UK DSIT Call for Evidence on Data Regulation in the Age of AI and Other Data-Intensive Technologies

Issued by

UK Department for Science, Innovation and Technology

liveUK-DRAI-CFEUpdated October 2026 · Last verified October 1, 2026

DSIT ran a call for evidence on adapting UK data law to AI and other data-intensive technologies, including AI agents, from 15 July to 9 September 2026. It is now closed and awaiting the government's response.

Applies To

Large enterpriseSMBPublic sectorAI developerAI deployer

Overview

Run by DSIT from 15 July to 9 September 2026, this call for evidence was a government consultation seeking views from industry, civil society, and academia on whether UK data rules suit AI. The consultation explicitly names agentic AI as a new governance challenge, signaling that policymakers are scrutinizing AI systems that start data exchanges without a human instructing them. Key areas under examination include data provenance (records of where data came from), access controls for AI agents, transparency obligations, and the adequacy of existing consent and purpose-limitation frameworks. Responses will inform possible changes to UK data law, which now rests on UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. No binding obligations arise from the call for evidence itself, but its findings are expected to feed directly into future legislative or regulatory proposals. Enterprises that submit evidence or monitor outcomes will be better positioned to anticipate forthcoming compliance requirements.

Key Requirements

•The call for evidence ran from 15 July to 9 September 2026 and is now closed.
•It covered five themes: accessing and using data, data quality, governing data use across organisations including agentic AI, transparency and rights, and how well data law regulates AI.
•Respondents chose which questions to answer.
•No obligations or penalties arise from it; any changes would come through later proposals.
•Current UK data law is UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What Your Organization Must Do

→Track the government's response to the closed call for evidence and any follow-up consultation on proposals.
→Map where your AI systems rely on UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
→Record where your data came from, since data provenance was one theme under examination.
→Review access controls and logging for AI agents that start data exchanges without human instruction.
→Test whether your consent and purpose limitation records still hold up for automated data use.
→Brief senior leaders that no duties arise yet, but changes may follow later proposals.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

09How do we maintain data privacy compliance when using AI?21How do we govern AI agents that take autonomous actions?12Is our training data compliant with global privacy laws?24What does audit-ready AI documentation look like in practice?43How do we engage regulators and standards bodies proactively on AI governance?

Frequently Asked Questions

Does the DSIT call for evidence on AI data regulation create any binding compliance obligations for UK businesses right now?: No binding obligations arise from the call for evidence itself. It is a government consultation instrument designed to gather structured input that will inform future legislative or regulatory proposals under the UK data regulation framework.
Which types of organizations are expected to submit evidence to the UK-DRAI-CFE consultation?: DSIT is seeking input from industry, civil society, and academia, covering large enterprises, SMBs, public sector bodies, AI developers, and AI deployers. Organizations running high-volume or sensitive data pipelines that involve AI systems are specifically expected to assess how current UK GDPR provisions apply to their operations.
Why is agentic AI singled out in the DSIT call for evidence, and what does that mean for compliance planning?: DSIT explicitly identifies agentic AI as a novel governance challenge because autonomous systems can initiate data transactions without direct human instruction, creating gaps in existing consent and purpose-limitation frameworks. Organizations deploying agentic AI should treat this as a strong signal that targeted regulatory requirements are forthcoming.
What specific thematic areas must respondents address in their submissions to the UK data-AI call for evidence?: None were mandatory; respondents chose which questions to answer. The themes were accessing and using data, data quality, governing data use across organisations including agentic AI, transparency and rights, and how well data law regulates AI.
How does the UK-DRAI-CFE relate to the Data Protection and Digital Information framework already in place?: There is no such framework, because the Data Protection and Digital Information Bill fell in May 2024. Its successor became the Data (Use and Access) Act 2025, which with UK GDPR and the Data Protection Act 2018 is the law the call examines.
What is the practical risk for organizations that choose not to engage with the DSIT AI data regulation consultation?: The call closed on 9 September 2026. Organisations can still follow the government's response and any later consultation on proposals.