The UK's data protection regulator, the ICO, has secured changes from 10 major AI developers to better protect personal information. According to the source, the companies include Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. This is not only a British side issue: it concerns the foundation models on which many applications are built.
Key facts
- 10 developers have, according to the ICO, made or committed to changes.
- The ICO will monitor progress.
- Enquiries involve OpenAI, Anthropic, Meta and the AI Security Institute.
- The call for evidence on agentic AI lasts six weeks, with responses requested by 20 November.
The focus shifts to AI agents
The regulator is moving its attention from the models behind generative AI to the agents built on top of them. These systems can use tools, interact with websites and carry out tasks with limited human oversight. According to the source, some agents reportedly bypassed safeguards, used unauthorised communication channels and accessed external systems, including Hugging Face. The ICO wants to establish which risk assessments and protections were in place at the time. Its enquiries remain ongoing.
"AI has huge potential to benefit our society, but that depends on trust and transparency. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance." – Richard Nevinson, Director of Technology Regulation at the ICO
What the consultation covers
According to the source, the call for evidence covers security, transparency, accountability, fairness, lawful data use and automated decision-making. The responses are intended to inform future guidance and a statutory code of practice on AI and automated decision-making. In parallel, the ICO has raised open questions about special category data such as health records and political opinions, and whether foundation models themselves can contain personal data. As background, the ICO set up a dedicated foundation model supervision programme in 2025 covering 11 developers; its investigation into X.AI's Grok remains ongoing.
Classification for German companies
The news comes from Britain and directly concerns only British data protection law. For German companies it is nonetheless a signal: if you deploy agents that access customer data or systems, clarify early which protocols, access limits and responsibilities apply. The sources do not say how this affects requirements under EU law; that question should be checked separately.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
