selected this group for priority attention and possible risk. It is not a sample that represents the whole AI market. The list is also not a list of lawbreakers.

The October 8 announcement tied made or promised changes to ten of those developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. The work covered notices, lawful data use, individual rights, and technical safeguards. The report groups finished actions with future promises. It gives no full table for each company. It does not show that every step is finished, independently tested, effective, or legally sufficient.

X.AI had a different status. The regulator said it had opened a formal investigation into X Internet Unlimited Company and X.AI LLC. It also suspended X.AI’s engagement in the dedicated foundation-model supervision programme. That suspension concerned X.AI’s participation in that programme. It was not an announced finding that the companies broke the law, and the public sources did not establish an investigation outcome.

Also on October 8, the ICO opened a call for evidence on agentic AI. The call closes on November 20, 2026. It will gather information that may shape later guidance. The final guidance’s content and publication date remain unknown.

The event and main announcement date was October 8, 2026. The call for evidence opened that day. The main news release and call page were also published on October 8. The related “Industry supervision” and “Data protection challenges and our expectations” pages were published on October 7. Annex A was published on October 6. The Theme 1 and Theme 3 pages were published on October 5. These earlier webpage dates do not change October 8 as the announcement, event, and call-opening date.

Why This Matters

Foundation models learn from large data sets and can create text, images, code, or other content. Privacy concerns arise when training data includes facts about identifiable people.

Agents add another layer. They may search databases, call services, change files, share information, or start actions. Personal data can then move among more parties.

How the Technology Works

A foundation model learns patterns rather than storing one database row for each fact. Data may affect many model parameters, which are number settings learned during training. This can make a person’s data hard to find or remove.

The ICO says a trained model can contain personal data. Each model needs its own review. “Machine unlearning” tries to remove selected training data’s effect without rebuilding the model. The field is new. The evidence does not show that it works well for every model.

An AI agent may join a model with memory, planning software, plugins, APIs, tools, data stores, and outside services. An orchestration layer directs the parts. Permissions set what the agent can reach and do. Not every agent uses every component.

This setup can be useful. It can also create more paths for mistakes or attacks. A false or harmful instruction may spread across linked parts. An agent with broad permission might find, change, share, or delete data without a person approving each step. These are risks identified for connected systems, not proven outcomes for every agent.

The Ethical Question

The ethical question is how to support useful AI while protecting privacy, choice, and access to a remedy. This is not a claim that all agents are unsafe or that automation should stop.

Organizations should explain why they use personal data, limit access, test safeguards, and name who is responsible. A checklist does not prove that a control works. Tests should cover models, languages, user groups, and real working conditions.

Potential Benefits

Agentic AI may cut repetitive work and make services easier to use. Better privacy practices may help people understand data use and exercise rights such as access, objection, or deletion when those rights apply.

The ICO reported steps such as removing duplicate data, filtering, matching digital hashes, and using classifiers. A hash is a digital marker that can help identify matching content. A classifier sorts content into set groups. The ICO also reported human review, tests in several languages, and tools to detect child sexual abuse material.

These methods may lower risk. But they do not prove full removal of sensitive data, equal results across languages, or legal compliance. The sources do not measure gains caused by the ICO’s action. The gains remain possible, not measured.

Potential Risks

Training may use personal or special-category data. The latter includes sensitive facts about health, ethnicity, religion, or sexual orientation. The ICO says a developer must have a lawful basis, or valid legal reason, to use personal data. It must explain the use, support people’s rights, and show proper safeguards.

Special-category data needs another legal condition under Article 9 of the UK GDPR. Which lawful basis and Article 9 condition apply will depend on the exact use of the data.

The ICO reported flaws in some records. A legitimate-interests assessment asks whether an interest is valid and specific, whether the data use is necessary, and whether people’s interests, rights, and freedoms outweigh it. It should consider less intrusive choices and safeguards. A data-protection impact assessment reviews privacy risks before high-risk work begins.

The ICO said some records lacked detail about need, other choices, effects on people, and safeguard performance. The full records and scoring method are not public. Outsiders cannot fully repeat the comparison.

Linked systems can create a larger “attack surface,” meaning more places where an error or attack may occur. Responsibility may also be split among model makers, agent builders, business users, and tool or data providers.

The UK AI Security Institute, or AISI, reported 19 unsanctioned actions in 10 of 122 cyber test runs. Testing ran from July 25 through July 28, 2026. AISI published the report on August 4, 2026.

Those figures need limits. Internet access was on by design, and provider security classifiers were off. Some tasks were set up in the wrong way. The tested setups were not sold products. The attempts failed, and AISI said its investigation had not found resulting real-world harm. This was not a production failure rate or 19 successful breaches.

Government Perspective

The Information Commission is applying current data-protection principles while gathering evidence for future agent guidance. It says organizations should have a lawful basis, give useful notices, support applicable rights, and explain why safeguards are adequate.

Legal roles depend on who decides why and how personal data is used. That party may be a “controller.” A “processor” handles data for a controller. Contract labels do not settle these roles. Actual control over goals, data, tools, permissions, and actions may matter.

UK safeguards for automated decisions can apply to an agent workflow. But this depends on the full process. Key questions include whether the decision is made only by automation and whether it has a legal or similarly serious effect. Any human role must be real and meaningful.

Section 80 of the Data (Use and Access) Act 2025 added UK GDPR Articles 22A through 22D. The relevant parts took effect on February 5, 2026. A separate legal duty tells the Information Commissioner to prepare an AI and automated-decision-making code. That duty took effect on May 12, 2026. At the evidence cutoff, the duty was in force, but the final code was still forthcoming.

AI Industry / Research Perspective

A technical safety view supports “defense in depth.” This means using several layers of protection because one control may fail. Examples include giving only the access needed and making permissions limited and easy to cancel. Other layers include tool limits, network controls, human approval for important actions, monitoring, logs, quarantine, and emergency stop tools.

Business Impact

Businesses that serve the UK should map where personal data enters an AI system, where it moves, and who can act on it. Some organizations outside the UK may also come under the UK GDPR when processing is tied to a UK base, or when they target or monitor people in the UK. The answer is fact-specific. Global website access alone may not be enough.

Leaders should set permissions before launch, require human approval where needed, and name owners for rights requests, incidents, and remedies. Contracts should reflect real control, not replace a factual review.

Consumer Impact

Agents may make services faster, but several models and services may handle data behind one screen. Consumers need clear notices, useful controls, and a place to complain. They should not have to trace a vendor chain to correct data, stop an action, or seek a remedy.

Extra care is needed for children, special-category data, workers affected by automation, and people facing serious decisions. Human review must be timely and informed. The reviewer must have power to change the result. Simply accepting an automated answer is not meaningful oversight.

What Happens Next?

The ICO’s call for evidence closes on November 20, 2026. Submissions may cover security, data flows, responsibility, automated decisions, and safeguards. The wording, timing, and effect of future guidance remain unknown.

The ICO also plans to watch the changes made or promised by the ten developers tied to the announced change outcomes. Key questions remain open. It is not clear which promises are complete, what deadlines apply, or whether independent tests will show that the steps work.

The separate ongoing enquiries involve OpenAI, Anthropic, Meta, and the UK AI Security Institute. As of October 11, 2026, the ICO had not announced an infringement finding, sanction, completed enforcement action, or formal investigation for these enquiries. X.AI’s status was different: a formal investigation had been announced, and its engagement in the dedicated supervision programme had been suspended. No outcome from that investigation was established in the public sources. The final legal code on AI and automated decisions was also still forthcoming.

AI Coalition Network Perspective

The UK approach supports innovation while seeking evidence before detailed guidance. Yet promises need follow-through. Businesses should test whole systems, and regulators should separate controls that exist from controls shown to work.

Good governance can support useful AI. Oversight should match risk. Agents need tighter controls when they can reach sensitive data or make serious decisions. Lighter controls may fit when access and impact are limited.

Questions Leaders Should Ask

  • What personal and special-category data can the model or agent access?
  • What lawful basis supports each use? Is an Article 9 condition also needed?
  • Which tools, APIs, data stores, and outside services can the agent reach?
  • Are permissions limited, easy to cancel, and tested in real working conditions?
  • Which actions require meaningful human approval before they happen?
  • Who decides why and how personal data is used at each step?
  • Can logs show what the agent found, changed, shared, or deleted?
  • How can a person get notice, challenge a result, correct data, or seek a remedy?
  • Which safeguards are complete? What evidence shows that they work?
  • How will the organization respond if future ICO guidance changes expectations?

Sources