October 9, 2026: The United Kingdom’s Information Commissioner’s Office says 10 major artificial-intelligence developers have made, or committed to make, changes to how they explain and protect the use of personal data. The announcement follows roughly two years of regulatory scrutiny and comes as the watchdog begins a six-week evidence-gathering process on agentic AI.
Featured image: Steve A Johnson via Unsplash.
Which AI companies are covered
The ICO named Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. According to the regulator, the changes fall into three broad areas: clearer information about how personal data is used, stronger mechanisms for people to exercise data rights and more rigorous assessments of safeguards.
The wording matters. The ICO said the companies have either made changes or committed to make them; it did not say that every improvement is already complete. It also did not announce a fine or a finding that all 10 companies had violated the law. The regulator said it will monitor delivery against the commitments.
Agentic AI is the next focus
The office simultaneously launched a call for evidence on “agentic” AI—systems designed to use tools or take multi-step actions with less direct supervision than a conventional chatbot. The consultation asks developers, researchers, deployers and the public for evidence about how personal information is handled when agents browse, call services or act across connected systems.
Submissions are due by November 20, 2026. The ICO says the evidence will help it understand how existing data-protection rules apply to agents and where additional regulatory guidance may be necessary.
Open inquiries are not enforcement findings
The watchdog also confirmed inquiries involving OpenAI, Anthropic, Meta and the U.K. AI Security Institute concerning recent AI-agent testing incidents. Those inquiries are ongoing. They should not be read as conclusions that any organization broke the law.
The distinction is important for users and businesses evaluating AI tools. Regulatory inquiries can lead to requests for information, changes in practice, formal enforcement or no action, depending on the facts ultimately established. For now, organizations deploying agents remain responsible for understanding what data the systems can access, how actions are logged and when a human can stop or reverse an automated step.
Why the changes matter
Foundation-model developers often process large and diverse datasets, which can make it difficult for people to understand whether their information was used or how to exercise rights such as access, objection or deletion. Clearer notices and workable rights channels can reduce that gap, but their value depends on how fully the companies implement them and how the ICO assesses compliance.
The announcement also connects privacy oversight to a wider debate about AI-agent security. A system that can browse, enter information or call an external tool can create risks that are different from merely generating text. Effective safeguards therefore need to address permissions, authentication, monitoring and recovery—not only model outputs.
Sources and further reading
- The ICO’s official announcement, published October 8, 2026.
- Independent coverage from TNW, published October 8, 2026.
- Background on the regulator’s earlier monitoring of agent-testing incidents from Reuters, published August 3, 2026.
Follow AskNovus’ Technology and Technology News pages for verified platform and regulatory developments.