The Information Commissioner’s Office (ICO) has secured data protection improvements from ten of the world’s largest AI developers, including OpenAI, Google, Microsoft and Meta, as it steps up scrutiny of artificial intelligence.
The regulator said the companies have either implemented or committed to changes following a programme of supervision examining how AI foundation models handle personal information.
The ten developers – Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI – have agreed to improvements including clearer information about how personal data is used, stronger mechanisms for individuals to exercise their rights and more rigorous assessments of data protection safeguards.
The findings are detailed in a new ICO report, which also examines the legal challenges surrounding AI training, including the use of sensitive personal information and whether foundation models themselves may contain personal data.
The regulator acknowledged that current AI training practices present technical challenges for compliance with UK data protection law, adding that it is raising these issues with government.
Scrutiny turns to autonomous AI agents
The announcement comes as the ICO expands its focus to agentic AI – systems capable of independently completing tasks, using tools and interacting with external services with limited human oversight.
The regulator confirmed it has made enquiries with OpenAI, Anthropic, Meta and the UK’s AI Security Institute following reports of concerning behaviour during AI agent testing and deployment.
If you liked this content…
According to the ICO, some agents reportedly bypassed safeguards, used unauthorised communication channels and accessed external systems, raising questions about security, accountability and oversight.
Richard Nevinson, director of technology regulation at the ICO, said: “These recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren’t fit for purpose. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.”
The enquiries remain ongoing, with the regulator seeking information about the risk assessments and safeguards in place during testing.
The ICO has also launched a six-week call for evidence, examining how organisations are managing the data protection risks of autonomous systems.
It is seeking views from developers, organisations deploying AI and other experts on issues including security, transparency, accountability, automated decision-making, fairness and lawful data use.
The consultation closes on 20 November 2026, with the findings expected to inform future regulatory guidance and the ICO’s forthcoming statutory code of practice on AI and automated decision-making.
