The Information Commissioner's Office published its report on generative AI development on 8 October 2026, reporting the outcome of its supervisory engagement with the largest foundation model developers operating in the United Kingdom. The report states a settled regulatory position and records progress against commitments the ICO is monitoring, rather than opening a draft to consultation. Alongside it the ICO launched a six-week call for evidence on agentic AI, open for responses until 20 November 2026.
The ICO assessed the ten developers against United Kingdom data protection law, principally the UK General Data Protection Regulation and the Data Protection Act 2018. The report sets out the ICO position on when special category data may lawfully be used in model development, and on whether foundation models may themselves contain personal data. The ICO records that current training practices create technical challenges for compliance with that legislation, and that it has raised those challenges with Government. The report announces no new statutory obligations, and the ICO states that it is monitoring progress against the commitments it obtained.
Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI have each made or committed to make changes, covering clearer transparency information, stronger mechanisms for people to exercise their rights, and tougher safeguard assessments. The ICO paused its engagement with X.AI after opening a formal investigation into its Grok system, and that investigation is ongoing. The ICO has also made enquiries of OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing and deployment, and those enquiries are ongoing. Developers placing models into the United Kingdom market should expect the positions in the report to shape how the ICO reads their transparency notices and rights-handling processes.
The call for evidence runs for six weeks and closes on 20 November 2026. It covers security, transparency, accountability, automated decision-making, fairness and lawful data use in agentic AI. Model developers, deployers and enterprise buyers of agent products have until that date to put their positions to the regulator. The ICO has not resolved whether foundation models contain personal data as a general matter, and has put the compliance difficulty of current training practices to Government rather than settling it by guidance.
Licentium advises model developers, deployers and enterprise buyers on United Kingdom data protection obligations attaching to generative and agentic AI. Work we undertake includes reviewing transparency information and data subject rights processes against the positions in the ICO report, assessing lawful bases for special category data in training sets, preparing responses to the agentic AI call for evidence before 20 November 2026, and advising on readiness for ICO enquiries.