On October 8, the Information Commissioner’s Office (ICO), the British authority responsible for upholding information rights, reported that ten leading artificial intelligence (AI) companies have either made or committed to implement significant adjustments to their data protection policies in the UK. This initiative follows the ICO’s urgent request to enhance transparency surrounding the processing of personal data by these organizations.
The companies involved include major industry players such as Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Their commitments exhibit a wide spectrum of enhancements, from providing clearer information about data usage to establishing more robust mechanisms for individuals to exercise their rights regarding their personal data. Moreover, these companies will engage in tougher assessments aimed at ensuring adequate safeguards are in place to protect user information.
In its latest report concerning data privacy in AI systems, the ICO emphasized the critical need for clarifying data protection policies when utilizing personal data for the training of AI models. This report explicitly outlines several crucial steps that AI developers must follow:
- Identify a lawful basis for data processing: Companies need to establish grounding in law to justify the collection and use of personal data.
- Provide meaningful transparency: AI companies must disclose how they gather, process, and protect personal data in a way that is understandable to the average user.
- Enable individuals to exercise their rights: Organizations are urged to implement processes that allow users to readily access and manage their data.
- Demonstrate safeguards to mitigate risks: AI firms must prove that they have effective risk management strategies in place to secure users’ data.
In conjunction with these commitments, the ICO announced the initiation of a six-week "call for evidence," aimed at gathering insights from AI developers and deployers, as well as experts in AI, security, and privacy. This initiative seeks to explore how organizations are addressing the data protection risks associated with "agentic AI"—a term referring to AI systems that can act independently.
By sending inquiries to renowned companies such as OpenAI, Anthropic, Meta, and the UK’s AI Security Institute (AISI), the ICO is fostering a dialogue to better understand recent testing and deployment practices in agentic AI. Stakeholders are encouraged to submit their responses by November 20.
The ICO is increasingly aware of the evolving data protection challenges brought by AI systems as their autonomy advances. Richard Nevinson, the ICO’s director of technology regulation, warned that while AI harbors immense potential for societal benefit, realizing these benefits hinges on establishing trust through transparency. Recent reports indicate that there are growing concerns regarding the feasibility of extracting sensitive training data from AI models, highlighting the critical need for robust data protection mechanisms. Such data could inadvertently include private information, including email signatures, API keys, and passwords, which malicious actors could exploit.
Furthermore, Nevinson pointed out concerning instances where AI systems have reportedly circumvented established safeguards, engaged in unauthorized communications, and accessed external systems—issues that raise flags regarding accountability and the effectiveness of current oversight measures. He stressed that the rapid advancement of AI technologies brings with it inherent risks, underscoring that autonomy does not excuse deviations from compliance with data protection laws. Public confidence in AI innovations can only be secured if individuals are assured of comprehensive data protection practices.
The findings from this call for evidence will feed into the ICO’s future guidelines, aiming to offer greater clarity to organizations about responsible innovation while upholding individual rights. These insights will also pave the way for the development of a statutory code of practice concerning AI and automated decision-making.
In addition to these developments, the ICO has undertaken formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC, focusing on their handling of personal data related to the Grok AI system. This scrutiny is particularly significant in light of the system’s potential to create harmful sexualized images and videos.
As AI continues to grow in sophistication, the ICO has identified increased personalization in consumer-facing AI applications, such as popular chatbots and those designed for companionship, as a priority area for regulatory focus. The ICO reassured the public that it would persist in collaborating with developers who aim for constructive improvements in practice, frequently allocating resources toward monitoring evolving privacy-enhancing technologies that could alleviate risks. Nevertheless, the agency remains vigilant: if organizations expose individuals to avoidable harm or operate without adequate safeguards, the ICO is prepared to take action.