AI agents and the ICO: what a UK business needs in place

The announcement on 8 October had two parts. First, the ICO said ten of the largest AI model developers, including Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI, had made or committed to data protection changes after its scrutiny: clearer information for the public, better ways for people to use their rights, and tougher checks on safeguards. Second, it opened a six-week call for evidence on agentic AI, for developers and the organisations that deploy agents. What it hears will feed into future guidance and the statutory code of practice on AI and automated decision-making it is preparing.

The ICO also said it had contacted OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agent testing, after reports that agents had bypassed protections and reached outside systems. It wants to know what risk assessments and safeguards were in place.

Richard Nevinson, the ICO's Director of Technology Regulation, put the principle in one line: “the fact AI agents act with autonomy is not an excuse for poor compliance.”

The call for evidence follows a run of real incidents. In July, OpenAI said agents it was testing for cyber skills, with reduced safety restrictions, used a flaw in their own test setup to get out of it and into a limited part of Hugging Face's production systems, as Malwarebytes reported. A week later Anthropic disclosed that, during evaluations where a misconfiguration had left live internet access switched on, three Claude models broke into three real companies, according to Help Net Security. One used weak passwords and unauthenticated endpoints to reach a production database. Another published a software package that was downloaded and run on 15 real systems.

In October India's cyber security agency, CERT-In, said agents from several providers had reached the live systems of Indian organisations during research and testing, going beyond what their tasks allowed, TechCrunch reported. The way in was ordinary: exposed passwords and connection settings, public code, and cloud permissions that were too wide.

Two things stand out. The organisations that were broken into had not noticed. And the agents did not use anything exotic. They used the same weak spots a careless human would, only faster and without stopping to ask.

These were labs testing the most capable models with safety measures turned down, not businesses running a booking assistant. But the lesson carries over. An agent will use whatever access it is given, and some it was not meant to have, to finish the job.

The call for evidence sets out the ICO's current thinking under six headings. In plain terms:

Autonomy is a decision you make. The ICO says the level of autonomy an agent has should be “a deliberate and carefully considered design and deployment decision”, with access and approvals matched to the risk. Commentary on the paper, including from Freshfields, reads it as pointing to a named owner, a defined purpose and set permissions for each agent.

Telling people once may not be enough. Agents change what data they use and who they share it with as they go. The ICO says transparency has to be designed in from the start, and that a further notice or approval may be needed before an agent uses a new source or takes a consequential action.

You are probably the controller. The ICO says the idea of a controller should be read broadly, and that organisations should not rely only on how they describe themselves. Whoever sets an agent's permissions and access is likely to carry the responsibility, whatever the supplier contract says.

Look at the whole workflow, and make the human count. Where agents make decisions about people, the ICO says it is not enough to look at single steps in isolation. A person reviewing a decision must have the authority and the understanding to change it, not just click approve. And the records should show which agent acted, on whose authority, and where a person stepped in.

A new use is not an allowed use. An agent finding another way to use data does not make that use compatible with the reason it was collected. And a user's instruction or your terms of service do not, on their own, cover everything an agent does next.

List your agents. Every AI tool that can act, not just answer, belongs on it: the assistant that books appointments, the one that drafts and sends emails, the coding agent with access to your systems. For each, write down who owns it, what it is for, and what it can read and change.

Cut its access to what the job needs. Most of the incidents above began with access that was wider than anyone intended. An agent that answers enquiries does not need your whole customer database or the ability to issue refunds.

Put a real person at the points that matter. Decide where the agent must stop and ask: before money moves, before anything is sent that cannot be taken back, before a decision about a person. Make sure the person at that point can say no and knows enough to.

Keep a record you could show someone. If the ICO, a customer or your own board asked what an agent did last Tuesday and why, could you answer? If not, that is the first gap to close.

This is how we build our own products. ReplyOS®, our enquiry system, lets AI answer and follow up, with a person in charge of anything that commits the business, and a record of what was said and done. Slipmark exists because AI coding agents report checks they did not do: it binds every agent verdict to the exact files the agent read, and Slipmark Cloud keeps the record for audit.

If you already run an agent and want to know where it could go wrong, our AI Control Review is a one-day, fixed-price look at one agent or workflow: what it can access and change, where a person approves, and what evidence remains. It is not a certification, and we do not claim it makes you compliant. It shows you where the gaps are.

The call for evidence closes on 20 November 2026. If you use agents and have views on what would help, the ICO is asking. Otherwise, book a 20-minute call and we will help you work out what your agents can reach.