Introduction 

On 8 October 2026, the UK Information Commissioner’s Office (ICO) announced that ten major AI foundation-model developers had made, or committed to make, data-protection improvements following regulatory scrutiny. On the same day, the regulator launched a call for evidence on agentic AI, seeking views on how existing data-protection law should apply as AI systems become capable of independently accessing information, using external tools and taking actions with limited human intervention. 

The developments mark a shift in regulatory attention. Questions surrounding foundation models have largely focused on how personal data is obtained and used during training. Agentic AI adds another layer: what happens when an AI system can decide what information it needs, retrieve that information and act upon it? What we aim to address in today’s blog is whether existing data-protection principles remain sufficient when processing becomes increasingly autonomous. 

ICO Scrutiny Produces Changes from AI Developers 

The ICO’s foundation-model programme examined some of the largest developers operating in the UK. Following this engagement, Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI have made or committed to changes in their data-protection practices. 

According to the ICO, these include clearer information about how personal data is used, stronger mechanisms for individuals to exercise their rights and more robust assessments of safeguards. The regulator is continuing to monitor compliance with these commitments. The ICO has also developed regulatory positions on issues such as the lawful processing of special-category data and whether foundation models themselves may contain personal data. It nevertheless acknowledges that current foundation-model practices continue to create technical challenges for compliance with UK data-protection law and data protection by design. 

Why Agentic AI Raises Different Questions 

The ICO describes agentic AI as combining generative AI with tools and systems that enable it to undertake more open-ended tasks. An AI agent might search external sources, access databases, communicate with other services, make plans or complete transactions on behalf of a user. This increased autonomy changes the nature of the privacy risk. A conventional AI system may process information supplied to it. An agent may instead determine that additional information is required, access another system to obtain it and use that information when deciding what to do next. 

The ICO has already opened enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute concerning recent agent testing and deployment. According to the regulator, reported incidents included agents bypassing protections, using unauthorised communication channels and accessing external systems. The enquiries remain ongoing. The call for evidence, which runs until 20 November 2026, consequently covers security, transparency, accountability, automated decision-making, fairness and the lawfulness of processing. 

Accountability Cannot Be Delegated to the Agent 

The first challenge is identifying who remains responsible when the system itself determines how a task will be completed. The ICO's position is clear: autonomy does not remove organisational responsibility. AI agents are not independent legal actors. Developers and deployers remain responsible for determining whether personal information is processed lawfully and for establishing appropriate controls around the system. 

The practical difficulty is ensuring that accountability remains meaningful. Agentic systems may involve foundation-model providers, developers, deployers, tool providers and external data sources. Multi-agent systems can make these relationships even more complex. 

Organisations will need to define controller and processor responsibilities, determine what systems and information an agent can access, and maintain records capable of showing what the system actually did. The ICO notes that real-time monitoring, retrospective logs and even separate supervisory systems may become necessary as the number and complexity of agents increase. 

Data Minimisation Meets Open-Ended AI 

Agentic AI also tests one of the most established requirements under the UK GDPR: data minimisation. Article 5 requires personal data to be adequate, relevant and limited to what is necessary for the purpose for which it is processed. 

This becomes difficult when an agent is designed to perform broad or evolving tasks. A personal assistant may work better if it has access to emails, calendars, browsing information, documents and transaction histories. Yet giving an agent access to information simply because it may become useful later sits uneasily with data minimisation. 

The ICO specifically cautions against this approach. Organisations should identify a legitimate reason for each category of personal information an agent can access and carefully select the tools and databases available to it. Possible safeguards include granular permissions, masking personal information and requiring human authorisation before accessing particular data. 

A useful design principle may therefore resemble the cybersecurity concept of least privilege: agents should receive only the information and permissions required for the task they are currently authorised to perform. 

Transparency Becomes Harder When Agents Choose Their Own Route 

Existing data-protection law also requires organisations to explain how and why personal information is being processed. Agentic systems can make that explanation considerably more difficult. An organisation may know the objective assigned to an agent without knowing in advance every information source it will consult or every intermediate step it will take. Information may also move between multiple agents or services operated by different organisations. 

The ICO warns that future systems may independently seek additional personal information, repurpose existing information or process data in ways that developers did not originally anticipate. Agent-to-agent communications may further reduce the visibility of these information flows. 

A privacy notice stating merely that an organisation “uses AI” would therefore be insufficient. Transparency will increasingly depend on explaining the agent's permitted scope: what information it can access, which external systems it can interact with, the types of decisions it can make and when human intervention is available. 

Special-Category Data and Unexpected Inferences 

An apparently ordinary task may lead an agent to infer information concerning health, political beliefs, religion or other special-category data. For example, an agent tasked with providing highly personalised recommendations could combine several ordinary data points and derive a sensitive conclusion that was never directly supplied by the individual. 

The ICO expects organisations to assess whether an agent is capable of inferring and using special-category information. Where such processing occurs, an appropriate lawful basis and an Article 9 condition must be identified. Technical restrictions may also be necessary to prevent unnecessary sensitive inferences. This reinforces a difference: limiting the data provided directly to an agent does not necessarily limit the personal data that the agent can subsequently generate. 

Can Existing Data-Protection Principles Govern AI Agents? 

For now, the answer appears to be yes, but their application will need to become considerably more technical. Accountability, purpose limitation, data minimisation, transparency, security and individual rights are broad enough to apply regardless of whether processing is undertaken manually, through conventional software or by autonomous AI systems. The ICO itself stresses that organisations deploying agentic systems remain subject to existing data-protection obligations. 

The harder problem is translating these principles into system architecture. A requirement to minimise data may become a requirement to restrict tool permissions. Accountability may require detailed agent logs and monitoring. Transparency may require organisations to record and explain unexpected processing routes. Data protection by design may require approval checkpoints before sensitive information is accessed or consequential actions are taken. 

What Should AI Developers and Deployers Do Now? 

Organisations developing or deploying AI agents should already consider several practical safeguards: 

• Set clear boundaries for agent access: Define the databases, applications, tools and categories of personal data that an agent may use rather than granting broad system access. 

  
  

• Build human approval points into sensitive actions: Access to highly sensitive information, external communications or consequential transactions may require additional authorisation. 

  
  

• Maintain usable logs: Organisations should be able to reconstruct what information an agent accessed, what actions it took and which systems it interacted with. 

  
  

• Apply data minimisation dynamically: Permissions should reflect the particular task and should not give an agent access to personal information merely because it could prove useful later. 

  
  

• Assess sensitive inferences: Testing should examine not only the information supplied to an agent but also personal and special-category data that it may independently infer. 

  
  

• Review transparency and rights mechanisms: Individuals should be able to understand significant uses of their information and exercise rights even where several agents or external systems are involved. 

Conclusion 

The ICO's October 2026 actions illustrate how AI regulation is moving from questions about how models are trained towards questions about what AI systems do after deployment. The foundation-model review has already produced commitments on transparency, individual rights and safeguards. Agentic AI presents a more difficult challenge because the system may independently determine how information should be obtained and used in pursuit of a broader objective. 

The existing principles of accountability, transparency and data minimisation remain applicable. But autonomy makes compliance harder to demonstrate and easier to lose in practice. The challenge now is whether developers can build technical controls strong enough to ensure that an autonomous system continues to respect those principles when no human is directing every individual action. 

Want to Stay Ahead? 

Reach out to the experts at Tsaaro today.