The ICO Agentic AI Call For Evidence: Register Every Agent To An Owner Before The Statutory Code Arrives

On 8 October 2026 the UK Information Commissioner opened a call for evidence on agentic AI, meaning software that plans and takes actions on its own across tools, systems and other agents. It closes at the end of 20 November 2026, and the regulator has said it may not consider late responses. The call has eight sections and around 45 questions, and it is addressed to developers and deployers alike, as well as legal and technical experts. What makes it worth reading even if you never respond is that each section states the current thinking of the regulator before asking its questions. The evidence will feed future guidance and the statutory code of practice on AI and automated decision making, so today is a preview of what UK organisations will later be measured against.

The call arrived alongside an announcement that the ICO had secured changes from several foundation model developers and had made enquiries with developers and their testing partners about reported agent testing incidents, which it says are ongoing. That context explains the tone. In the words of its Director of Technology Regulation, as reported by Freshfields, "the fact AI agents act with autonomy is not an excuse for poor compliance." Nothing in the call creates a new legal duty. The UK GDPR and PECR already apply to an agent that touches personal data, and the call is the regulator explaining how it reads those existing rules when the thing doing the processing makes its own choices about which tools to call and which data to use.

The security theme is the most concrete. The ICO expects the level of autonomy given to an agent to be a deliberate design choice, backed by guardrails, permissions and approval thresholds in proportion to what the agent can do with personal data. It names least privilege access, limits on tool use and human approval for high risk actions as emerging good practice, and it introduces the idea of agent ownership: each agent registered to a named owner, with a set purpose and a set of permissions and capabilities. It also expects organisations to have a clear way to tell when an agent, rather than a person, is operating. For most teams that means agents need their own identities in the identity provider, not a shared service account or a borrowed human login, which is the same point we made about Microsoft Copilot agents and Entra earlier this month.

On transparency, the ICO questions whether a general explanation given before a workflow starts is enough, because an agent may pull data from a device, internal systems, screenshots or external tools and then pass it to other agents or third parties, and the sources and recipients can change every time it runs. The regulator accepts that prompts, notifications and approval steps during the workflow add friction, and suggests that friction may be necessary. On accountability, it asks organisations to interpret the concept of a controller broadly, and it notes that whoever decides the protocols, permissions and access controls an agent runs under may be determining the means of processing. A company that configures a third party agent platform, chooses its tools and grants it access to a CRM should not assume the vendor carries the controller role on its own.

The automated decision making theme is where agent builders are most likely to be caught out. The ICO says the UK GDPR provisions on solely automated decisions with significant effects must be assessed across the whole agentic workflow, not decision by decision, and that human input at one point in a chain of machine steps is not necessarily meaningful human involvement. An agent that screens applicants, drafts a rejection and sends it after a person glanced at a summary three steps earlier may still be making a solely automated decision. The purpose limitation theme adds that an agent spotting a new use for personal data does not make that use compatible with the original purpose. And on lawful basis, neither the terms of service nor a user instruction to an agent covers every processing step that follows; different stages may need different bases, legitimate interests needs a written assessment, and PECR consent may apply where an agent reads or stores information on a user device.

Read together, the six themes come down to one capability: being able to show which agent did something, under what authority, and with which data. That is an evidence problem as much as a legal one, and it maps neatly onto controls many teams already run. ISO 42001 expects an AI system inventory, impact assessment and defined roles. ISO 27001 Annex A covers identity management, access rights, privileged access and logging. SOC 2 expects logical access and change management controls that apply equally to a non human identity. If your evidence lives in Vanta, Drata, Secureframe, Sprinto, Thoropass or Hyperproof, the quickest win is to add agents as a distinct asset type with an owner, purpose, permission scope and log source, so that the same access reviews and offboarding tasks that apply to staff also apply to agents.

A practical list for the next four weeks. Map each agentic workflow from start to finish, including every data source, tool and recipient, and attach it to your record of processing. Keep a register of agents with a named owner, purpose and permissions for each, and give each its own identity. Check that logs are detailed enough to reconstruct what an agent did and where a person intervened, and keep them long enough to answer a subject access request or a complaint. Revisit your controller and processor analysis for every agent platform you use, including Claude, ChatGPT, Microsoft Copilot and coding agents such as Cursor and Devin. Update DPIAs so lawful basis and purpose are tested at each stage of the workflow, not once at the start, and record where solely automated decisions with significant effects could occur.

Whether to respond is a separate decision. If you build agent products for UK customers, or run agents on UK personal data at any scale, the call is a low cost way to tell the regulator where its expectations would be unworkable, and the questions on transparency friction and controller roles are where industry evidence is thinnest. A response does not need to answer all 45 questions, and you can submit through the ICO Citizen Space portal or by email to the address listed on the consultation page. Keep a copy of what you send, because it becomes a record of your own stated practices that a regulator could later compare with what you actually do.

Our view is that the call is more useful than most consultations because it states expectations plainly rather than only asking questions. None of it should surprise a team that already runs ISO 27001 access controls and an ISO 42001 inventory, but most of those programmes were designed around people and models, not around software that acts on its own and changes its data flows each run. The agent owner register is the single change that makes the rest possible. Build it now, while the code of practice is still being written, and the eventual guidance becomes a gap check rather than a rebuild.