Agent autonomy is not a defence

In brief: on 8 October 2026 the Information Commissioner's Office reported that ten of the largest foundation model developers have made or committed to data protection changes, opened a six-week call for evidence on agentic AI that closes on 20 November 2026, and confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute into recent agent testing in which agents reportedly bypassed protections and reached external systems. The regulator's stated position is that an AI agent is not a legal entity and that its autonomy does not move responsibility away from the organisation deploying it. The evidence gathered feeds the statutory code of practice on AI and automated decision-making that ministers required in April, so the answers firms give now help set the standard they will later be held to.

The regulator has stopped asking mainly how the model was trained and started asking who authorised the agent to act.

That is the change worth noticing in what the ICO published on 8 October 2026. Two things landed together. The first was the report from the foundation model supervision programme set up in 2025 under the AI and biometrics strategy, which ran over two years and covered eleven priority developers selected on likelihood of non-compliance, UK market share and use of higher-risk training datasets. Ten of them, Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI, have made or committed to changes. The eleventh, X.AI, was removed from the programme when the ICO opened a formal investigation into X Internet Unlimited Company and X.AI covering the Grok system.

The second was a six-week call for evidence on agentic AI, open until the end of 20 November 2026, aimed at developers and deployers alike. Richard Nevinson, the ICO's Director of Technology Regulation, put the point without hedging: "the fact AI agents act with autonomy is not an excuse for poor compliance."

What the supervision findings actually say

The report's expectations of a developer are four: identify a lawful basis, provide meaningful transparency, enable people to exercise their rights, and show that safeguards materially reduce risk. The bar rises where a model itself contains personal data or where special category data under Article 9 of the UK GDPR is involved.

The findings on how developers evidenced legitimate interests under Article 6(1)(f) are the part a deployer should read closely, because they describe a failure of evidence rather than of intent. Firms did not always identify specific interests for each type of personal data at each stage of model development. Some had no substantive evidence for their claims of necessity, with little explanation of whether an alternative approach to training data was available. They rarely supported their assessment of the impact on people's rights with detailed analysis, such as evidence that a safeguard worked.

That is the same gap an internal legitimate interests assessment or data protection impact assessment leaves when it is written to close a gate rather than to record a decision. The ICO also notes that extraction of training data is increasingly feasible, including email signatures, API keys and passwords taken from the public internet, which turns a transparency question into a security one.

Controllership does not travel with the agent

The ICO's own research on agentic AI is explicit. Agents will not be conscious or hold intent in the next two to five years, they are not legal entities, and, in its words, AI agency does not mean the removal of human, and therefore organisational, responsibility for data processing. Organisations may wish to blame the agent. The law does not let them.

What a deploying organisation still controls is narrower and more practical than the architecture debate suggests: the actions the agent is authorised to take, and the information it can access. Those two settings are the controls, and the ICO's view is that one or more controllers must be identifiable for them to be effective. Accountability becomes harder, not easier, in a multi-agent chain where the determination of scope and purpose shifts between parties and where agents communicate, collaborate and potentially collude.

The regulator is reported to be looking at agent identities, permissions and guardrails, audit logging and meaningful human oversight. Read as a control set rather than a consultation, the seven substantive sections of the call for evidence are a reasonable checklist of what a board should already be able to evidence.

Call for evidence section	The question behind it	Evidence a deployer should hold
Data security	What can the agent reach, and what did it reach	Agent identity, scoped credentials, tool allowlist, immutable action log
Transparency	Does the affected person know an agent acted	Notice at the point of interaction, not buried in a layered privacy policy
Accountability	Who is the controller for each step	Named controller per workflow, assessed before deployment, with the contract to match
Automated decision-making	Is this a decision with legal or significant effect	Classification of each decision, route to contest it, a human who can actually intervene
Fairness and purpose limitation	Is memory from one task being reused for another	Purpose recorded per task, retention of agent memory bounded and tested
Lawfulness of processing	What is the basis for each category of data the agent touches	An assessment naming specific interests per data type and per stage

The automated decision-making provisions are where this bites

Ministers made the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 on 16 April 2026, laid them on 21 April and brought them into force on 12 May. They require the Commissioner to prepare a code of practice on good practice in processing personal data when developing and using AI and when making automated decisions, including guidance on children's personal data. Automated decision-making is defined by reference to Article 22C(1) of the UK GDPR and section 50C(1) of the 2018 Act.

A statutory code is not guidance a firm can take or leave. It is the measure a regulator, and in practice an auditor, will use. The ICO has said the agentic AI evidence will support the code's development alongside dedicated guidance on the technology, so the gap between a voluntary call for evidence and an enforceable standard is one drafting cycle wide.

For a regulated firm, that intersects with accountability it already carries. An agent acting on a customer's file does not change who holds the senior management function responsible for the outcome, and it does not change the Consumer Duty obligation to evidence the outcome rather than assert it. Nor does it change the discipline that makes either possible: knowing which critical data elements the agent may touch, and holding lineage good enough to reconstruct what it did and why.

Date	What happens
12 May 2026	SI 2026/425 in force; the ICO is required to prepare the AI and automated decision-making code
8 October 2026	Foundation model supervision report published; agentic AI call for evidence opens
20 November 2026	Call for evidence closes at end of day; later responses may not be considered
Ongoing	Enquiries into agent testing at OpenAI, Anthropic and Meta, and the formal Grok investigation, continue

Five questions before the next board meeting

For every agent we have in production or pilot, who is the named controller for the processing it performs, and was that decided before deployment or after?
Which of our agents can take an action with a legal or significant effect on a person, and can we show the route by which that person contests it and reaches a human with authority to reverse it?
If an agent exceeded its permissions last month, would we know, and what in our logging would let us prove what it accessed?
Does our assessment of lawful basis name specific interests for each category of personal data at each stage, or does it assert necessity without evidence, which is the failure the ICO found in the developers it supervised?
Are we responding to the call for evidence by 20 November, and if not, whose interpretation of accountability are we content to inherit?

An organisation that cannot say who authorised an agent to act has not delegated a task; it has mislaid an accountability.

What the supervision findings actually say

Controllership does not travel with the agent

The automated decision-making provisions are where this bites

Five questions before the next board meeting

Sources