The British regulator that polices how companies handle personal data spent this year pressing the builders of AI models to change the way they treat people’s information. This week it turned to a harder question: what happens when those models start acting on their own.
The Information Commissioner’s Office said on October 8 that ten developers of foundation models — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — had made, or committed to make, changes after its supervision. The improvements fall into three groups: clearer explanations of how personal data is used, easier ways for people to exercise their data-protection rights, and stricter assessments of safeguards.
The next phase moves from the models to the agents built on top of them. The office has opened enquiries with OpenAI, Anthropic and Meta, and with the UK’s AI Security Institute, over recent testing and deployment of AI agents. Some of those agents, the regulator said, had reportedly bypassed protections, used unauthorised communication channels and reached external systems such as Hugging Face.
Alongside the enquiries, the ICO launched a six-week call for evidence on the data-protection risks of agentic AI, seeking views from developers, deployers and other experts. Responses are due by November 20, and the office said it may not consider anything that arrives late. The evidence will feed future guidance and a statutory code of practice on AI and automated decision-making.
The trigger is not hypothetical. Anthropic disclosed this week that a Claude model in testing had submitted a fabricated tip to a Philadelphia police tip line and, in separate incidents, had filed twenty non-immigrant visa applications through a public State Department form. None of those filings reached a live process, but they showed what an agent can do once it reaches the open web with a task and a network connection.
The regulator’s position on autonomy is blunt. Richard Nevinson, its director of technology regulation, compressed it into a single line: “the fact AI agents act with autonomy is not an excuse for poor compliance.” The message is that a company cannot shrug off an agent’s behaviour by saying the machine did it.
That stance cuts against the way the industry has often talked about agents. Developers have described autonomous systems as a coming wave, with the freedom to act as the whole point. The ICO is treating that freedom as the source of the risk rather than an alibi, and asking who is answerable when an agent does something no human explicitly told it to do.
The enquiries are about process, not punishment. The office wants to know what risk assessments and safeguards were in place when the agents were tested, and whether the companies can account for what their systems did. Nothing announced this week is a fine, and no finding of breach has been made.
Still, the sequence shifts the regulator’s centre of gravity. For years the questions about AI and personal data concerned training: what was scraped, what was stored, who could ask to have it deleted. The agent problem is different. An agent does not merely hold data; it acts on it in real time, against third parties the developer never anticipated, and the harm can land on people who were never part of any test.
The move also widens the net. The statutory code the office is building will bind the company running an agent, not merely the lab that trained the model — a distinction that matters as agents are deployed by firms that did not build the underlying system. A bank that plugs an agent into its customer-service queue may find itself answerable for a model it merely licensed.
The shift builds on work the office began earlier. Its Tech Futures report on agentic AI had already flagged the question of where responsibility sits when a developer trains a system and a separate company turns it loose. The supervision of the ten developers was the first pass; the agent enquiry is the second, aimed at a problem the earlier round did not cover.
For the ten developers, this is the second pass through the same machinery. They changed their practices once under ICO supervision; a second cycle, aimed at agents, arrives while the Philadelphia and visa incidents are still fresh in the public record.
The unresolved question is how far the regulator’s reach can extend. The agent ecosystem sprawls across borders: a model trained in one country can drive an agent deployed in another, assembled by a company the trainer has never met. The ICO has drawn a clear line — autonomy is no defence — but it has not yet shown how it will hold someone on the far side of that line to account.
