If you are a founder building with AI, the ICO’s message last week is worth reading closely. Autonomy changes how a system behaves. It does not change who is accountable for what that system does with personal data.
What the ICO announced
On 8 October the ICO said that ten of the largest foundation model developers operating in the UK have made, or committed to make, data protection changes following its scrutiny. The changes include clearer transparency information, stronger ways for people to exercise their rights, and more rigorous assessment of safeguards. The ICO says it is monitoring progress against those commitments. [ICO]
It also opened a call for evidence on agentic AI. The questions cover data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing, and the ICO invites views from developers, deployers and other experts. The ICO says the evidence will inform its guidance and support the development of its forthcoming statutory code of practice on AI and automated decision-making. [ICO]
“…the fact AI agents act with autonomy is not an excuse for poor compliance.”
What this means for AI start-ups
The ICO’s report on foundation models is addressed to developers, not to the organisations that build on them. The five points below are our reading of what follows for start-ups, based on the general UK GDPR position. They are not legal advice.
Your provider’s commitments are not your compliance
Where you are the controller for your product’s processing, the lawful basis, transparency and rights handling are yours. A provider improving its own transparency information does not discharge your duties to your users.
Agents widen the risk surface
The ICO’s questions span security, transparency, accountability, automated decision-making, fairness and lawful processing. An agent that books, buys, decides or acts touches more personal data, in more places and with less human involvement, than a tool that only answers questions.
Special category data raises the bar
The ICO’s report sets out its position on how special category data can be used lawfully. Under UK GDPR you need both a lawful basis and an additional condition to process it. If your product touches health, biometric or similar data, expect investors and enterprise buyers to ask how you handle it. [ICO]
The code will become the yardstick
Once the statutory code is published, we expect buyers, investors and their advisers to use it as a benchmark in procurement and due diligence. That is our expectation, not a statement from the ICO. A minimum viable governance baseline now costs far less than a retrofit later.
You can shape it
The call for evidence closes on 20 November 2026. Regulators benefit from hearing how smaller firms work in practice. Responses go through the ICO’s online survey, and the ICO may publish them in full or in summary, so leave out anything you would not want made public. [ICO]
Where to start
If you are building with agents and are not sure where you stand, begin with three questions. What personal data does the agent touch? Who is accountable for it? Where does a human step in? Our free checklist, “15 questions to ask when governing agentic AI”, works through the rest. Download it free below, or start now with our due diligence checklist, forty questions across eight areas.
Sources
- ICO, ICO secures changes from leading AI developers as scrutiny extends to AI agents, 8 October 2026.
- ICO, Agentic AI call for evidence, open 8 October to 20 November 2026.
- ICO, Building trust and transparency into generative AI development: our work to create regulatory certainty.