UK privacy watchdog pushes AI developers to rein in agents, paving way for binding code of practice

The UK’s Information Commissioner’s Office (ICO) signalled a tougher line on AI developers on October 8, 2026, announcing it has secured concrete changes from several major firms building chatbots and autonomous AI agents. These systems, which can act continuously on a user’s behalf, often rely on extensive logging and personal data to function—raising sharp questions about privacy, transparency and accountability.

According to the regulator, companies have agreed to clarify how training data and usage logs are collected, how long they are kept and for what specific purposes they are used. The ICO stresses that when AI systems make or support automated decisions about people, individuals must be able to understand the logic and criteria behind those outcomes, not just receive a generic explanation.

The announcement also previews a forthcoming statutory code of practice on AI and automated decision‑making. Unlike high‑level principles, this code is expected to set binding rules and give the ICO a stronger basis for enforcement, including fines. The UK has already created a dedicated supervision programme for powerful foundation models, positioning itself as a jurisdiction that seeks flexible, sector‑based oversight rather than a single omnibus AI law like the EU’s. For AI builders, the message is clear: privacy‑by‑design and explainability need to be integrated into agent architectures from the outset.