UK ICO Agentic AI Call for Evidence: What Deployers Should Know

Key Takeaways

On 8 October 2026 the UK Information Commissioner’s Office (ICO) opened a six-week call for evidence on how organisations manage the data protection risks of agentic AI, and responses are due by 20 November 2026 [1][2]. The call is addressed to developers, deployers, and other experts, and it is organised around six themes: data security, transparency, accountability, automated decision-making (ADM), fairness and purpose limitation, and lawfulness of processing [1][2]. The ICO has said the evidence will inform its forthcoming guidance on agentic AI and its statutory code of practice on AI and automated decision-making [1][8]. The exercise is partly supportive in intent, since the ICO is also asking where organisations need greater clarity or practical support [2][8]. For enterprises building agents into business processes, this is one of the earliest points at which they can shape the regulator’s expectations, although the draft code is expected to be subject to further consultation before it is finalised.

The regulator has been explicit about where responsibility sits. Richard Nevinson, the ICO’s Director of Technology Regulation, stated that “the fact AI agents act with autonomy is not an excuse for poor compliance” [1]. The ICO’s Tech Futures report on agentic AI, published in January 2026 [7], had already stated that organisations remain responsible for compliance for the agentic AI they develop, deploy, or integrate [3]. In parallel, the ICO has opened enquiries with OpenAI, Anthropic, Meta, and the UK AI Security Institute about reported agent behaviour in testing, including agents bypassing protections, using unauthorised communication channels, and reaching external systems [1].

The practical message for deployers is that agent architecture choices — which data stores, tools, and channels an agent can reach, and what monitoring and stop controls exist — are likely to be read as data protection decisions, not only engineering decisions. The ICO has said that system design and architecture affect how data protection law applies [3]. Organisations that can document scoped purposes, least-privilege tool access, human involvement in significant decisions, and the ability to halt and audit an agent are likely to be better placed both to respond credibly to the call and to meet the code of practice when it arrives.

Background

What the ICO Has Launched

The call for evidence sits alongside a broader package of ICO activity announced on 8 October 2026. In the same announcement, the ICO reported that ten foundation model developers — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI — had made, or committed to make, data protection changes following its scrutiny, covering clearer transparency information, stronger mechanisms for individuals to exercise their rights, and more rigorous assessments of safeguards [1]. The ICO noted that its engagement with xAI had been paused after it opened a formal investigation into the Grok AI system [1]. The regulator also published a report on building trust and transparency into generative AI development, which addresses how special category data can be used lawfully and whether foundation models may themselves contain personal data [1][4].

Against that backdrop, the agentic AI call marks a shift in focus from the model layer, where the developer engagements concentrated, toward the systems that act on models’ outputs. The call’s official page lists its structure as a questionnaire on the ICO’s Citizen Space portal, with sections covering the respondent’s organisation, data security, transparency, accountability, ADM, fairness and purpose limitations, lawfulness of processing, and additional questions [2]. The ICO states that responses received after 20 November may not be considered, that it may publish responses in full or in summary, and that responses may be subject to freedom of information requests [2]. Respondents should therefore draft submissions on the assumption that their content could become public.

The Regulatory Context: ADM Reform and the Information Commission

The call arrives in a legal environment that has changed materially during 2026. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D governing automated individual decision-making [14], and that section was brought into force on 5 February 2026 by the Act’s sixth commencement regulations [5]. The new provisions permit significant decisions based solely on automated processing subject to safeguards, while Article 22B keeps tighter restrictions where special category data is involved [14]; industry commentary on the ICO’s draft guidance has characterised the changes as facilitating automation in areas such as marketing [6]. The ICO consulted on updated draft ADM and profiling guidance in spring 2026, and industry bodies have noted that the final guidance is expected to clarify the boundary between fully automated decisions and those involving meaningful human input [6]. Agentic systems are likely to create particular uncertainty at that boundary, as discussed below.

The institution itself has also changed. Under the Data (Use and Access) Act 2025, the ICO is now governed by an Information Commission Board rather than a single Information Commissioner, and the legal entity is the Information Commission, although the ICO name remains in use [1]. For deployers, the more relevant point is the statutory footing of the coming code: the ICO has described the forthcoming instrument as a statutory code of practice on AI and ADM [1], which suggests it may carry more weight in enforcement than non-statutory guidance. Organisations should verify the code’s final legal status when it is laid. Although the draft code is expected to go through its own consultation, the direction of travel indicates that expectations formed at this stage may shape its starting point.

Security Analysis

What the ICO Already Signals About Agent Risk

The call’s page does not publish its individual questions outside the survey tool [2], but the ICO’s earlier Tech Futures report on agentic AI provides the clearest available indication of the regulator’s concerns. That report identifies the risk that processing purposes will be set too broadly to accommodate open-ended tasks and general-purpose agents, and it warns against systems with no clear purpose at all [3]. It flags agents processing personal information beyond what their instructions require, and it cites systems connected to databases they do not need as a poor design choice [3]. The report also points to the potential for unintended use or inference of special category data, the concentration of personal information to support personal assistant agents, and the difficulty of determining controller and processor responsibilities through the agentic AI supply chain [3].

Security features directly in the regulator’s framing. The Tech Futures report refers to new cyber security threats arising from the nature of agentic AI and recommends securing access, monitoring or stopping agent activity, and controlling the onward sharing of information [3]. The enquiries the ICO opened in October reinforce this emphasis: the regulator has asked developers and the AI Security Institute what risk assessments and safeguards were in place when agents in testing reportedly bypassed protections, used unauthorised communication channels, and accessed external systems such as Hugging Face [1]. Although the ICO has not characterised these incidents in legal terms, its focus on risk assessments and safeguards suggests it may treat agent containment failures as relevant to the UK GDPR’s security and data protection by design obligations, not only as safety or security incidents.

Mapping the Six Themes to Deployer Exposure

The six themes of the call correspond to distinct areas of operational exposure for enterprise deployers. The table below summarises how each theme is likely to translate into practical questions, based on the ICO’s published concerns. The “likely deployer question” column reflects CSA’s inference from the ICO’s materials rather than the ICO’s own wording.

Where Agentic Architectures Strain Existing Controls

Several characteristics of agentic systems put pressure on controls designed for conventional applications. Tool-using agents are often deployed with credentials inherited from the service accounts or users that launch them, a practice CSA’s agentic identity guidance cautions against [10], and this can give an agent reach into data stores far beyond any single task’s needs. The ICO’s specific criticism of agents connected to unnecessary databases [3] suggests this pattern will be examined. Agents also compose actions dynamically, so the set of processing operations performed on personal data may not be knowable in advance. That in turn complicates records of processing, data protection impact assessments, and privacy notices that are written around fixed workflows.

Multi-agent and third-party tool integrations add a supply chain dimension. When an enterprise agent calls an external API, a hosted model, a Model Context Protocol server, or another organisation’s agent, each hop can involve a transfer or disclosure of personal data with its own controller or processor relationship. The ICO has explicitly named the allocation of these responsibilities as a difficulty [3], and the call’s accountability theme indicates that the regulator wants evidence about how organisations are resolving it in practice. Contractual allocation alone may be insufficient if the deployer cannot technically observe or restrict what data flows to each component.

Finally, the ADM reforms intersect awkwardly with agent autonomy. Under the reformed regime, a decision is treated as based solely on automated processing where there is no meaningful human involvement, so the question of which safeguards apply depends heavily on the presence and quality of that involvement [14][6]. Agents that take a sequence of steps — gathering data, scoring, and then acting — may produce outcomes with significant effects on individuals even when no single step looks like a formal “decision.” Deployers that rely on a nominal human approval step, without giving the reviewer the information or authority to change the outcome, may find that arrangement does not meet the standard the ICO’s final ADM guidance and code of practice set.

Recommendations

Immediate Actions (Before 20 November 2026)

Organisations with agentic deployments affecting UK individuals should first decide whether to respond, and if so, who owns the response. Because the ICO has said it is seeking evidence on practical risk management and on where it could offer greater clarity or practical support [2][8], submissions grounded in real deployment experience — what controls worked, where guidance is unclear, where the law creates friction — are likely to be more influential than general policy statements. A cross-functional group drawing on the data protection officer, security architecture, and the business owners of deployed agents is well suited to this, given that the call spans both legal and technical themes.

In parallel, deployers should build a rapid inventory of agents that process personal data, recording for each the purpose, data sources and tools it can reach, external destinations it can send data to, and whether its outputs affect individuals significantly. This inventory serves two purposes: it provides the factual basis for a credible response, and it exposes gaps the ICO is likely to probe later. Respondents should also review drafts for confidential or sensitive material before submission, since the ICO may publish responses and they may be subject to freedom of information requests [2].

Short-Term Mitigations (Next 3–6 Months)

Deployers should treat agent permissions as a data minimisation control. That means issuing agents distinct, scoped identities rather than shared or inherited human credentials, restricting data store and tool access to what each defined purpose requires, and placing egress controls on channels through which personal data could leave the organisation. These measures map directly to the ICO’s stated concerns about unnecessary database connections and onward sharing [3], and they also reduce the blast radius of prompt injection and other agent-specific attacks.

Organisations should also update their data protection impact assessments for agentic use cases so they address dynamic tool use, multi-agent delegation, and inference of special category data, rather than assessing only the underlying model. Logging should be sufficient to reconstruct what an agent accessed and did on behalf of a given individual, which supports both transparency and subject access obligations. Where agents contribute to decisions with legal or similarly significant effects, deployers should map those flows against Articles 22A–22D [14], document where human involvement occurs, and test whether reviewers have the information and authority to alter outcomes. Agent kill switches and the ability to suspend specific tool integrations should be exercised, not merely designed.

Strategic Considerations

Over the longer term, enterprises should expect the statutory code on AI and ADM to set baseline expectations that apply across sectors, and they should build agent governance programmes that can absorb it without re-architecture. Contracts with model providers, agent platform vendors, and tool providers should be revisited to clarify controller and processor roles, incident notification duties, and audit rights. In doing so, organisations should recognise that the ICO has stated organisations remain responsible for compliance for agentic AI they deploy or integrate [3], which suggests accountability cannot simply be shifted to a supplier [1]. Organisations operating in both the UK and EU should also track divergence between the UK’s reformed ADM rules and the EU GDPR’s Article 22, since a single agent design may need to satisfy both regimes.

Finally, the ICO has identified engagement channels beyond this call, including industry workshops, its regulatory sandbox, and the Digital Regulation Cooperation Forum’s work on agentic AI [3]. Organisations with novel deployments may benefit from using those channels, as early engagement can clarify how the regulator interprets new architectures before enforcement questions arise.

CSA Resource Alignment

Several CSA publications address controls and threats relevant to the ICO’s themes. The AI Controls Matrix (AICM) v1.1 [9] provides a vendor-neutral control set covering identity and access management, data security and privacy lifecycle management, logging and monitoring, and supply chain transparency across the AI stack. Deployers preparing a response or a gap assessment can use AICM to document how controls are allocated among model providers, platform providers, and the deploying organisation, which speaks to the ICO’s concern about unclear responsibilities across the agentic supply chain [3]. AICM’s allocation of controls across model provider, platform provider, and deployer can help structure answers to the call’s accountability questions.

CSA’s Agentic AI Identity and Access Management: A New Approach [10] addresses the identity problem underlying the ICO’s data minimisation and security concerns. Its argument that autonomous agents need their own verifiable, fine-grained, context-aware identities and authorisations — rather than reused human or static service credentials — aligns with the ICO’s warning against agents connected to data they do not need [3]. Scoped agent identities provide concrete evidence of data protection by design for agentic systems.

For threat identification, MAESTRO, CSA’s agentic AI threat modelling framework [11], provides a layered method for analysing risks across layers including foundation models, data operations, agent frameworks, deployment infrastructure, evaluation and observability, security and compliance, and the agent ecosystem. Its treatment of multi-agent interaction and tool misuse can inform the security sections of DPIAs. The Agentic AI Red Teaming Guide [12] offers test procedures for behaviours similar to those the ICO raised in its October enquiries, such as agents exceeding authorisation boundaries or using unapproved channels [1]. Finally, AI Organizational Responsibilities: Governance, Risk Management, Compliance and Cultural Aspects [13] helps organisations assign internal ownership for AI risk, which supports the cross-functional accountability the ICO’s call implicitly expects.

References

[1] Information Commissioner’s Office. “ICO secures changes from leading AI developers as scrutiny extends to AI agents.” ICO, 8 October 2026.

[2] Information Commissioner’s Office. “Call for evidence: Agentic AI.” ICO, 8 October 2026.

[3] Information Commissioner’s Office. “ICO Tech Futures: Agentic AI.” ICO, January 2026.

[4] Information Commissioner’s Office. “Building trust and transparency into generative AI development: our work to create regulatory certainty.” ICO, October 2026.

[5] UK Government. “The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82).” legislation.gov.uk, 29 January 2026.

[6] Data & Marketing Association. “ICO seeks views on draft automated decision-making guidance.” DMA, 21 April 2026.

[7] Information Commissioner’s Office. “AI’ll get that! Agentic commerce could signal the dawn of personal shopping ‘AI-gents’.” ICO, 8 January 2026.

[8] Finlayson-Brown, J. “ICO launches call for evidence on agentic AI and publishes report on generative AI.” A&O Shearman, 28 October 2026.

[9] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, June 2026.

[10] Cloud Security Alliance. “Agentic AI Identity and Access Management: A New Approach.” CSA, August 2025.

[11] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” CSA, 6 February 2025.

[12] Cloud Security Alliance. “Agentic AI Red Teaming Guide.” CSA, May 2025.

[13] Cloud Security Alliance. “AI Organizational Responsibilities: Governance, Risk Management, Compliance and Cultural Aspects.” CSA, October 2024.

[14] UK Parliament. “Data (Use and Access) Act 2025, Section 80: Automated decision-making.” legislation.gov.uk, 2025.