UK ICO seeks evidence on autonomous agents’ privacy risks

The UK’s Information Commissioner’s Office opened a six-week call for evidence on agentic AI on October 8, 2026, with submissions due by November 20, 2026. The consultation seeks practical input on applying existing data protection law to systems that independently plan, make decisions and use tools.

The regulator is examining security, transparency, accountability, automated decision-making, fairness and discrimination, lawful basis for processing, and governance safeguards. Agents accessing calendars, email, databases and external services can create unanticipated data flows or process information about people who have not agreed to their involvement. Organizations remain responsible for compliance when they develop, deploy or integrate these systems, regardless of their autonomy.

The consultation accompanied findings from a roughly two-year supervision program covering ten foundation-model developers. Those companies implemented or committed to clearer disclosures about personal data use, stronger mechanisms for exercising data rights, and tougher assessments of privacy safeguards. The findings did not describe unlawful conduct, and the ICO will continue monitoring those commitments.

The evidence will inform practical guidance and the regulator’s statutory AI and automated decision-making code. Unlike the EU’s existing risk-tiered obligations, the UK initiative emphasizes gathering evidence to clarify how data protection requirements apply to agents’ distinctive capabilities and risks.