UK Information Commission opens call for evidence on agentic AI

The IC has opened a formal call for evidence on agentic AI, seeking input from developers, deployers and other stakeholders on how organisations are managing the data protection risks the development of agentic AI systems creates. The responses will feed into the IC's forthcoming statutory code of practice on AI and automated decision-making (ADM) and its wider corporate strategy priority of promoting trust and transparency in AI.

This is a pre-guidance, evidence-gathering exercise rather than a statement of settled regulatory guidance but it signals clearly where the IC expects compliance gaps to emerge, and organisations building or deploying agentic AI should treat its "challenge" and "expectations" framing as a strong steer on future IC enforcement priorities.

How does the IC frame "agentic AI?

The IC defines an AI agent as an LLM-based system with access to tools, memory and an environment, and some level of autonomy in achieving a task. An agentic AI system is any computing system incorporating one or more such agents. Compared with earlier generative AI deployments, agentic systems process personal information at greater scale and complexity. Agents may select tools, access multiple data sources, disclose personal information to third parties, and take further action without step-by-step human approval. The IC warns that multi-agent "orchestration" can spread inaccurate information, bias or errors quickly through a processing chain, and can make it harder for organisations to track what data was used, why, and where it went and this undermines their ability to demonstrate compliance.

The IC maps the emerging ecosystem across three layers:

• service/integration
• the agentic AI system
• the individual AI agent

The IC states that accountability boundaries between these layers are not always clear and organisations must assess their actual role based on the decisions they make, not how they label themselves (i.e. as controller/processor).

The six themes and the IC's expectations

Theme 1 - Data security.

Because agents can act with high autonomy (e.g. updating a database without step-by-step approval), security failures or malicious instructions can propagate across connected systems. The IC states that organisations must assess risks specific to the system's capabilities and connections and implement proportionate technical and organisational measures. The level of agent autonomy should be a deliberate design decision backed by guardrails (e.g. least-privilege access, scoped permissions, tool-use restrictions, human approval thresholds for high-risk actions) and deployers of agentic systems may need to register and assign an owner / purpose to each agent to apply appropriate access policies.

Theme 2 - Transparency in complex supply chains.

Because data sources, tools and recipients of output can change every time an agent runs a task, it can be hard for people to know what information is used, where it goes, and who is responsible, a problem magnified in multi-agent workflows. Organisations must design transparency in from the start, documenting what data agents can access, for what purposes, and who receives it. A single, general explanation given before a task starts may not be sufficient where processing changes mid-task, and additional notices or approval steps may be needed before higher-risk actions are undertaken. Where an agent accesses or stores information on a person's device the specific rules on access and storage technologies (PECR Regulation 6 – the cookies rules) may separately apply. Supply-chain measures organisations should consider include agent identification, agent authentication, scoped permissions, agent tracing, audit logging and user controls to review / reverse actions.

Theme 3 - Accountability.

Multiple organisations, models, agents and tools can be involved in a single workflow, making it hard to identify who determines the purpose and means of each processing activity and to distinguish controllers from processors. The IC rejects the position (taken by some developers) that they are controllers only for initial development and maintenance / security processing. The IC’s view is that organisations exerting sufficient influence over the purposes or means of processing via an agentic system can be controllers for that processing, and the concept should be interpreted broadly. In agentic AI, decisions about protocols, permissions and access controls may more heavily drive the "means" analysis than in generative AI generally.

Theme 4 - Automated decision-making (ADM).

Because agents can make multiple decisions across a workflow with little or no meaningful human involvement, agentic systems may (depending on the nature of the decision taken) trigger the application of the UK GDPR's ADM provisions. In order for the ADM provisions to be avoided there must be meaningful human involvement and human involvement at just one stage of a multi-stage process does not automatically take the overall decision outside scope of the ADM rules. Organisations must assess the complete workflow, not individual agents or decision points in isolation, and apply the ICO's draft ADM guidance test for "meaningful" human involvement (ability to actually influence and change the outcome, with suitable training to understand the system). The IC states that organisations should be able to reconstruct the decision-making process after the fact: which agent acted, under what authority, on what data, and whether human involvement was genuinely meaningful.

Theme 5 - Fairness and purpose limitation.

Agentic systems can draw on detailed behavioural data (actions, sequences, choices) that may reveal sensitive information and lead to uses people would not reasonably expect. Agent autonomy does not relax fairness or purpose-limitation obligations. An agent's own ability to identify a new use for data doesn't make that use automatically compatible with the original collection purpose. Labelling agent development, testing or improvement activity as "research" does not automatically unlock the compatible-further-processing exemption It must meet the specific scientific-research criteria and cannot be solely internal commercial product development.

Theme 6 - Lawful basis.

Dynamic tool / data-source selection makes it harder to provide transparent information, assess reasonable expectations, and pin down a lawful basis for each processing activity, and a lawful basis valid for one stage of a workflow will not necessarily cover every other stage. A contract with the end user or a user instruction to an agent does not automatically supply a lawful basis for everything that follows under the performance of a contract lawful basis. That lawful basis only covers processing objectively necessary to deliver the requested service. Where consent is used, it must meet the GDPR requirements for consent. It must be freely given, informed, specific, unambiguous and capable of being withdrawn. Legitimate interests may be available for some agentic processing, including training orchestrator LLMs, but organisations must not assume it applies by default and a legitimate interests assessment must be in place that meets the IC guidance requirements on LIAs.

Economic and adoption questions

Beyond the six compliance themes, the IC is also gathering evidence on organisations' current and planned agentic AI adoption, expected benefits, and barriers or costs faced. The IC is interested to know whether data protection uncertainty has caused organisations to delay or abandon agentic AI deployment plans.

Practical implications for clients

• This is a consultation, not settled guidance but the themes identified will likely shape the forthcoming statutory AI/ADM code of practice.
• Governance teams assessing agentic tools / workflows should map which organisation in the chain is exercising real decision-making power over purposes/means of data processing (Theme 3); whether multi-stage agent decisions could trigger ADM safeguards even where individual steps look human-supervised (Theme 4); and whether lawful basis analysis has been done for each processing stage rather than once for the whole workflow (Theme 6).
• Security and engineering teams should review whether agent autonomy levels were a deliberate, documented design decision with proportionate guardrails (least-privilege access, approval thresholds, audit logging) rather than a default configuration (Theme 1).
• Privacy compliance teams should assess whether existing notices anticipate dynamic, mid-task changes in data sources or recipients, and whether higher-risk agent actions warrant additional notice or approval mechanisms rather than a single upfront disclosure (Theme 2). Use of device-level access / storage technology should also be checked against PECR / ePrivacy Directive consent requirements.
• Privacy / public policy teams: the call for evidence includes structured questions on adoption, barriers and lawful basis practice. Organisations deploying or planning to deploy agentic systems have an opportunity to shape the resulting guidance and should consider contributing, particularly where they have concrete examples of compliance challenges or effective safeguards.