UK regulator seeks input on data privacy for agentic AI

Defining the new AI frontier

The UK Information Commissioner's Office (ICO) recently opened a call for evidence to explore how existing data protection laws apply to "agentic AI." Unlike standard chatbots that simply answer questions, agentic AI refers to systems capable of acting independently to achieve specific goals. These systems are designed to operate with limited human supervision while performing complex tasks.

The ICO provides a specific technical definition for these systems in its announcement. It describes agentic AI as a computer system made of one or more agents that possess an LLM-based foundation, memory, and access to various tools and environments. Because these agents have a level of autonomy, they can use these resources to complete tasks based on the context provided by a user.

These agents can pursue overarching goals by creating their own intermediate, self-defined objectives. This ability to plan and execute multi-step processes distinguishes them from traditional AI services. The regulator is now looking for information on how this autonomy creates unique challenges for data privacy and legal compliance.

Novel compliance challenges

The shift toward autonomous agents introduces several questions that current laws may not easily answer. One major concern is how data controllers can ensure their systems process personal data fairly and lawfully. Because agents can act independently, organizations may find they have no meaningful or real control over how the system collects or uses data during its tasks.

Transparency is another significant hurdle for businesses using these technologies. It can be difficult for a company to provide clear information about data processing when they cannot predict exactly how an agent will gather information. The ICO is specifically looking for evidence on how organizations manage these uncertainties regarding the types of data a system might use to reach a goal.

Security also presents a complex problem for developers and operators. Organizations may struggle to anticipate whether an agent will retrieve information from external sources that includes malicious prompts or code. The regulator wants to know how companies are implementing technical and organizational measures to prevent these agents from updating internal databases with unauthorized or harmful information.

Who is affected by this move

The ICO is reaching out to anyone who wants to use the benefits of agentic AI while remaining compliant with the law. This includes a wide range of stakeholders, from large corporations to small developers. The regulator notes that agentic AI is moving rapidly from a theoretical concept to a practical tool used in many different business environments.

Specific groups that would benefit from providing feedback include those who develop or provide AI agents as a service. It also applies to businesses that embed these agents within their internal processes or offer them as part of a product. Companies using AI systems that can access third-party websites, tools, or external data sources are also encouraged to participate.

Organizations currently grappling with questions around automated decision-making or fairness are also primary targets for this call. The ICO wants to hear from those who have already experienced practical challenges in applying data protection requirements to these systems. This feedback will help identify where organizations need more practical support before final guidance is officially published.

The path toward regulation

The information gathered from this call for evidence will be used to inform the ICO's future statutory code of practice. This code will specifically address AI and automated decision-making within the UK. By collecting this evidence now, the regulator hopes to create a framework that balances innovation with the protection of personal data.

The ICO is also focusing on specific sectors, such as the adtech ecosystem, where agentic AI may have a significant impact. A report exploring the application of these systems in advertising is expected to be released later this year. This suggests that the regulator is looking closely at how autonomous agents might influence the way ads are delivered and targeted.

Future guidance from the ICO is expected to influence the regulatory expectations for the design and governance of agentic AI. Organizations that participate in the call for evidence have an opportunity to explain where current laws are difficult to apply. This proactive approach allows the regulator to understand the real-world limitations of current rules before setting new standards.