The ICO's agentic AI call for evidence: What you need to know

The Information Commission's Office (ICO) has opened a six-week call for evidence on agentic AI, closing on 20 November 2026. It focuses specifically on how data protection law applies to the distinctive capabilities and risks of agentic AI systems. Given that many organisations are already deploying agentic AI tools, this development deserves close attention.

This comes at the same time as the ICO publishing the results of its supervision of the largest foundation model providers, following which 10 of the world's largest AI model developers committed to making data protection improvements.

What is agentic AI, and why does it raise data protection questions?

We covered these key questions in the Agentic AI and Data – Five Big Questions article, written by Emma Erskine-Fox, previously published on our website.

Agentic AI consists of AI systems capable of making decisions and taking actions with minimal human oversight and a degree of autonomy. This typically goes beyond the prompt-response interactions of traditional generative AI, as an agent can plan, execute and adapt over time. This means that agentic AI systems tend to process personal information on a larger scale, and in a more complex way, than traditional generative AI.

The ICO flags that an agentic system could use more personal information than necessary to complete a task, or it could disclose special category personal data to an unauthorised third party. Orchestration activities could allow inaccurate information or bias to spread through the chain of processing, affecting later decisions or actions.

This combination raises data protection concerns, which the ICO is aware of and which is a factor in this agentic AI call for evidence.

Why the ICO is acting now

The ICO is seeking to support responsible innovation. It has previously contributed to an agentic AI deep dive by the Digital Regulation Cooperation Forum (DRCF), as well as identifying the need to provide greater regulatory certainty to AI developers and deployers on agentic AI.

As many of us are, it is also aware of recent agentic AI incidents concerning foundation model providers, such as the widely covered incident where OpenAI agents escaped a testing sandbox to infiltrate Hugging Face. The ICO has already made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute around recent agentic AI testing.

The feedback provided in respect of this call for evidence will also inform the ICO's forthcoming statutory code of practice on AI and automated decision-making (ADM).

The six themes

The initial analysis conducted by the ICO of agentic AI systems identified six key areas where organisations face challenges in implementing a 'data protection by design and by default' approach.

The six themes identified provide a helpful framework for stress-testing existing and proposed agentic AI deployments against the ICO's current thinking.  For example, do you know what data your agents can access? Can a clear lawful basis be identified for all stages of the workflow? Has meaningful transparency been provided to individuals?

The themes are as follows:

What happens next?

The dynamic nature of agentic AI raises important questions about how to comply with data protection requirements, which organisations across the UK are working to understand. Organisations are already working hard to implement governance and technical solutions to comply with legal requirements when developing and deploying agentic AI systems.

The evidence gathered will be used to develop guidance that helps organisations in the UK understand their regulatory obligations in respect of agentic AI, as well as informing the statutory code of practice on AI and ADM. The call for evidence provides a helpful opportunity for organisations to demonstrate the value of agentic AI systems, as well as to share compliance challenges directly with the ICO, to inform what guidance and support is provided by the regulator.

Responses can be submitted until the end of 20 November 2026. If you would like to discuss whether and how to respond to the call for evidence, or to review your existing agentic AI arrangements, please do get in touch.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at October 2026.  For more information see our terms & conditions.