Source: The National Law Review

The ICO opened an evidence-gathering exercise on 8 October 2026 to examine how existing UK data protection laws apply to agentic AI, with submissions accepted until 20 November 2026. For this exercise, agentic AI encompasses systems containing one or more LLM-based agents with access to tools, memory and an environment, and some autonomy in completing tasks. An agent’s objectives may come from a user or the person concerned by the information, or include intermediate objectives generated to pursue a broader goal. The consultation covers data security, transparency, accountability, automated decision-making, fairness, purpose limitation and lawful processing of personal data. The ICO asks how organisations encounter these challenges when developing or using AI agents, how organisations address the challenges, and what additional support would help. The questionnaire contains 45 questions, combining open responses and multiple-choice answers; respondents do not have to answer every question.

Responses will inform future guidance and the ICO’s planned statutory code of practice on AI and automated decision-making. The exercise is open to anyone seeking to use agentic AI while complying with data protection law, and responses can be submitted through the ICO’s online form. In their professional commentary, David Naylor, Simon Jones and Paul Jinks examine compliance difficulties arising when organisations cannot meaningfully control how agents collect or use personal data. The authors also question how organisations can explain unpredictable processing, establish lawful grounds and manage security risks from external information, malicious prompts or code. The authors advise potential respondents against focusing too narrowly on whether a system precisely matches the ICO’s consultation definition. The authors expect future guidance to influence UK regulatory expectations for agentic AI design, deployment and governance, and encourage organisations to identify practical difficulties with existing requirements.