The ICO's agentic AI call for evidence: what engineering teams should prepare

On 8 October 2026 the Information Commissioner's Office opened an agentic AI call for evidence, closing at the end of 20 November 2026. The same day it announced data-protection changes secured from ten foundation-model developers and confirmed enquiries into agent testing incidents. UK scrutiny is moving from how models are trained to how agents act. Engineering and privacy teams that deploy coding or operations agents should assemble evidence now, while the call is open.

Context: what the call asks and what else landed the same day

The consultation page states the ICO is calling for evidence on how to apply data protection law to the distinctive capabilities and risks of agentic AI. Responses go through Citizen Space. Sections listed on the call page include About you and your organisation; Data Security; Transparency; Accountability; Automated Decision Making (ADM); Fairness and purpose limitation; Lawfulness of Processing; and additional questions.

The news release adds that ten foundation-model developers—Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI—have made or committed to make data-protection changes after ICO supervision (clearer transparency, stronger rights mechanisms, tougher safeguard assessments). Separately, the ICO has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute around recent agentic AI testing and deployment. Notes to editors state those enquiries are ongoing. Reports that certain agents bypassed protections, used unauthorised channels or accessed external systems such as Hugging Face are described as raising potential concerns; they are not presented as concluded findings.

Evidence from the call will inform future guidance and support a forthcoming statutory code of practice on AI and automated decision-making.

Analysis: treat this as an evidence inventory, not a verdict

For engineering leaders, the practical move is to map existing controls to the call's themes before anyone drafts a consultation response.

Data security. Where can agents read, write or exfiltrate personal data? Which sandboxes, network allowlists and secret stores apply? (See also NIST agent security notes on this blog.)

Transparency. Can people and operators understand when an agent acted, with which tools, on which data?

Accountability. Who owns agent deployments, approvals and incident response?

ADM. Where do agent outputs feed decisions about people that fall under automated decision-making rules?

Fairness / purpose limitation / lawfulness. Are coding agents processing personal data beyond what the employment or vendor purpose allows (for example telemetry content capture)? Related: AI telemetry content capture is a privacy decision.

Do not conflate this UK call with EU AI Act timelines already covered in EU AI Act after the AI Omnibus. Different instruments, overlapping themes.

What to gather while the call is open

Engineering teams that expect to respond—or to brief legal and privacy colleagues—should collect concrete artefacts, not only opinions. For data security: how agent tools reach personal data, which sandboxes and gateways sit in the path, and how prompt or tool contents are redacted before they leave the organisation. For transparency: what users and staff are told when an agent acts on their data. For accountability: who can approve high-risk tool calls, how those approvals are recorded, and how long records are kept.

Automated decision-making (ADM) sections will matter where agents change access, pricing, hiring or customer outcomes without a meaningful human in the loop. Even coding agents can touch ADM when they open production access or alter customer-facing systems. Map those paths early.

The ICO's parallel enquiries into agent testing incidents are ongoing. Do not treat media summaries as concluded findings against named developers. Do treat the existence of those enquiries as a signal that agent behaviour outside intended systems is already on the regulator's desk.

What it means for engineering and security leaders

Build a cross-functional pack in six weeks. Security, privacy, platform and legal need the same inventory of agents, data flows and logs.

Separate developer agents from customer-facing agents in the narrative. Both can process personal data; the risk stories differ.

Document ongoing ICO enquiries as context, not as guilt. If your vendors are named, ask them for their current safeguard posture—without treating press reports as adjudicated facts.

Use the call to force decisions you already postponed. Content capture defaults, retention, and whether agents may leave the corporate network are consultation-shaped questions.

Cross-link to existing UK and EU threads

This call sits beside earlier UK and EU work on AI and ADM. Use your existing EU AI Act and NIST agent security notes as starting inventories, then add agent-specific evidence the ICO asks for. Privacy choices about whether telemetry captures prompt content (AI telemetry content capture) will appear in data-security and transparency answers.

Practical takeaways for this week

• Diary 20 November 2026 as the response deadline; assign a single drafting owner.
• Inventory agents that can use tools, browse, or call external APIs with personal or employee data.
• For each agent, note security controls, logging, human approval points and lawful basis notes.
• Decide whether your organisation will submit; if not, still complete the internal inventory.
• Ask foundation-model and coding-tool vendors for written updates against the ICO's foundation-model commitments where relevant.
• Align telemetry content capture settings with privacy policy before anyone screenshots a dashboard for evidence.

Where SpanDock fits

SpanDock keeps telemetry on your machines unless you add a destination; the website does not receive prompts or code (privacy). On Enterprise (and in the trial), guardrails match prompts and tool calls on the computer itself so text is not sent away to be checked. On Premium and Enterprise (and in the trial), the MCP gateway records connector calls with credentials held on the server. Those facts help when answering security and accountability questions; they are not a substitute for legal advice on the consultation.