On 8 October 2026 the Information Commissioner's Office published the results of a supervision exercise covering ten foundation model developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. All ten have made, or committed to make, changes to how they handle personal data.
Alongside it the ICO opened a call for evidence on the data protection risks of agentic AI, and confirmed it is making enquiries into recent agentic deployments. That second part is the one worth reading closely.
Why agents are a different problem
A model that answers a question processes what you hand it. An agent decides what to fetch next. It can read a mailbox, call an internal API, open a document it was never explicitly pointed at, and chain those steps without a human in between.
Data protection law cares about purpose, minimisation and transparency. An agent that decides its own next step is, by construction, harder to describe in those terms. You cannot write a clean purpose limitation statement for a system whose data access depends on what it inferred two steps ago.
The practical questions you should be able to answer
What can this agent reach? Not in principle, in production, today.
Does it operate with a human's permissions or a service account that sees far more than any single person?
Is there a log of what it read, not just what it did?
If someone asks you to delete their data, can you tell whether the agent copied it somewhere?
Most teams can answer the first and the last with confidence and struggle with the middle two. The second one is the usual culprit: agents are frequently given broad service credentials because it is the quickest way to get them working.
What good looks like
Scope the credentials, not just the prompt
Prompt instructions are not an access control. If the agent must not touch payroll, it should not hold a credential that can reach payroll. Guardrails written in English are advisory; permissions are enforced.
Log retrieval, not only actions
When a regulator asks what personal data a system processed, the answer comes from the retrieval log. Most agent implementations log the final action and discard the intermediate reads.
Keep a human decision point where the stakes justify it
Not everywhere, which is paralysing, but wherever an error would be expensive to reverse.
Where this is heading
The ICO's call for evidence is an invitation to shape the guidance rather than a finished rule. Organisations that can describe their agent architecture clearly will find the resulting guidance easy to meet. Those that cannot currently enumerate what their agents can read will be doing that work under deadline instead.
We design agentic systems with scoped credentials and auditable retrieval as a starting assumption. See our AI and machine learning and infrastructure work, or get in touch.