{"article":{"slug":"ico-agentic-ai-evidence-call","kind":"rule","source":{"title":"ICO secures changes from leading AI developers as scrutiny extends to AI agents","url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-AI-developers-as-scrutiny-extends-to-AI-agents/","date":"2026-10-08"},"headline":"The UK seeks agent evidence before writing further privacy guidance","whatChanged":"The UK's ICO opened an agentic-AI call for evidence on October 8, closing November 20. It seeks input on security, transparency, accountability, automated decisions, fairness, purpose limitations, and lawful processing. Responses will inform future guidance and a forthcoming statutory code of practice. The consultation is not a new binding rule or a completed code.\n\nThe same announcement says ten foundation-model developers have made, or committed to make, data-protection changes after supervision. These include clearer disclosures, stronger rights mechanisms, and tougher safeguard assessments. Commitments are not proof that every change has been implemented.\n\nThe ICO also confirmed ongoing enquiries with OpenAI, Anthropic, Meta, and the UK's AI Security Institute concerning agent testing and deployment. It described reported bypasses and unauthorised communication channels as potential concerns. The release does not establish findings of wrongdoing or an order to stop using those providers.","whyItMatters":"A company deploying agents can contribute a specific problem instead of a general view about AI. Document whether it can tell a user where an agent sent personal data and stop the next tool call. Identify who is responsible when a connected service changes the purpose of processing. Those checks match the call's practical focus.\n\nUse one non-sensitive workflow to check recipients, logs, and permission limits now. The ICO says policy alone cannot address these challenges, which is a reason to test technical controls rather than add another statement to a handbook. Responses may be published, so strip personal and confidential information. The November deadline is for consultation input, not a newly announced compliance deadline for every AI user.","issuer":"UK ICO","glance":"The ICO opened an agentic-AI evidence call October 8, closing November 20, to inform future guidance and a statutory code.","status":"proposed","action":"Test whether one agent workflow can list its data recipients and stop an unapproved onward transmission.","attachments":[{"title":"ICO agentic-AI evidence themes","url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/the-ico-s-call-for-evidence-on-agentic-ai/","description":"Explains the evidence sought on security, transparency, accountability, automated decisions, fairness, and lawful processing. It informs future guidance rather than announcing a final code.","source":{"title":"Agentic AI call for evidence","url":"https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence","date":"2026-10-08"}},{"title":"Consultation dates and response privacy statement","url":"https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence","description":"Confirms the November 20 closing date and warns that organisational responses may be published. Useful before submitting a workflow example.","source":{"title":"Agentic AI call for evidence","url":"https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence","date":"2026-10-08"}}],"companyLabel":"Public edition"},"issue":{"id":"2026-10-12","publishedLabel":"Week of October 12, 2026","isLatest":true},"position":{"index":4,"total":5},"next":{"slug":"finra-ai-impersonation-verification","headline":"FINRA warns that realistic impersonation leaves old trust shortcuts unreliable"},"session":null}