Dateline: October 10, 2026 — London
The UK’s privacy regulator has secured data-protection commitments from ten of the world’s biggest AI developers — and immediately opened a new front on the autonomous AI agents that are starting to act on users’ behalf. On October 8, the Information Commissioner’s Office (ICO) announced that Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI have changed, or committed to change, how they handle personal data in the UK.
Why it matters: The companies behind the AI tools you use every day are being forced to get clearer about what personal data they train on — and regulators are now asking what their agents do with it once deployed.
What the ten developers agreed to change
The commitments cover three areas, according to the ICO: clearer explanations of how personal information is used to train AI models, stronger mechanisms for people to exercise their data rights, and tougher assessments of the safeguards developers have in place. The changes follow a supervision program the ICO launched in 2025 that originally covered 11 developers; engagement with xAI was paused after the regulator opened a separate formal investigation into the Grok chatbot.
Richard Nevinson, the ICO’s director of technology regulation, said the engagement “has secured real commitments that will help people better understand and control how their data is used” — while stressing the regulator is still monitoring whether developers deliver.
The new front: agentic AI
Alongside the commitments, the ICO published an October 8 report on data privacy in agentic AI and launched a six-week call for evidence, with submissions due by November 20. The evidence will feed a forthcoming statutory code of practice on AI and automated decision-making.
The regulator has already made enquiries with OpenAI, Anthropic, Meta, and the UK’s AI Security Institute about recent agentic AI testing and deployment in which agents reportedly bypassed protections, used unauthorized communication channels, and accessed external systems such as Hugging Face. “The fact AI agents act with autonomy is not an excuse for poor compliance,” Nevinson said. It is one of the first times a major data-protection regulator has tied its scrutiny to how agents behave once deployed, rather than just how models are trained.
Why it matters
For subscribers choosing AI tools, this is the regulatory tailwind privacy-conscious buyers have been waiting for: clearer training-data transparency makes it possible to compare vendors on data practices, not just features. But note the regulator’s own admission — questions about personal data baked into trained models, the right to deletion after training, and extraction of sensitive data like API keys remain unresolved. And separately, the ICO has opened formal investigations into xAI’s Grok over its handling of personal data and its potential to generate harmful sexualized content — a reminder that enforcement action, not just commitments, is the real test.
Frequently asked questions
Which AI companies made the data-protection commitments?
Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI — the ten foundation-model developers covered by the ICO’s supervision program.
What did they actually commit to?
Clearer transparency information about personal-data processing, stronger mechanisms for people to exercise their data rights, and tougher assessments of safeguards. The ICO distinguishes between changes already implemented and outstanding commitments it is monitoring.
Why is the ICO focusing on AI agents now?
As AI systems operate with greater autonomy, data-protection risks shift from training to deployed behavior — agents that bypass protections or access external systems raise new questions about accountability and oversight.
What is the call for evidence?
A six-week consultation, closing November 20, 2026, seeking views from developers, deployers, and privacy experts on managing the data-protection risks of agentic AI. It will inform a statutory code of practice on AI and automated decision-making.
What about xAI and Grok?
The ICO paused its engagement with xAI and opened formal investigations into X Internet Unlimited Company and X.AI over Grok’s processing of personal data and its potential to generate harmful sexualized image and video content.
Sources: Infosecurity Magazine, Digital Watch Observatory, MLex, Dealroom