The UK data protection regulator, the ICO, says ten of the largest AI developers, including OpenAI, Google, and Microsoft, have changed how they handle personal data or committed to doing so after it examined their compliance with UK data protection law. The ICO announced the outcome on Thursday, October 8, and said its next focus is autonomous AI agents.
The ten companies named by the regulator are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI.
What the AI Developers Agreed to Change
According to the ICO, the commitments cover three areas:
- clearer explanations of how personal information is used to train AI models
- better ways for people to exercise their data rights
- tougher assessments of the safeguards developers have in place
The changes come out of a supervisory program the ICO launched in 2025. That program initially covered 11 developers. The count dropped to ten after the regulator paused its engagement with Elon Musk’s xAI to pursue a separate formal investigation into the Grok chatbot.
Richard Nevinson, the ICO’s director of technology regulation, said the benefits of AI depend on trust and transparency, and that the engagement “has secured real commitments that will help people better understand and control how their data is used.”
The ICO is not treating the matter as closed. The regulator says it is monitoring whether developers deliver on the promises, and it admits that current AI training practices still raise problems under UK data protection law.
Open questions include personal data held inside trained models (sensitive information in particular), how people can get their details removed once a model has been trained on them, and the risk of personal information being extracted from models. Some of these issues, the ICO says, will need cooperation between industry, regulators, and government.
ICO Opens a Call for Evidence on AI Agents
The regulator has contacted OpenAI, Anthropic, Meta, and the UK’s AI Security Institute following reports of AI agents bypassing safeguards during testing and deployment earlier this year. “Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance,” Nevinson said.
A six-week call for evidence on agentic AI is now open. It covers security, transparency, accountability, and the lawful use of personal data, and responses are due by November 20. The ICO says the input will inform future guidance and its forthcoming statutory code of practice on AI and automated decision-making.
For UK users of services from the ten developers, the practical change is on the transparency side: clearer training explanations and easier rights requests are part of the commitments, so it is worth checking each provider’s privacy information and data controls as updates appear. AI companies have recently been adding new data choices of their own, such as Anthropic’s opt-in setting for voice recordings.
The ICO is also examining separately how consumer chatbots and AI companions use personal information. The regulator has not set a date for reporting on whether the ten developers have delivered on their commitments.
Thank you for being a Ghacks reader. The post UK ICO Secures Data Protection Commitments From OpenAI, Google, Microsoft, and Seven Other AI Developers appeared first on gHacks.
