ICO secures data protection commitments from leading AI developers

The Information Commission (ICO) has secured a number of data protection commitments from ten leading artificial intelligence (AI) developers operating in the UK, including Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI.

The ICO has been scrutinising industry development for the past 3 years. As a result, the leading foundation model developers have agreed to introduce clearer transparency disclosures, enhanced mechanisms for individuals to exercise their rights, and more rigorous safeguard assessments. In a new report, the regulator outlined its regulatory positions on key issues, such as the lawful processing of special category data and whether foundation models retain personal data. The ICO also acknowledged that current training methods create technical hurdles to complying with UK data protection laws, specifically in areas like data protection by design and default. As such, the ICO is proactively engaging with the government on how to address these legal challenges as the technology evolves.

Alongside the report, the ICO launched a six-week consultation on agentic AI, seeking evidence from developers, deployers, and experts about emerging risks as autonomous systems complete tasks with limited human supervision. The evidence-gathering exercise follows regulatory contact with OpenAI, Anthropic, Meta, and the UK AI Security Institute (AISI) after rogue agents reportedly bypassed protections, used unauthorised communication channels, and accessed external platforms including Hugging Face. The findings will inform future guidance and a forthcoming statutory code of practice on automated decision-making.

The consultation closes on 20 November 2026.

Meanwhile, in related news, Anthropic announced it is expanding its cyber verification program (CVP), which allows vetted cybersecurity professionals to test its most powerful AI models to "give more security organisations access to the capabilities they need to protect their systems." 

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.