The UK’s Information Commissioner’s Office (ICO) has issued a “call for evidence” examining how existing data protection laws should apply to agentic AI systems. As the British government agency responsible for data protection, privacy and access to public information, it is responding to businesses increasingly deploying automation to execute workflows and make decisions.
The initiative focuses on the potential privacy and security implications of AI agents that perform tasks with limited human intervention, particularly when those systems process personal information or exchange data across multiple applications.
The ICO is seeking input from organizations developing or implementing agentic AI on several issues, including data security, transparency, accountability, automated decision-making, fairness and lawful processing of personal information.
The regulator is particularly interested in how businesses identify and mitigate risks associated with autonomous systems, as well as what additional regulatory guidance could help organizations comply with existing data protection requirements.
Responses will inform the ICO’s future guidance and its forthcoming statutory code of practice on AI and automated decision-making.
The consultation closes Nov. 20, 2026, with submissions accepted through the ICO’s Citizen Space survey.