The UK Information Commissioner's Office on October 8, 2026 opened a call for evidence on agentic AI, a 37-page document that sets out how the regulator currently reads data protection law for AI agents across six themes - data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing - and asks developers, deployers and legal and technical experts to show how they are handling each one. Responses are accepted until the end of November 20, 2026.

In Short

The UK's data protection regulator wrote down what it thinks the law already requires when AI agents handle people's personal information, and asked companies to send in evidence on how they actually cope. It matters for anyone building or using agents that book, buy, search or share data on someone's behalf, because the ICO says the answers will shape its guidance and a statutory code on AI and automated decisions. Nothing becomes binding through this document, but it shows where the regulator is likely to draw lines on agent permissions, logging, controllership and lawful basis.

What the ICO published, and when

The document is titled "The ICO's call for evidence on agentic AI" and carries the version stamp "1.0.13 | 8 October 2026" on every page. The ICO's consultation page dates the publication to the same day, October 8, and says responses will be taken until the end of November 20, 2026, through the regulator's Citizen Space portal. Responses received after that date may not be considered, according to the page.

The PDF itself contains no closing date. That matters for how the deadline circulated. A LinkedIn post by Alvin Antony, who describes himself as a techno-legal professional working on AI governance, IP and data protection, gave the November 20 date and summarised the six themes, attaching the 37-page document. The post is a personal summary that ends "P.S. This is for academic discussion only", and it is not an ICO statement. The date it gives does match the ICO's own consultation page.

The structure is consistent throughout. Each of the six themes is split into "The challenge", "Our expectations" and "Where we are seeking evidence". A set of additional questions on page 30 asks organisations about adoption, barriers and benefits, and two annexes describe the components of an agentic system (Annex A) and define the vocabulary (Annex B). The PDF contains no clickable hyperlinks; the only web address printed in the text points to the ICO's page on "Must, should, could - using this guidance to comply", which explains how the regulator uses those three words to separate legal requirements from good practice.

The ICO frames the exercise around regulatory clarity. "We want to support responsible innovation and provide organisations with greater regulatory clarity," the document states. "To do this, we're seeking evidence to inform our thinking on how to apply data protection law to the distinctive capabilities and risks of agentic AI."

Where the call fits in the ICO's work

The regulator lists four existing pieces of guidance it is building on: AI and data protection, explaining decisions made with AI, generative AI, and foundation models. It also lists four precursors: its input into an internal Digital Regulation Cooperation Forum (DRCF) deep dive on agentic AI in summer 2025, a DRCF call for views, its own Tech Futures report in January 2026, and the DRCF foresight paper in March 2026. PPC Land covered that foresight paper when the CMA, FCA, ICO and Ofcom published "The Future of Agentic AI" on March 31, 2026, with five levels of autonomy and agreement among all four regulators that existing UK rules on transparency, fairness and consumer protection already apply.

The evidence will also "inform our statutory code of practice on AI and automated decision-making (ADM)", according to the document. That is the part with legal weight attached later: a statutory code is something the ICO takes into account when it enforces.

One sentence in the introduction is directly relevant to advertising. "We're also currently exploring the application of agentic AI in the adtech ecosystem and will publish a report on this later this year," the ICO writes. The document does not say what the report will cover. The regulator has a long history with programmatic advertising: PPC Land reported in July 2019 that the ICO had given the industry six months to respond to its real-time bidding report, and in May 2026 the regulator advised the government to relax consent rules for low-risk advertising after a consultation that drew 76 responses.

How the ICO defines an agent

The document's definition is narrow and technical. "An AI agent is a system that is based on large language models (LLMs); has access to tools, memory, an environment (such as a folder on a user's computer or the computer's calendar and clock to know the date and time) and has some level of autonomy in its approach to achieving a task." Any computing system that includes one or more such agents counts as agentic AI, and either a human or another agent can set the task. The ICO's definition sits close to the one in the agentic AI vocabulary that has spread through ad tech since 2025.

What changes, in the ICO's reading, is variability. The same purpose can produce different processing each time. "For example, an agent responding to similar travel requests at different times may access different information sources and disclose personal information to different service providers," the document states. Orchestration, where one agent hands parts of a task to several others running at once, can make processing more efficient, but "it can also allow inaccurate information, inferences or bias to spread quickly through the data-processing chain and affect later decisions or actions."

The ICO lists five principles that an agent's choices may put at risk: data minimisation, purpose limitation, accuracy, fairness and security. It gives one concrete failure: without safeguards, a system "could disclose special category personal information to an unauthorised third party."

Three layers

To describe who does what, the ICO splits the ecosystem into three layers.

The service and integration layer covers how agentic services are built, sold and connected. The document names a commercial example: "Salesforce's Agentforce is one example. It allows organisations to configure AI agents for particular tasks. At the same time, it relies on third-party foundation models, such as Anthropic's Claude." A table lists six participant groups - foundation model developers, agentic AI service providers, organisations obtaining agentic systems, in-house developers and integrators, agentic tool providers, and end users - with their typical activities. The table deliberately does not say who is a controller or processor. Agentic tool providers are defined as "any entity that offers a means (eg through protocols such as Model Context Protocol (MCP) or Agent2Agent (A2A)) for agents to use a tool."

The agentic AI system layer covers the components an agent needs to understand an objective, plan and act. Here the ICO separates subagents, which work for an orchestrating agent and may share its session, from agent teams, which have separate contexts, tools or permissions and can talk to each other and to the user. It also distinguishes local processing, on a device or inside an organisation's controlled environment, from remote processing, which "may disclose personal information to a service provider or other third party."

The AI agent layer covers how individual agents are trained, set up and evaluated. The ICO lists four methods: prompting and in-context learning, agent skills and workflow setup, behaviour cloning and imitation learning, and reinforcement learning. Training data for agents, it notes, may include "text; prompts; user feedback; system logs; clickstreams; screen recordings; or records of actions taken by humans or other agents." Such records "may contain personal information and reveal details about a person's behaviour, routines and preferences." Workflow setup can involve job role descriptions, task histories and reporting lines, which become personal information when a workflow is fitted to particular employees or customers.

The conclusion of that section is that "an agentic AI system may process personal information throughout its lifecycle, from initial development and evaluation to deployment, monitoring and improvement."

Theme 1: Data security

The challenge, as the ICO frames it, is that agents act without approval at every step. An agent "may retrieve information from external sources and update an internal database without requiring explicit approval at each step of the process. This increases the risk that security failures or malicious instructions (such as instructions to delete a record or an entire database) could spread across connected systems and data sources."

The expectations start with a "must": organisations developing or deploying agentic AI must assess the security risks from the system's capabilities, connections and processing, and implement proportionate technical and organisational measures. Then comes a "should" on autonomy. "The level of autonomy given to an agent should be a deliberate and carefully considered design and deployment decision," the document states, supported by guardrails, permissions and approval thresholds.

The ICO lists emerging controls: least-privilege access, scoped permissions, restrictions on tool use, human approval thresholds for high-risk actions, and limits on access to personal and sensitive information. These are standard security practice, the regulator concedes, but agentic systems require them to be applied in new ways.

Agent identity gets particular attention. "Without a clear way to identify when an AI agent is operating, organisations can't determine what guardrails and control settings they need to manage its use appropriately," the document says. A deployer may need to register an agent, tie it to an owner and purpose, and apply access policies. The ICO suggests an agent identity may need to carry more than a traditional software identity: owner and purpose, capabilities and tools, permissions and approval thresholds, deployment context, relationships with other agents, and its current task, session or delegated authority.

That point lands in a market where identification is already a problem. PPC Land reported in January 2026 that a single Grok fetch request triggered 16 requests from 12 IP addresses, none identifying itself as xAI, with traffic rotating through ordinary browser user agents.

The ICO wants evidence on five points:

  • session isolation controls that keep data in a session accessible only to specific parties, such as the user who started it;
  • how organisations decide whether an agent can reach only internal knowledge systems or also third-party databases;
  • whether guardrails and permissions change dynamically;
  • structured logging that records agent identity alongside actions such as data retrieval or database modification, with outcome tracking and tamper-evident records;
  • which provider-built features help security, and where deployers struggle.

The document also notes that some systems restrict which websites an agent can visit, and says the regulator is "interested in understanding how efficient these measures are in practice."

Theme 2: Transparency

The transparency problem is that the inputs and outputs of an agent keep changing. Agents can access information on a device, retrieve data from company systems, take screenshots and call external services, then create files, send emails or make purchases. People may not know what is processed, where it came from, whether it stays on the device, which organisations receive it, whether ADM is involved, or who is responsible. Multi-agent systems compound this: "An organisation may find it difficult to provide meaningful information to people if it can't identify the agents involved or trace how they use and share personal information."

"Organisations must design transparency into agentic AI systems from the beginning," the ICO writes. It lists seven things organisations should document and communicate, from the personal information agents can access and its sources, to the third parties that may receive it and "the decisions and actions agents have authorisation to take."

A single notice up front may not be enough. Where processing changes mid-task, or an agent reaches for a new data source, a new tool or an action with significant consequences, organisations should consider more information or asking the user to approve first. The ICO is explicit that this may slow things down: "This approach may include introducing extra 'friction' into the user experience to ensure users are aware of the novel risks agents pose to their personal information."

For marketers, the most familiar part of this theme is the reference to device storage. Where an agent stores or reads information on a person's device, PECR obligations may apply. "For example, where the use of agentic AI results in the storage of information on or access to information stored on a person's device, organisations must provide clear and comprehensive information about the purposes of that storage or access, in accordance with regulation 6 of the PECR," the document states. Regulation 6 is the cookie rule, the same provision at the centre of the ICO's advice on low-risk advertising earlier this year.

The ICO then lists supply-chain measures with short labels: agent identification, agent authentication, scoped permissions, agent tracing, audit logging, and user controls that let people "review, approve, challenge, correct or reverse actions where appropriate."

Evidence is sought on eight questions, including how organisations tell people whether processing is local or remote, how they give timely notice when an agent opens a new source, uses an external tool or shares data with another agent, and how they use "pre-authorisation, prompts, approval steps, live status indicators" to improve transparency. The ICO also asks how users can set limits on websites, tools and actions, and how post-task summaries and audit trails explain what an agent did and what happened as a result.

Theme 3: Accountability

This theme deals with the controller and processor split, which in agentic systems can shift workflow by workflow. Multiple organisations, models and tools may be involved, which "makes it hard to distinguish between data controllers, joint controllers and data processors."

The document adds six factors that can influence the purposes and means of processing in agentic systems: who decides the agent's goals, what personal information it can reach, which models and tools it can select, which protocols it can use, what permissions it has, and what actions it can take.

The regulator then addresses a position it has heard from developers. "Some agentic AI developers suggest they are controllers only for: the initial development of an agentic AI system; and its maintenance and security-related processing." The ICO does not accept this as a default. "But organisations should interpret the concept of a controller broadly to ensure complete and effective protection for people," it writes. Organisations that determine "or exert sufficient influence over" the purposes and means of processing done through an agentic system can be controllers for it.

The ICO also identifies a shift in what defines the means of processing. In generative AI, the types and sources of training data shape deployment. "In agentic AI, decisions about protocols, permissions and access controls may more heavily influence the means of processing." In other words, the company that decides which MCP servers or tools an agent can reach is making a decision that may carry controller responsibility. The section earlier in the document makes the same point in a more general form: organisations "should not rely only on how they describe themselves (ie as a 'data controller' or 'data processor')."

Evidence is sought on how organisations allocate controller, joint controller and processor roles, how they show that allocation in contracts, which logging and monitoring tools let controllers keep control, and what information developers give deployers, and should give them, to make accountabilities clear.

This question of who answers for an agent's actions is not unique to the UK. Singapore's IMDA published a 36-page discussion paper on legal responsibility for AI agents in May 2026, which mapped civil liability across model developers, tooling providers, platform providers, deployers and end users, though it left data protection to one side.

Theme 4: Automated decision-making

Theme 4 applies the UK GDPR's ADM provisions, articles 22A to 22D, to agents. Those articles replaced the old Article 22 under section 80 of the Data (Use and Access) Act 2025, which PPC Land described in September when Privacy International argued the change shifts the burden onto individuals and asked the UK to ban five AI uses.

The challenge is multi-stage decisions. An agent may make several decisions that together shape a final outcome, and that outcome may combine solely automated, partly automated and human steps. "Nevertheless, human involvement at one stage of a workflow doesn't necessarily mean that the overall decision falls outside the ADM provisions. The key question is whether that involvement is meaningful."

Organisations must assess whether and how the provisions apply "across the complete workflow". The ICO adds: "It's not enough to consider individual agents or decision points in isolation." The reverse also holds. The presence of an agentic system in a decision process "doesn't, by itself, mean that the ADM provisions apply."

Citing its draft guidance on ADM and profiling, the ICO lists five conditions for human involvement to be meaningful. The person shaping the decision should review it at a point where it has actual impact, be able to influence the outcome, have the discretion and authority to change it, have the training to understand the system's logic, outputs, limits and risks, and take into account the data and factors the system used.

Organisations should either justify why the provisions do not apply or put all the required safeguards in place. That means being able to reconstruct what happened when an agent behaves unexpectedly: "which agent was involved; what authority it was operating under; what systems or data it accessed; and whether any human involvement was meaningful." Logging, in this context, should identify which contributing decisions were solely automated and how much automated and human processes each influenced the result.

The ICO draws a distinction that is easy to miss. Genuine oversight before a decision is "distinct from the right to seek human intervention after a solely automated decision. That right forms part of the safeguards applicable to ADM." An appeal route does not turn an automated decision into a human one.

Evidence is sought on how organisations decide whether the provisions apply, how they make human involvement meaningful where they conclude they do not, how they apply safeguards where they do, and how logging, permission setting and interface design support compliance.

The Dutch data protection authority ran a parallel exercise this year. It opened consultation on a 31-page draft guidance on the right to an explanation in automated decisions on April 25, 2026, after a survey found nearly two in five Dutch residents did not know about their right to human intervention.

Theme 5: Fairness and purpose limitation

The fairness section turns on a specific kind of data: the behavioural records produced when people use computers, which may be used to train agents. These can include "the actions people take; the sequences in which they take them; the choices they make; and how they interact with different systems." Depending on content and context, the ICO says, such data "may reveal sensitive personal information about people."

Purpose limitation is tested by agents doing things nobody asked for step by step, and by memory that carries information from one task into the next. "An agent's ability to identify a new use for personal information doesn't mean that the use is automatically compatible with the original purpose for collecting the information," the document states. And: "Agent autonomy doesn't change the fact that an organisation handling personal information continues to have fairness and purpose limitation obligations."

The fairness expectations are unchanged from the ICO's existing AI guidance. Organisations must assess whether people can reasonably expect their information to be used in particular ways and identify adverse effects, weighing data sensitivity, how the data was obtained, the degree of agent autonomy, the consequences and the safeguards available.

The ICO says stakeholders have raised questions about agents autonomously processing information for secondary purposes. Its answer is that reuse is allowed only if compatible with the original purpose or otherwise permitted by law. Research gets a specific warning. Scientific research is deemed compatible with any original purpose under safeguards, "but simply labelling the development, testing or improvement of an agentic AI system as 'research' doesn't automatically mean that the scientific research provisions apply." Processing must meet criteria such as a rigorous methodology and an aim to increase the broader stock of knowledge. "It can't be solely for internal, commercial product development."

Evidence is sought on real compatibility assessments, on guardrails that support fairness and purpose limitation, and on monitoring of agent actions, data access and tool interactions that reduces the risk of agents using information for purposes nobody has assessed or authorised.

Theme 6: Lawful processing

The final theme starts from the observation that one agentic product can involve many processing activities - training or adapting models, interpreting instructions, reading data on a device, retrieving it from other systems and sharing it - each needing a lawful basis. Device access brings PECR into play again, which prohibits storage or access unless an exception applies or the user has consented.

Two positions here are likely to matter most commercially. First, terms of service and user instructions are not a blanket justification. "The existence of a contract with an end user (ie terms of service) or a user's instruction to an agent doesn't automatically provide a lawful basis for all the processing that follows," the document states. The contract basis applies only where processing is "objectively necessary to provide the service requested by the person", and "a lawful basis that applies to one part of that workflow doesn't necessarily apply to every other part."

Second, legitimate interests are available but not presumed. They "may be available as a lawful basis for some agentic AI information processing activities. This applies particularly to training orchestrator LLMs, as outlined in our report on foundation models. But organisations must not assume that this lawful basis applies by default. They may only rely on it if a legitimate interests assessment is in place."

Where consent is used, whether by choice or because PECR requires it, it must be freely given, informed, specific, unambiguous and revocable at any time. The ICO calls this "a high threshold".

Evidence is sought on which lawful bases organisations use for each activity, the difficulties they meet in choosing one, the analysis behind those choices, and how they run legitimate interests assessments for agentic processing, including training or adapting orchestrator models.

The adoption questionnaire

Seven additional questions ask about the market rather than the law. The ICO ties them to its secondary duties to support "responsible innovation and economic growth", and says the answers will help it judge "the potential costs and benefits of any future regulatory interventions."

Question 1 asks organisations to place their current position, and their expected position within 12 months, on a five-step scale from "No current plans for adoption" through "Exploring potential use cases", "Pilot or proof of concept" and "Limited deployment" to "Wide deployment". Question 2 asks respondents to rate seven listed barriers, plus an "Other" option, from "Not a barrier" to "Major barrier", including lack of regulatory certainty over data protection requirements, security concerns, cost of implementation, cost of compliance safeguards, and supplier assurance or due diligence.

Question 3 is the most pointed: "Has your organisation delayed or abandoned plans to deploy agentic AI because of uncertainty relating to data protection requirements?" Question 4 asks how organisations obtain assurance without specific guidance, offering options from DPIAs and DPO review to "Vendor assurances" and "Third-party governance or safeguarding solutions". The remaining questions cover how much uncertainty affects decisions, which data protection difficulties respondents have met, and which benefits - productivity, cost savings, faster delivery, better decisions - they have seen or expect, with a request for evidence or estimates.

The annexes

Annex A lists nine components: tools, tool use, memory, planning or orchestration, user interface, environment, hooks, plugins and protocols. Several entries contain compliance statements rather than definitions. Hooks, which run commands at set stages of an agent's operation, "may support compliance by providing monitoring, access control and audit functions. But they may also process personal information." Plugins "can extend an agent's access to personal information and its ability to take actions", so organisations should assess "their provenance, permissions and data flows before making them available to an agent."

The protocol entry is the most direct. MCP, A2A and payment protocols "can give agents access to a wider range of data and functions," the ICO writes, "but the use of a standard protocol doesn't, by itself, ensure that the resulting data processing is secure or complies with data protection law."

Annex B defines 17 terms, from agent identity to supervised fine-tuning. Its definition of a session includes the meaning of "session isolation": "controls that prevent data associated with one session from being accessed by unauthorised users, agents or other sessions."

Why it matters for advertising

The document never discusses ad campaigns, but much of it describes systems the ad industry is already building. IAB Tech Lab released its Agentic RTB Framework for public comment in November 2025, and PubMatic put AgenticOS into live connected TV and video campaigns in January 2026, with an early campaign run through natural-language input in Claude. Agents that buy media, query audience data or connect to clean rooms through standard protocols are exactly the multi-tool, multi-party workflows the ICO describes.

Three positions in the document stand out for that market. The controllership test focuses on who sets permissions, tools and protocols, not on contract labels. Device access triggers PECR regardless of whether a human or an agent did the reading. And a lawful basis that covers one step of a workflow does not carry over to the next.

There is also the adtech report. The ICO has said it will publish one on agentic AI in advertising "later this year", without a date or scope. The OECD's working paper on agentic AI concepts in February 2026 flagged accountability and transparency as unresolved; the ICO's call is the first UK attempt to attach regulatory expectations to those gaps, and it arrives while Parliament's Joint Committee on Human Rights is waiting on the government's answer to its call for an AI Bill, due around mid-November.

Much of the document repeats obligations that already exist, and the ICO says so. The new elements are narrower: a working definition of an agent, a three-layer map of who does what, a list of controls the regulator expects to see (agent identity, scoped permissions, tamper-evident logging, session isolation), and a firm view that neither autonomy nor a terms-of-service click changes who is responsible.

Timeline

Summary

Who: The UK Information Commissioner's Office, addressing developers and deployers of agentic AI systems as well as legal and technical experts. A LinkedIn summary by Alvin Antony circulated the document and its deadline.

What: A 37-page call for evidence setting out the ICO's current reading of data protection law for AI agents across six themes - data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing - with specific evidence questions under each, a seven-question adoption survey and two technical annexes.

When: Published October 8, 2026 (version 1.0.13). Responses close at the end of November 20, 2026, according to the ICO's consultation page. The ICO also plans a report on agentic AI in adtech later in 2026.

Where: The United Kingdom, under the UK GDPR, the Data (Use and Access) Act 2025 amendments on automated decisions, and the Privacy and Electronic Communications Regulations 2003. Responses go through the ICO's Citizen Space portal.

Why: The ICO says agents process personal data at greater scale and with more variation than earlier AI, which makes compliance harder to ensure and demonstrate. The evidence will feed new guidance and the ICO's statutory code of practice on AI and automated decision-making.