ICO Secures Developer Changes and Opens Agentic AI Data Protection Probe

What happened

Why it matters

• ·Regulatory pressure is now producing documented product changes at AI developers. Enterprise procurement teams cannot treat vendor data protection commitments as stable. Commitments secured today may be revised under further ICO pressure, requiring updated due diligence under GDPR.
• ·The six governance areas named in the call for evidence, covering privacy impact assessments, lawful basis, transparency, automated decision-making controls, security testing, and monitoring, map directly to controls that most enterprise compliance programs have not yet adapted for agents that act autonomously across multiple steps.
• ·UK-based organizations and any business deploying agentic AI that processes data about UK residents face a closing window. The six-week call for evidence will shape ICO guidance likely to define the compliance baseline. Early engagement and internal gap analysis are a time-sensitive priority.

Governance controls affected

What to do now

• ☐Map every agentic AI system in your inventory that processes personal data about UK residents, and confirm whether a privacy impact assessment has been completed for each one.
• ☐Review the lawful basis your organization relies on for each agentic AI workflow: confirm it is documented, defensible, and covers the full chain of actions the agent can take, not just the initial instruction.
• ☐Assess whether users are told, in plain language, when an AI agent is acting on their data, what decisions it makes automatically, and how they can object or request human review.
• ☐Ask your engineering and security teams whether agentic AI systems are tested for security risks before deployment and monitored for unexpected behavior after deployment, and request written evidence of both.
• ☐Submit a response to the ICO call for evidence before the six-week window closes, or assign a team member to track published submissions and draft guidance so your compliance program adjusts promptly.

What to watch next

Compliance teams should monitor the ICO's published call for evidence submissions and any subsequent draft guidance. This guidance is expected to define a concrete compliance baseline for agentic AI under GDPR. The ICO's willingness to secure product changes without formal sanctions suggests it may move quickly from guidance to enforcement action once the evidence period closes. Teams operating in the EU should also watch for parallel signals from EU data protection authorities. This is especially relevant given the first agentic AI data breach to reach a European DPA earlier this year. Any further ICO enforcement actions against named AI developers during the evidence period could accelerate the compliance timeline significantly.