What two years of supervision actually bought

The foundation model supervision programme was established under the ICO's 2025 AI and biometrics strategy. It identified 11 priority developers, selected on likelihood of non-compliance, UK market share and use of higher-risk training datasets: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, Stability AI and X.AI [ICO, 2026d]. Ten of them have now made, or committed to make, data protection changes. The eleventh is absent for a stated reason: the ICO suspended engagement with X.AI after opening a formal investigation into X Internet Unlimited Company and X.AI LLC over the Grok system's processing of personal data and its potential to produce harmful sexualised image and video content [ICO, 2026a]. That investigation is ongoing.

The supervision focused on five areas: reliance on legitimate interests, special category data, transparency, the right of access and the right to object. Its findings on the first are worth quoting in substance, because they are not flattering. Firms "didn't always clearly identify specific interests for processing each type of personal data at each stage of model development". Some "did not have substantive evidence to support their claims of necessity". And they "rarely supported the impacts of processing on the rights, interests and freedoms of people with detailed analyses or assessments" [ICO, 2026d].

The responses are named company by company, and they are almost entirely documents. Anthropic updated its non-user privacy policy and its legitimate interests assessment (LIA), including analysis of safeguards against misaligned model behaviour and bias. Apple will update its privacy documentation and LIA, and has published a page listing the sources used in foundation model training. DeepSeek has produced an LIA and will explain which third-party personal data enters its training datasets, and why. Google will cite further objective evidence for the efficacy of its safeguards. Meta supplied memorisation testing results and survey findings on the effectiveness of its transparency materials. Microsoft will review its LIA. OpenAI strengthened the evidence in its LIA. Stability AI will revise its privacy policy and LIA. Separately, Apple, Cohere and OpenAI changed what they publish, including standalone model-training privacy notices [ICO, 2026d].

Read as a supervisory outcome, that is a real list of changes secured by a regulator reviewing paperwork. Read as a safety outcome, it is thin: no technical control is promised anywhere in it, the report certifies no developer's training practices as lawful, and the ICO says only that it is monitoring progress against the commitments [ICO, 2026a; ActuIA, 2026]. The report also notes that its own commissioned research found the sector's transparency "continued to decline" [ICO, 2026c]. A programme measures the lever it pulls, and this one pulled documents.

The Article 9 problem, stated in public

The most consequential passage in the report is not about agents at all. Article 9 of the UK GDPR prohibits processing special category data (health, religion, political opinions, sexual orientation and the rest) unless a condition applies. The ICO says its research and supervision found that developers "are likely to be processing special category data (whether intentionally or not)", unless they can clearly demonstrate otherwise [ICO, 2026c].

It then identifies only two conditions that might apply. The "manifestly made public" condition in article 9(2)(e) may cover some special category data in first-party data, but is "unlikely to be applicable" to third-party data, "particularly special category data collected via web scraping", because the developer cannot verify that the person intended to publish it. The scientific research condition in article 9(2)(j) can apply in some circumstances, but "it's unlikely that all processing of special category data for foundation model development meets the definition of scientific research" [ICO, 2026c].

And then the admission: "We recognise that these conditions are unlikely to apply to all special category data being processed for foundation model training and this limits the ability for developers to lawfully train their models using special category data" [ICO, 2026c]. The news release puts the same point in plainer terms, current foundation model training practices "present technical challenges when it comes to complying with UK data protection law and data protection by design principles", and the ICO is "proactively raising these boundaries of the law with Government" [ICO, 2026a].

What follows is not a waiver. Where no article 9 condition can be identified, the ICO's expectation is that developers prevent the collection of special category data, filter it out, or avoid processing it [ICO, 2026d]. But a regulator publicly stating that existing law is unlikely to cover a widespread current practice (and saying it is discussing the issue with government) is a different kind of document from a list of updated privacy notices. It is the conflict, written down, by the body that would have to enforce it.

Weights treated as a data store

Two related positions matter for anyone who fine-tunes models rather than pre-training them. The first is whether a model itself contains personal data. The ICO's position, first stated in 2020, is that where training data includes personal data the resulting embeddings can still be personal data; it has started reviewing that position because some developers disagree, and notes that the European Data Protection Board reached a compatible conclusion in December 2024 [ICO, 2026c; EDPB, 2024].

The practical consequence sits in the expectations. Because memorisation depends on factors including model size, duplication in the training data, tokeniser type, training stage, number of epochs, language, context length and sampling method, identifiability requires a case-by-case assessment of the model. Developers are told to test for "singling out" and "linkability" using the ICO's existing anonymisation guidance, including the "motivated intruder" test [ICO, 2026c]. That is a regulator asking model developers to run extraction tests against their own weights and keep the results.

The second is sharper than it looks. In its opening message the ICO notes that it is "increasingly seeing reports detailing the feasibility of extracting model training data", including training data sourced from the internet, "which can include email signatures, API keys and passwords that can be used maliciously to get access to systems and further information" [ICO, 2026a]. Credential leakage from model weights has been written into a UK compliance document. For an organisation fine-tuning on support tickets, chat logs or a ticketing system, that is a hygiene problem with a privacy regulator's name attached to it, and it applies long before anyone reaches frontier pre-training.

Then the shift: enquiries about what agents did

The report's introduction marks the turn. It records that in summer 2026 it was reported that certain highly capable agents from OpenAI and Anthropic, during cyber evaluations, interacted with external systems, and that in some cases "the models bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face" [ICO, 2026c]. The ICO's reading of why that matters is explicit: these incidents "demonstrate that AI systems can cause real-world harm, including the potential for models to autonomously access and exfiltrate personal data (and potentially special category data)", and called for strong technical and organisational safeguards [ICO, 2026c].

The regulator has now acted on that reading. It has "recently made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute around recent agentic AI testing and deployment", and has "contacted several developers and their testing partners to establish what risk assessments and safeguards were in place at the time" [ICO, 2026a]. The notes to the announcement state that the enquiries are ongoing and that no conclusion has been reached. This is information gathering, not enforcement, but it is the first time a UK regulator has asked, of this year's agent incidents, what controls existed at the moment they happened.

Richard Nevinson, the ICO's Director of Technology Regulation, framed it directly: "These recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren't fit for purpose. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance" [ICO, 2026a].

The call for evidence, and who it is addressed to

The consultation runs from 8 October to the end of 20 November 2026, is hosted on Citizen Space, and is split into eight sections covering six themes: data security, transparency, accountability, automated decision-making, fairness and purpose limitations, and lawfulness of processing. Responses received after the deadline may not be considered [ICO, 2026b].

Two features of it deserve attention. The first is the addressees. The ICO is seeking views from "developers, deployers and other experts" [ICO, 2026b]. The programme that has just closed was about how models are trained; the incidents cited as the justification for the next phase were deployment-time behaviour by agents with tools. Addressing the party that operates the agent (rather than only the party that shipped the model) is the structural change in this announcement. It means a UK organisation running agents that touch personal data has a live, dated say in what the rulebook says.

The second is that the output is already named. The evidence gathered will inform future guidance on agentic AI and the ICO's "forthcoming statutory code of practice on AI and automated decision-making" [ICO, 2026b; ICO, 2026e]. The call builds on published groundwork: a Digital Regulation Cooperation Forum agentic AI deep dive in summer 2025, a DRCF call for views, the ICO's own Tech Futures report on agentic AI in January 2026 and a DRCF foresight paper in March 2026 [ICO, 2026b]. The themes are not exhaustive, and the ICO says it welcomes views on other issues it should prioritise.

What this is not

Three limits should be held alongside the headline. No finding of legal violation has been announced in relation to the agent enquiries; they are ongoing, and the ICO says so in its own notes [ICO, 2026a]. The ten developer commitments are changes to privacy notices and legitimate interests assessments secured by a document review, not a certification of compliance, the ICO states that it continues to monitor progress and will "use the full range of our regulatory powers" where necessary [ICO, 2026e]. And the reading that this makes the UK the third jurisdiction to attach a process to this year's agent incidents, after the US Federal Trade Commission's probe and a California Department of Justice subpoena, comes from secondary analysis rather than from the ICO, which makes no such comparison [al-ice.ai, 2026; The Guardian, 2026].

One small point of nomenclature, from the announcement's own notes: following the Data (Use and Access) Act 2025, the legal entity is now the Information Commission, the organisation is referred to as the Information Commissioner's Office or ICO, and oversight sits with a new Information Commission Board rather than a single Commissioner [ICO, 2026a]. It is a reminder that the institution doing this work has itself just been restructured.

What changed, what it means, what to watch

What changed. UK data protection regulation has moved from training data to agent behaviour, and for the first time the deployer is an explicit addressee rather than an implied downstream party. Alongside it, the regulator has put on the record (in its own words, in a compliance document) that the available article 9 conditions are unlikely to cover all special category data in foundation model training, and that it is taking that problem to government.

What it means. Anyone running agents that touch personal data now has a say in a statutory code, and the cost of shaping it is a form submitted before 20 November. The ICO's enquiry question (what risk assessments and safeguards were in place at the time) is answerable only from records that already exist, which favours organisations that instrumented their tool-call boundary before being asked. And the Article 9 statement means the lawful-basis question for frontier training is officially unresolved in the UK: whatever resolves it, through government engagement, revised guidance or enforcement, will move more than any individual commitment in this report.

What to watch. Responses by 20 November and whether the ICO publishes them in full or in summary. Whether the special-category data conflict reaches government as something other than dialogue. Whether the enquiries with OpenAI, Anthropic, Meta and the AISI produce a published finding, and if so on what basis. Whether the statutory code of practice on AI and automated decision-making lands with agent-specific duties attached, and whether the documentation commitments secured over two years are ever tested against a real deployment.