Call for Evidence on Data Regulation in the Age of AI and Other Data-Intensive Technologies

Applies To

Overview

Launched in July 2026, this call for evidence is a formal government consultation instrument through which DSIT is gathering structured input from industry, civil society, and academia on the adequacy of the UK data regulation landscape for AI. The consultation explicitly identifies agentic AI as a novel governance challenge, signaling that autonomous systems capable of initiating data transactions without direct human instruction are under active policy scrutiny. Key areas under examination include data provenance, access controls for AI agents, transparency obligations, and the adequacy of existing consent and purpose-limitation frameworks. Responses will inform potential amendments to UK data law and may shape guidance issued under the Data Protection and Digital Information framework. No binding obligations arise from the call for evidence itself, but its findings are expected to feed directly into future legislative or regulatory proposals. Enterprises that submit evidence or monitor outcomes will be better positioned to anticipate forthcoming compliance requirements.

Key Requirements

• •No legally binding obligations attach at this stage; however, organizations are invited to submit written evidence by the published closing date.
• •Respondents must address specific thematic questions covering agentic AI, data provenance, and access control frameworks.
• •Submissions are expected to include concrete examples of current regulatory gaps or friction points encountered in AI deployment.
• •Organizations operating high-volume or sensitive data pipelines involving AI are expected to assess how existing UK GDPR and Data Protection Act 2018 provisions apply to their AI systems.
• •No penalties exist under the call for evidence itself, but failure to engage may reduce an organization's ability to shape the regulatory outcome.

What Your Organization Must Do

• →Register to respond to the consultation and assign a subject-matter lead from legal, data protection, and AI functions to coordinate the submission.
• →Audit current AI deployments for agentic or autonomous data-processing components and document how data provenance and access controls are managed today.
• →Map existing data flows involving AI agents against UK GDPR obligations to identify gaps that regulators are likely to target in forthcoming rules.
• →Brief senior leadership on the signal value of this consultation: future UK data regulation touching agentic AI is now a foreseeable compliance risk, not a speculative one.
• →Update your regulatory horizon-scanning calendar to track the outcome of this call for evidence and any subsequent consultation or legislative draft from DSIT.
• →Engage industry associations or legal counsel to monitor peer-sector responses, which will influence the regulatory narrative and eventual scope of any new rules.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Does the DSIT call for evidence on AI data regulation create any binding compliance obligations for UK businesses right now?

No binding obligations arise from the call for evidence itself. It is a government consultation instrument designed to gather structured input that will inform future legislative or regulatory proposals under the UK data regulation framework.

Which types of organizations are expected to submit evidence to the UK-DRAI-CFE consultation?

DSIT is seeking input from industry, civil society, and academia, covering large enterprises, SMBs, public sector bodies, AI developers, and AI deployers. Organizations running high-volume or sensitive data pipelines that involve AI systems are specifically expected to assess how current UK GDPR provisions apply to their operations.

Why is agentic AI singled out in the DSIT call for evidence, and what does that mean for compliance planning?

DSIT explicitly identifies agentic AI as a novel governance challenge because autonomous systems can initiate data transactions without direct human instruction, creating gaps in existing consent and purpose-limitation frameworks. Organizations deploying agentic AI should treat this as a strong signal that targeted regulatory requirements are forthcoming.

What specific thematic areas must respondents address in their submissions to the UK data-AI call for evidence?

Submissions must address data provenance, access controls for AI agents, transparency obligations, and the adequacy of existing consent frameworks. DSIT also expects respondents to include concrete examples of regulatory gaps or friction points encountered during actual AI deployment.

How does the UK-DRAI-CFE relate to the Data Protection and Digital Information framework already in place?

The call for evidence is intended to identify where current UK GDPR and the Data Protection Act 2018 fall short in AI contexts. Findings are expected to feed directly into amendments or guidance issued under the Data Protection and Digital Information framework, making this consultation a direct upstream input into enforceable rules.

What is the practical risk for organizations that choose not to engage with the DSIT AI data regulation consultation?

While there are no penalties for non-participation, organizations that do not engage lose the opportunity to shape the regulatory outcome. Peer-sector responses will influence the narrative around scope and requirements, meaning late-engaging organizations may face rules calibrated to others' operational realities rather than their own.