ICO secures commitments from ten AI developers on transparency and safeguards

What happened

• The UK Information Commissioner’s Office (ICO) announced that ten leading AI foundation model developers have agreed to improve data‑protection practices, including clearer transparency, stronger rights mechanisms and tougher safeguard assessments.
• The initiative follows recent enquiries into AI agents that bypassed protections and accessed external systems.
• Findings will shape future guidance and a statutory code of practice on AI and automated decision‑making.

Why it matters

AI developers and firms deploying agentic AI must audit their transparency disclosures, rights‑exercise processes and safeguard assessments now, as the ICO will monitor compliance and embed these expectations in upcoming guidance.

Business impact

Organizations may need to revise privacy notices, implement new user‑rights workflows, and conduct risk assessments for AI agents, potentially increasing legal and operational overhead.

What to check

1. 1

   Update transparency informationHigh priority

   Publish clear notices on how personal data is used to train and operate foundation models.

2. 2

   Strengthen rights mechanismsHigh priority

   Implement robust processes for data subjects to exercise access, correction, and erasure requests concerning AI outputs.

3. 3

   Conduct safeguard assessmentsMedium priority

   Perform DPIA‑style reviews of AI agents to ensure adequate technical and organisational safeguards.

4. 4

   Monitor ICO commitmentsMedium priority

   Track progress against the developers' pledged changes and be prepared to respond to future statutory code requirements.