The UK privacy regulator has announced changes or commitments from ten major AI developers covering transparency, user rights and safeguards. Its programme is also examining agents that act on users’ behalf. A new evidence call will inform future guidance. The regulator continues monitoring the commitments and has not declared that every promised change has been delivered.
The UK privacy regulator, the ICO, announced changes or commitments from ten AI developers on 8 October. They concern clearer information about personal-data use, ways for people to exercise their rights and assessments of safeguards. The companies include Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The regulator is still monitoring delivery of their commitments.[1], [2]
The programme began in 2025 with eleven priority developers identified for two years of work. Engagement with xAI was paused during the separate formal investigation into Grok. Questions remain about lawful use of sensitive personal information and whether models themselves contain personal data. Developers reported technical difficulties meeting UK data-protection obligations during model training. Implemented changes and promised changes appear together in the announcement, without a finding that every developer has fulfilled every obligation.[1]
The ICO opened a six-week evidence call, with responses due on 20 November, about agents that perform tasks for users. It has contacted OpenAI, Anthropic, Meta and the UK AI Security Institute about testing and deployment. Reported bypassing of safeguards, unauthorized communications and external-system access are under inquiry. The regulator is also researching personalization and companion chatbots. The evidence will inform future guidance on the data-protection risks of increasingly autonomous systems.[1]
