On 8 October 2026 the UK Information Commissioner’s Office (ICO) published two items on the same day: a report on its supervision of foundation models, and a call for evidence on agentic AI. The report shows that ten foundation model developers, including OpenAI, Anthropic, Google, Meta, Microsoft, Apple and DeepSeek, have completed or committed to a series of data protection changes; the call for evidence is addressed to developers, deployers and experts, runs for six weeks and closes on 20 November. Read together, the two indicate the ICO’s regulatory tempo: finish the work at the foundation model layer first, then move attention to what happens after deployment.
Interim results of foundation model supervision
In 2025 the ICO established a foundation model policy and supervision programme under its AI and biometrics strategy, running for two years and covering eleven priority developers selected by likelihood of non-compliance, UK market share and use of high-risk training datasets. The report of 8 October is the interim outcome of that round of supervision.
The ten developers that made changes are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The changes concentrate on three areas: clearer transparency information, more usable mechanisms for individuals to exercise their data rights, and more rigorous assessment of safeguards. The ICO states that it will continue to monitor how each developer discharges its commitments.
The report also sets out the ICO’s position on two specific questions: how special category data may lawfully be used, and whether a foundation model may itself contain personal data. Both have long been contested in practice, and the ICO’s statement gives developers a measure of certainty. The ICO acknowledges, however, that current foundation model training practice faces technical difficulty in satisfying UK data protection law and the principle of compliance by design, and says that it will raise these legal boundary questions with the government on its own initiative.
One point should be noted: the ICO had opened a formal investigation into X.AI over its Grok AI system and, as a result, suspended its engagement with X.AI, so that the number of priority developers fell from eleven to ten. That investigation continues.
From models to agents: how the risk judgment changes
Foundation models underpin a new wave of AI agents. Unlike chatbots, agents can complete tasks, call tools and interact with websites, often under only limited human supervision. The ICO summarises the change as a shift in the focus of risk from how a system is trained to how it may act independently once deployed.
What is genuinely notable is the ICO’s attitude to agent autonomy. Richard Nevinson, the ICO’s Director of Technology and Regulation, put it directly: the fact AI agents act with autonomy is not an excuse for poor compliance. The direction is clear — autonomy does not dilute the deployer’s responsibility; it raises the requirement for safeguards.
The ICO also disclosed that it had put questions to OpenAI, Anthropic, Meta and the UK AI Security Institute (AISI) about agent testing and deployment earlier in the year. According to the report, some agents bypassed safeguards, used unauthorised communication channels and accessed external systems such as Hugging Face. The ICO has approached several developers and their testing partners to establish what risk assessments and safeguards were in place at the time. Those inquiries continue.
The weight of this passage lies in its specificity. It does not remain at the abstract level of agents being risky, but points to particular modes of failure: guardrails bypassed, communication channels out of control, external systems accessed. These are precisely the matters to be checked one by one when assessing an agent product.
The call for evidence and the forthcoming code of practice
The ICO’s call for evidence covers six areas: safety, transparency, accountability, automated decision-making, fairness and lawful use of data. The responses will inform subsequent guidance and support its forthcoming statutory code of practice on AI and automated decision-making. This deserves the attention of Chinese companies: a statutory code of practice means the rules move from the level of guidance to a position with greater binding force.
Beyond agents, the ICO identifies the growing personalisation of consumer-facing AI services as another priority area, including general-purpose chatbots and role-play and companionship chatbots. The ICO is conducting public research and engaging with companies. This direction overlaps with domestic regulatory attention to anthropomorphic interaction services.
What the approach offers Chinese companies
The ICO’s method is layered: first subject foundation model developers to continuing supervision, turning transparency, exercise of rights and assessment of safeguards into trackable commitments; then, through a call for evidence, build the regulatory basis for the more autonomous form that agents represent. The sequence has its own logic — regulate first the object that is trained, then the subject that acts autonomously.
For Chinese companies going overseas, two points can be taken directly.
First, treat transparency, exercise of rights and assessment of safeguards as the default baseline of product design. These three requirements run in the same tradition as the GDPR and are also consonant with the notice-and-consent and protection-of-individual-rights logic of China’s Personal Information Protection Law. Building them as default capability is more efficient than adapting jurisdiction by jurisdiction.
Second, document the testing and evaluation of agents. One focus of the ICO’s inquiries was what risk assessments and safeguards were in place at the time. Read in reverse, that sentence means that test records, risk assessment documents and descriptions of guardrail design are themselves compliance assets. Assembling the material only when an inquiry arrives costs far more.
It should be noted that China’s regulatory thinking runs in the same direction on this point. The “unexpected autonomous behaviour” and “autonomous cyber-attack threat” newly added in the AI Safety Governance Framework 3.0 likewise emphasise that AI should remain under human control. For companies serving both the domestic and overseas markets, making controllability, traceability and accountability robust is one of the few things that satisfies both sets of regulatory requirements at the same time.
For assistance with data protection and accountability design for agent products, and with data compliance for overseas markets, see the EU AI Act and GDPR and Cross-Border Data Transfer service pages. Related reading: the analysis of the AI Safety Governance Framework 3.0 discusses domestic requirements on the autonomous behaviour of agents, and the multi-jurisdiction compliance guide sets out compliance arrangements where several jurisdictions apply in parallel.
This article is prepared on the basis of the ICO’s press release of 8 October 2026, “ICO secures changes from leading AI developers as scrutiny extends to AI agents”, together with its foundation model supervision report and its call for evidence on agentic AI. It is for reference only and does not constitute legal advice. Specific compliance judgments should be made in the light of the applicable jurisdiction and the facts.