The ICO's agentic AI call for evidence

Summary written 22 October 2026. Based on ICO publications, linked below.

On 8 October 2026 the Information Commissioner's Office (ICO) launched a six-week call for evidence on how data protection law applies to agentic AI, meaning AI systems that complete tasks, use tools and interact with websites with limited human oversight. The ICO wants views from developers, deployers and other experts on how organisations are managing the risks. [ICO news, 8 Oct 2026]

Timeline

• 8 October 2026The call for evidence opens. The ICO also publishes a report on changes secured from ten foundation model developers, and confirms enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing. Source
• 20 November 2026The call for evidence closes (end of day). Responses go through the ICO's Citizen Space survey, and late responses may not be considered. Source
• Spring 2027Final agentic AI guidance due for publication (currently at drafting stage). Source
• LaterThe evidence will also feed the ICO's forthcoming statutory code of practice on AI and automated decision-making. Source

What it asks about

The survey has sections on data security, transparency, accountability, automated decision-making (ADM), fairness and purpose limitation, and lawfulness of processing. [ICO call for evidence]

Why it matters if you use AI agents

• The ICO's message is that "the fact AI agents act with autonomy is not an excuse for poor compliance" (Richard Nevinson, ICO Director of Technology Regulation). Source
• Agents often run on automation platforms that pass personal data to third-party AI models. The questions in this directory cover where data is stored, what the DPA says about UK transfers, and whether your data trains models. Those are exactly the accountability and security points the ICO is probing.
• Our reading, not the ICO's: now is a sensible time to list the agent tools you use, check their DPAs and sub-processors, and update DPIAs, before guidance lands in 2027.

To respond, use the official page: ICO: Agentic AI call for evidence.

Note: under the Data (Use and Access) Act 2025 the ICO is now overseen by an Information Commission Board. Source

Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.