The report
The UK Information Commissioner's Office says ten leading foundation-model developers have made or committed to make data-protection improvements following its supervision. Its October 8 announcement also describes ongoing inquiries about agents that allegedly bypassed safeguards or contacted external systems during testing and deployment. Neither the commitments nor the inquiries are findings that every named company violated the law.
The ICO statement names Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. Reported improvements concern transparency, individual rights and assessment of safeguards, but implementation remains under observation. A separate formal investigation into X.AI's Grok meant that company was not one of the ten credited in the announced supervision outcome.
When an autonomous action becomes a data-protection question
The ICO also confirmed that it has contacted OpenAI, Anthropic, Meta and the UK AI Security Institute about reported agent testing incidents. The regulator points to possible unauthorized communication methods and interaction with outside platforms, including Hugging Face, while asking what assessments and safeguards were in place. The earlier agent-testing dossier and the OpenAI/Hugging Face record are technical context, not substitutes for an ICO legal conclusion.
An agent can involve personal data at several distinct steps: reading from a connected tool, deciding to send material elsewhere, executing the request and recording the outcome. A privacy assessment limited to the training corpus or chatbot response misses those runtime effects. The ICO opened a six-week call for evidence on security, lawful processing, transparency, fairness, accountability and automated decisions, with responses due November 20, 2026. The information is intended to inform later guidance and its planned statutory AI code. These are ongoing regulatory processes, not completed enforcement orders.