ICO turns to Ai agents
.avif)
ICO and Ai Agents: What UK Organisations Using Copilot Should Do Now
The UK’s data protection regulator has secured commitments from ten of the biggest Ai developers, and it is now turning its attention to Ai agents. If your organisation uses Microsoft 365 Copilot or other Ai tools, this is a good moment to check your own house is in order.
What the ICO announced
On 8 Oct 2026, the Information Commissioner’s Office (ICO) said Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI have made changes, or committed to make them, after it reviewed how they comply with UK data protection law. The changes include clearer explanations of how personal information is used to train Ai models, better ways for people to exercise their data rights, and tougher assessments of developers’ safeguards.
The commitments come from a supervisory programme launched in 2025. It started with 11 developers, and fell to ten when the ICO paused its engagement with xAI to pursue a separate formal investigation into its Grok chatbot.
The ICO isn’t calling the job done. It says it will monitor whether developers keep their promises, and that problems remain under UK data protection law. These include sensitive personal data embedded in models, how people can have their details removed once a model has been trained on them, and the risk of personal information being extracted from models.
Ai agents are next
The regulator has also contacted OpenAI, Anthropic, Meta and the UK’s AI Security Institute after reports that agents bypassed safeguards during testing and deployment earlier this year. Richard Nevinson, the ICO’s director of technology regulation, was clear: “the fact AI agents act with autonomy is not an excuse for poor compliance.”
The ICO has opened a six-week call for evidence on agentic Ai, covering security, transparency, accountability and the lawful use of personal data. Responses are due by 20 Nov 2026, and they will inform future guidance and the ICO’s forthcoming statutory code of practice on Ai and automated decision-making.
Why this matters if you use Ai at work
The developers’ commitments cover how they train and run their models. They don’t change who is responsible for the personal data your own teams put into Ai tools. If staff paste personal details into a chatbot, or an Ai assistant can search every file in your Microsoft 365 tenant, your organisation still has to answer for how that data is handled.
Agents raise the stakes. A tool that can act on its own, sending emails, updating records or pulling information from several systems, needs firmer boundaries than one that only answers questions. The ICO’s message is that autonomy doesn’t move accountability away from the organisation using it.
Five practical steps to take now
- Know what’s in use. List the Ai tools your teams actually use, approved or not, and the data each one can reach.
- Tidy up permissions before you switch on Copilot. Ai assistants work with the access your people already have. If sensitive folders are shared too widely, fix that first.
- Carry out a DPIA where it’s needed. If an Ai tool processes personal data in a way that’s likely to be high risk, a data protection impact assessment (DPIA) helps you spot and reduce that risk before rollout.
- Write a short, usable Ai policy. Set out which tools are approved, what data must never go into them, and who signs off new uses, especially agents that can take actions.
- Keep a person in the loop. Where a decision affects an individual, make sure someone reviews what the Ai produces before it’s acted on.
A note for finance and public sector buyers
If you’re budgeting for Ai licences or buying Ai capability for a council or public body, ask suppliers how their tools handle personal data, what controls exist over agents, and how they’ll respond to the ICO’s code of practice when it arrives. Building those questions into procurement now saves rework later.
If your organisation is already using or testing Ai agents, the call for evidence is open until 20 Nov 2026. It’s worth reading and considering a response, as it will help shape the rules you’ll be working to.
Get your Ai rollout on a solid footing
Flotek help partners adopt Microsoft 365 Copilot and other Ai tools with the right permissions, security controls and policies in place, so your teams get the productivity gains without the data protection headaches. As a Microsoft Cloud Partner, we can review your setup, tighten access and help you plan a sensible rollout. Get in touch to talk it through.
Further reading
.jpg)
Schedule a Free IT Audit & Cost Breakdown
Download ‘Your First 60 Days with Microsoft Copilot’ Guide
%20amended%20logo.avif)
.avif)
.avif)
%20(1).avif)
.avif)