The Information Commissioner’s Office (ICO) has published a call for evidence on how organisations are managing the data protection risks of agentic AI.
The call for evidence is the latest example of regulators seeking to come to terms with the particular challenges posed by agentic AI, and follows a report from the Digital Regulation Cooperation Forum (DRCF) on the subject earlier this year (discussed here).
In the context of data protection, the ICO explains how agentic AI raises complex and novel challenges due to the level of autonomy systems are granted, enabling them to “process personal information on a larger scale and in more complex ways than previous AI systems”. This includes, for example, accessing different sources of information, disclosing personal information to third parties, or taking action without human supervision or approval.
The Call for Evidence outlines how such systems work and explores the challenges of ensuring compliance with data protection requirements, including the principles of data minimisation, purpose limitation and accuracy.
While the purpose of the exercise is largely to understand how those developing and deploying agentic AI are managing various data protection risks, the ICO also sets out its expectations of such organisations, including that:
- The level of autonomy given to an agent should be “a deliberate and carefully considered design and deployment decision” supported by proportionate guardrails, permissions, and approval thresholds;
- Transparency must be designed into agentic AI systems from the beginning. Organisations should identify and document matters such as what personal information agents can access, the sources they can obtain it from, and to whom it may be disclosed;
- Organisations that determine or exert sufficient influence over the purposes and means of processing personal information through an agentic AI system may be deemed controllers in respect of that processing; and
- Organisations using agentic AI must assess whether and, if so how, the automatic decision– making provisions in data protection law apply.
The Call for Evidence closes on 20 November 2026 and can be found here.