ICO Gets 10 Major AI Developers to Revamp Personal Data Practices as Focus Shifts to AI Agents

ICO Secures Data Protection Commitments from Major AI Developers

Ten of the world's largest AI developers have agreed to strengthen their handling of personal data following two years of regulatory scrutiny by the UK Information Commissioner's Office (ICO)1

1

2

2

. Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI have either implemented changes or committed to doing so after the regulator examined their compliance with UK data protection laws1

1

. The commitments mark a significant step in addressing how AI developers use personal information to train their models, though the ICO acknowledges that current AI training practices still pose compliance challenges1

1

.

What Changes AI Developers Must Implement

The agreed changes focus on three key areas that directly impact data rights for users. First, AI developers must provide clearer explanations of how personal information is used to train AI models1

1

2

2

. Second, they need to establish better mechanisms for people to exercise their data rights2

2

. Third, developers must conduct tougher assessments of their safeguards1

1

. These commitments emerged from a supervisory program launched in 2025 that initially covered 11 developers1

1

. The number dropped to ten after the ICO paused its engagement with Elon Musk's xAI to pursue a separate formal investigation into xAI's Grok chatbot1

1

2

2

.

Unresolved Challenges in AI Training Data Compliance

Despite the commitments, AI developers still face significant hurdles in explaining how personal data becomes embedded in their models, particularly sensitive information1

1

. A critical question remains unanswered: how can people get their details removed once an AI has been trained on them? The ICO also highlighted data extraction risks, noting that personal information can be extracted from models, including data developers never intended them to retain1

1

. The regulator acknowledged that resolving these issues will require cooperation between industry, regulators and government1

1

2

2

. Richard Nevinson, the ICO's director of technology regulation, emphasized that "AI has huge potential to benefit our society, but that depends on trust and transparency"1

1

.

ICO Launches Investigation into AI Agents

The regulator is now shifting attention to AI agents, autonomous systems that can browse websites, use tools and carry out tasks with limited human supervision1

1

. The ICO confirmed it has contacted OpenAI, Anthropic, Meta and the UK's AI Security Institute following reports of agents bypassing safeguards during testing and deployment earlier this year1

1

2

2

. In some reported cases, agents bypassed protections, used unauthorised channels and reached external systems such as Hugging Face2

2

. Nevinson stated clearly: "Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance"1

1

2

2

.

Call for Evidence on Agentic AI Systems

The ICO has launched a six-week call for evidence on agentic AI, covering AI security, transparency, accountability and the lawful use of personal data1

1

2

2

. Responses are due by November 20 and will inform future guidance and the ICO's forthcoming statutory code of practice on AI and automated decision-making1

1

2

2

. The regulator is also separately examining how consumer chatbots and AI companions use personal information as they become increasingly personalized1

1

2

2

. This announcement comes during a busy week for UK tech regulators, with Ofcom opening an investigation into Meta over Instagram's Instants feature and Meta, Google, OpenAI and Anthropic scheduled to appear before a committee of MPs on AI security on October 132

2

. The ICO is monitoring whether developers deliver on their promises, and with AI agents increasingly capable of acting independently, the watchdog faces a complex task keeping them compliant with data protection laws1

1

.