ICO Finds Training Data Transparency Gaps at Ten Foundation Model Developers
Source
Generative AI foundation models: two-year supervision programme findings
UK Information Commissioner's Office
What happened
The UK Information Commissioner's Office (ICO) published findings from its Generative AI foundation models: two-year supervision programme findings, covering ten major foundation model developers over two years. All ten either made or formally committed to make data protection improvements following regulatory engagement. Training data transparency and personal information handling were the most persistent compliance gaps. The ICO also identified weaknesses in lawful-basis assessments, data inventories, data subject rights procedures, and model risk documentation. The findings apply within the General Data Protection Regulation (GDPR) framework as implemented in UK law. They set expectations for any organization that supplies or deploys foundation models in the UK. This supervisory action follows the ICO's broader pattern of escalating AI scrutiny, including a formal investigation into Grok's data processing practices and binding-standard guidance for AI agents.
Why it matters
- ·Enterprises that deploy foundation models from any of the ten supervised developers cannot assume upstream data protection compliance has been resolved. Lawful basis, data subject rights, and training data provenance remain open gaps. Deployers may share regulatory exposure if vendors do not address these issues.
- ·The ICO's focus on training data transparency directly affects vendor due diligence programs. Any organization procuring foundation models for use with UK resident data must ask vendors to demonstrate how training data was collected and what legal basis was used. Vendors must also show whether data subject rights can be honored. Failing to do so risks breaching General Data Protection Regulation (GDPR) accountability obligations.
- ·The supervision programme covered model risk documentation and data inventories alongside transparency. This signals that the ICO views AI governance as an integrated compliance obligation, not a narrow data handling question. Organizations without documented AI risk assessments and vendor compliance verification processes face heightened audit exposure as the ICO moves toward its next phase of supervision.
Stay ahead of stories like this
Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your foundation model vendors whether they were among the ten developers in the ICO supervision programme, and if so, request written confirmation of which data protection commitments they made and their completion status.
- ☐Review your vendor contracts to confirm they require the vendor to disclose regulatory findings and completed remediation steps, and update contracts that do not.
- ☐Map your UK resident data flows through each foundation model you use and verify that your vendor has documented a lawful basis for training data collection that covers those data types.
- ☐Confirm that your vendors can support data subject rights requests, including access and erasure, for personal data that may have been included in training data, and document the process for handling such requests.
- ☐Update your AI risk register to record each foundation model vendor's data protection compliance status and flag any vendor that has not provided documentation of completed ICO commitments as a heightened risk.
What to watch next
The ICO has signaled it will continue active supervision of foundation model developers and has separately opened probes into agentic AI data protection practices. Compliance teams should monitor whether the ICO publishes enforcement notices or formal reprimands against any of the ten supervised developers, as these would create precedent for deployer obligations. The ICO's forthcoming code of practice on AI and automated decision-making is required under UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425). It is expected to codify many expectations the supervision programme raised informally. This gives compliance teams advance notice to prepare documentation and vendor verification programs.