The UK’s Information Commissioner’s Office (ICO) says 10 major AI developers have made, or committed to make, changes to their data-protection practices after regulatory scrutiny. The regulator has also opened a six-week call for evidence on data-protection risks from AI agents.
These are two related but distinct steps: the ICO is monitoring developers’ handling of personal information, while gathering evidence that may inform future guidance on agents. Neither step creates a new law, and the regulator has not said the named companies broke data-protection rules. (ICO announcement)
What the regulator says changed
The ICO named Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. It said changes made or promised cover clearer information about personal-data use, stronger ways for people to exercise their rights, and tougher assessments of safeguards.
The regulator says it is monitoring progress. Its announcement does not provide a detailed account of each company’s changes, and the commitments should not be mistaken for completed steps across the board. (ICO announcement)
For people in the UK, the issue is how their personal information may be used in AI training or processed by AI services. Clearer explanations and usable ways to exercise rights can help people understand and raise questions about that use. The announcement does not describe a new individual right or specify how a particular company’s services or data practices have changed. It reports regulatory pressure and developer responses, not a guarantee that all concerns have been resolved.
Why agents are part of the discussion
The ICO is separately seeking evidence on data-protection risks from AI agents. Its stated areas of interest include security, transparency, accountability, automated decisions, fairness and lawful data use. Responses are due November 20, 2026. The call is a consultation, not a statutory duty, and may help shape later ICO guidance. (ICO announcement)
The regulator also said it has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute regarding reported agent testing and deployment. Those enquiries remain ongoing. The ICO has not announced findings of wrongdoing, so they should not be read as evidence that a violation occurred. (ICO announcement)
Independent coverage by Computing also described the changes as improvements sought through continuing supervision, rather than a newly enacted regulation. (Computing)
The immediate development is increased regulatory attention to how AI developers explain personal-data use and handle people’s rights. The agent consultation may influence what the ICO says next, but any future guidance and the outcome of the ongoing enquiries remain unsettled.
