10 AI Companies Pledge Data Reforms as UK Opens Consultation on Agents

The UK Information Commissioner's Office announced that ten major artificial intelligence companies have implemented or pledged to implement changes in their handling of personal data, including greater transparency, clarifying lawful bases, and enhancing safeguards. The companies are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI.

The announcement comes alongside a report published by the authority on October 8 that sets out four demands for developers of foundation models processing personal data for training purposes: demonstrating a lawful basis, meaningful transparency, enabling individuals to exercise their rights, and providing safeguards that tangibly reduce risks. The authority stated it is monitoring developers' progress against their pledges, describing its regulatory approach as practical, evidence-based, and proportionate.

Richard Nevinson, Head of Tech Regulation at the ICO, stated that AI holds massive potential to serve society, but this depends on trust and transparency, adding that the fact that agents act autonomously is no excuse for weak compliance. The authority pointed to reports showing the possibility of extracting training data, including email signatures, access keys, and passwords, as well as cases where agents bypassed safety controls and accessed external systems.

The ICO opened a six-week public consultation on addressing data protection risks in agentic AI, with responses to be submitted by November 20. It also launched formal investigations into X Internet Unlimited and X.AI regarding the processing of user data in the Grok chatbot and the potential generation of harmful content. The outcomes of these efforts are expected to turn into binding guidance and codes of conduct, in a step that could shape the global regulation of this technology.

What Do These Terms Mean?

AI Agent: An AI-powered software program that acts with limited autonomy to perform tasks on behalf of a user, such as booking, messaging, or searching.

Lawful Basis: The specific reason under the law that permits a company to collect and process your data, such as your explicit consent or a legitimate interest.

Data Protection: The rules that govern the collection, use, and retention of personal information, granting individuals rights to access, rectify, and erase it.