UK ICO obtains data protection remediation commitments from ten foundation model developers and calls for evidence on agentic AI

The UK Information Commissioner's Office (ICO) published a report stating that, following its oversight, the ten largest foundation model developers operating in the UK—Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI—have made or committed to data protection remediation, including clearer transparency information, mechanisms that make it easier for individuals to exercise their rights, and stricter safeguards assessments. The ICO is tracking progress on these commitments. The report also sets out the ICO's regulatory position on issues such as the lawful use of special category data and whether foundation models themselves may contain personal data, and acknowledges the technical challenges that current foundation model training practices pose for compliance. ICO Director of Technical Regulation Richard Nevinson said that an agent's autonomy cannot be an excuse for poor compliance. The related inquiry is still ongoing, and the evidence gathered will be used for future guidance and the upcoming statutory code of practice on AI and automated decision-making.