On 8 October 2026 the UK Information Commission (ICO) opened a call for evidence on the application of existing UK data protection laws to “agentic AI” systems [The ICO’s call for evidence on agentic AI | ICO]. This call for evidence will remain open for receipt of submissions until 20 November 2026.
This latest announcement forms part of the ICO’s wider focus on AI governance and signals that agentic AI represents another major area of its focus with a report exploring the application of agentic AI specifically in the adtech ecosystem expected later this year [https://www.linkedin.com/posts/information-commissioner%27s-office_every-time-an-ad-is-delivered-a-complex-activity-7465070783212687362-WWTU?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJRar4BQ-R16wOqceUsZ7UYI74kdmvnWb8].
What is agentic AI?
In simple terms agentic AI is generally considered to be an AI system that can act independently, and with limited supervision, to accomplish a specific goal rather than a chatbot or other AI service that merely answers questions.
For the purposes of this call for evidence the ICO has adopted a more nuanced definition (including in comparison to previous ICO definitions) which defines agentic AI as any computer system comprised of one or more (AI) agents being:
An LLM-based system that has access to tools, memory and an environment and has some level of autonomy in using these to complete a task. The agent’s goals depend on the context. The user or the person the information is about can specify these goals. They may also be intermediate, self-defined objectives intended to achieve an overarching goal”.
However, when deciding whether it would be beneficial to respond to this call for evidence we would suggest that respondents do not focus too much on whether their own use or potential use of agentic AI would exactly match this latest definition.
However, it is defined, in the data protection world agentic AI raises novel compliance questions which in the UK and many other jurisdictions are not always easily answered under current law or guidance. For example, fundamental questions that are raised in the context of agentic AI use of personal data include:
- how controllers can ensure that their agentic systems comply with their GDPR obligations to ensure personal data is processed fairly, lawfully and in accordance with the purpose limitation requirements when they may have no meaningful and real control over the agentic system’s collection and use of personal data as it goes about its tasks;
- how controllers can provide appropriate transparency about their data processing or ensure they have lawful grounds for their processing activities, when they cannot necessarily know how an agentic system will collect, use or transfer personal data, or what types of personal data the system may use, to achieve its goals; and
- how organisations can ensure they implement appropriate technical and organisational security measures when they may not be able effectively to anticipate or control whether agents retrieve information (and potentially malicious prompts or code) from external sources or update internal systems and databases.
Scope of call for evidence
The ICO is now seeking evidence to help inform its future guidance on how existing UK data protection laws apply to the capabilities (and risks) of agentic AI by reference to the following data protection challenges:
- data security;
- transparency;
- accountability;
- automated decision-making;
- fairness and purpose limitation; and
- the lawfulness of processing personal data.
Specifically, the ICO it is seeking evidence on:
- how organisations’ use or development of agentic AI tools interacts with these data protection challenges;
- how organisations are currently addressing those challenges; and
- what further guidance and support organisations want from the ICO.
The call for evidence uses 45 separate questions (some open, some answered by reference to multiple choice answers with answering all not mandatory) to elicit this information.
Who should respond/why respond?
The ICO’s call for evidence is addressed to anyone who “wants to harness the benefits of agentic AI while complying with data protection law” with the ICO going on to note that responses to this call for evidence will help it identify areas where organisations would benefit from greater regulatory clarity or practical support before final guidance is published.
Evidence collected will also be used by the ICO to inform its future statutory code of practice on AI and automated decision making.
As the ICO notes in its announcement, for many organisations, agentic AI is moving rapidly from theory to deployment. Whether used internally, embedded within products and services or supplied by third-party providers, these systems can make decisions, interact with external systems and process personal (and other) data in ways that, as already noted, raise novel compliance questions which both in the UK and further afield are not always easily answered under current law or guidance.
Any future guidance from the ICO is likely to influence regulatory expectations around the design, deployment and governance of agentic AI in the UK. This call for evidence means that organisations that are actively developing, deploying or evaluating these technologies now have an opportunity to explain where existing legal requirements are difficult to apply in practice and where further guidance and clarity would be most valuable.
As such, it is obvious which organisations are likely to stand the most benefit from responding to this call for evidence, it is those who:
- develop or provide AI agents;
- deploy agentic AI within business processes;
- use AI systems that can access third-party tools, websites or data sources;
- are grappling with questions around transparency, accountability or automated decision-making; or
- have experienced practical challenges in applying existing data protection requirements to agentic systems.
Next steps
This call for evidence will remain open for receipt of submissions until 20 November 2026. Responses can be provided via the ICO’s online form [Agentic AI Call For Evidence – Information Commissioner’s Office – Citizen Space].
In addition to top-tier data privacy and technology teams, Squire Patton Boggs has a leading public policy practice which assists clients in responding to consultations and calls for evidence such as this. For more information contact David Naylor or Simon Jones.
