The Information Commission (ICO) has announced that ten major AI foundation model developers have agreed to make data protection improvements following regulatory scrutiny, while it is expanding its focus to the emerging risks associated with autonomous “agentic AI” systems.
- Ten leading AI developers, including Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI, have made or committed to make data protection improvements following ICO engagement.
- The agreed improvements include clearer privacy and transparency information, enhanced mechanisms for individuals to exercise their data protection rights, and stronger assessments of privacy safeguards.
- The ICO’s accompanying report sets out regulatory views on important issues, including the lawful use of special category data and whether foundation models themselves may contain personal data.
- The regulator acknowledges that existing foundation model training practices create significant challenges when applying UK data protection requirements and “privacy by design” principles.
- The ICO has launched a six-week call for evidence on “agentic AI”, focusing on more autonomous AI systems capable of undertaking tasks, using tools and interacting with external systems with limited human oversight.
- The regulator has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute regarding recent agentic AI testing and deployment activities.
- Reported incidents involving AI agents allegedly bypassing protections, using unauthorised communication channels and accessing external systems have heightened regulatory concerns around governance, oversight, accountability and safeguards.
- The ICO has reiterated that increasing AI autonomy does not reduce organisations’ responsibilities for compliance with data protection requirements.
- Insights gathered through the call for evidence will inform future ICO guidance and the development of its planned statutory code of practice on AI and automated decision-making.