UK ICO launches report, unveils plans to foster responsible agentic AI

The UK Information Commissioner’s Office is concerned about the data protection challenges presented by AI agents as they become part of people’s daily lives.

A new Tech Futures report from the ICO lays out those concerns over the course of 68 pages, reviews how agentic AI is likely to be used, and identifies opportunities for innovation.

The ICO foresees a world in which “our own personal AI agents could be paying for goods, booking flights and helping with household finances,” in the words of Executive Director of Regulatory Risk and Innovation William Malcolm.

“These systems can handle vast amounts of personal information, so both developers and adopting organisations must ensure transparency, security, and compliance is built in from the start.”

This is where opportunities for innovation come in. Realizing the benefits of agentic AI will require the tech industry to provide tools, the ICO notes. “These tools could include tools for monitoring, auditing, explainability, permission structures, authentication and data access protocols,” according to the report.

The new report is a step towards fulfilling the objectives set out in the ICO’s “Preventing harm, promoting trust: our AI and biometrics strategy” in June, the regulator says.

That strategy also includes an update to the ICOs guidance on AI and data protection, which is unchanged since March of 2023.

Meanwhile, the potential and risk related to AI agents have become watercooler topics. Juniper expects more than 10 times as many interactions automated with AI agents in 2027 as there were in 2025. SecureAuth’s Jospeh Dhanapal wrote about how traditional IAM is not the answer in a guest post last month and authID’s Jeff Schiedel discussed how to bring trust to agentic AI in a recent episode of the Biometric Update Podcast.

The number of CIOs blocking giving AI agents meaningful autonomy dropped from 98.3 percent to 63.3 percent from August to November of 2025, according to a survey of large American firms by PYMNTS.

“While the potential benefits could be transformational, the public needs assurances their personal information is secure and well managed before placing their trust in agentic systems,” Malcolm writes in the ICO’s announcement.

“Strong data protection foundations can help build that public trust and can help scale the fast and safe adoption of AI. Throughout 2026 the ICO will actively monitor advancements and work with AI developers and deployers to ensure they are clear on what the law requires of them.”

The ICO also recently published draft guidance on automated decision making (ADM), and will hold a consultation on the draft this year.

Article Topics

AI agents  |  biometrics  |  data protection  |  digital identity  |  digital trust  |  identity access management (IAM)  |  Information Commissioner’s Office (ICO)