Artificial intelligence | UK Regulatory Outlook October 2026

UK updates

ICO launches call for evidence on agentic AI

The Information Commission's Office (ICO) has launched a call for evidence seeking views to inform its thinking on how to apply data protection law to the distinctive capabilities and risks of agentic AI. The ICO notes that its existing regulatory expectations continue to apply to the processing of personal data within these workflows, but also highlights that agentic AI systems process personal data on a larger scale and in more complex ways than previous generation AI systems based on large language models. The ICO says that this potentially poses data minimisation and security risks in the absence of appropriate safeguards.

The call focuses on targeted areas of compliance where research and stakeholder engagement have raised concerns, and sets out the ICO's current thinking. It covers the themes of data security, transparency, accountability, automated decision-making (ADM), fairness and purpose limitation, and lawfulness of processing, while also welcoming views on other issues that respondents might consider the ICO should prioritise.

The evidence gathered will inform future guidance and the ICO's forthcoming statutory code of practice on AI and automated decision-making, which it is obliged to produce under the Data (Use and Access) Act 2025. The call for evidence closes on 20 November.

In a statement accompanying the call for evidence and its report on AI foundation model development (see below), the ICO also said that it has identified the increasing personalisation of consumer-facing AI services as a priority area for regulatory focus. This includes general-purpose chatbots and chatbots used for role-play and companion purposes. The ICO is conducting public research to understand concerns and is engaging with businesses to ensure these products meet people's needs in a transparent and privacy-focused way.

The ICO is also exploring the application of agentic AI in the adtech ecosystem and intends to publish a report on its findings later this year.

ICO sets out data protection expectation for AI foundation model developers

The ICO has released a report on its work in connection with building trust and transparency into generative AI development, setting out its approach to foundation model development. The regulator’s central message to model developers is that businesses and the public must be able to trust that personal data is being used lawfully and transparently, with effective safeguards. Building that trust means embedding it into model development and AI governance from the start.

The report outlines the relevant data protection challenges in this area (transparency, lawful basis, data subject rights, special category data and clarity on when a model contains personal data) and the ICO's regulatory expectations.

On next steps, the ICO will continue its scrutiny of reliance on legitimate interests, continue to discuss with government the issue of special category data to ensure that data protection law supports responsible AI innovation while protecting people from harmful personal data processing, and address the public's queries and concerns over the increasing personalisation of consumer facing AI services.

House of Commons committee launches inquiry into AI adoption, safety and governance

The House of Commons Business, Innovation, Science and Trade Committee has launched a "long-term thematic inquiry" to examine how the UK can support AI adoption while protecting the public and national security.

The inquiry aims to investigate, among other things, the allocation of responsibility for AI-related harm between developers, deployers and users, whether standard consumer and business contracts provide meaningful remedies when safeguards fail and whether the law requires clarification or reform.

The inquiry will also examine whether industry commitments and self-regulation provide adequate protection and whether statutory duties, standards or powers in certain areas are needed.

The role and powers of the AI Security Institute (AISI) also come under scrutiny, including whether it should have a statutory basis and how responsibility for investigation, intervention, enforcement and democratic accountability should be divided between the AISI, government and sector regulators.

Joint committee calls for risk-based AI legislation with human rights safeguards

The Joint Committee on Human Rights, in a report published as part of its inquiry into human rights and the regulation of AI, has called for a dedicated AI bill.

The bill recommended by the committee would take a risk-based approach to addressing AI harms, imposing proportionately more demanding obligations on higher-risk AI systems and models. The committee says that legislation should not place "unjustified burdens" on businesses, and should enable UK companies to innovate and take advantage of the benefits AI can offer.

The committee also recommends prohibiting the use of AI in ways that are inconsistent with human rights, such as the use of subliminal techniques, emotional inference or the inappropriate use of profiling or biometric data. AI systems posing a high risk of harm to human rights should be required to obtain prior approval before they can be provided or deployed.

It further recommends that legislation place requirements on businesses at all stages of the supply chain to undertake the due diligence necessary to prevent unacceptable risks to human rights when designing, developing or deploying AI systems. This would be alongside mandatory transparency requirements on all those involved in the AI lifecycle. AI systems that can have significant impacts on individuals, groups and communities would, for example, be obliged to state when they are being used, what they are being used for, and to provide information about the AI system's data sources.

The committee also calls on the government to establish an independent AI oversight body on a statutory footing, either by creating a new body or by expanding the powers of an existing one.

ICO chief executive explores privacy and transparency challenges posed by smart glasses

See the data law section.

EU updates

European Commission consults on copyright and AI

The European Commission has launched a consultation on copyright and AI, seeking feedback on issues and challenges relating to the use of copyright-protected content in the context of AI; research; the fight against online piracy of content, including in connection with live events; and the use in the EU of sound recordings of music producers and performers from outside the EU.

The Commission aims to assess whether future measures are needed and gather views on possible policy options. The consultation closes on 3 November.

European Data Protection Board publishes statement on smart glasses

See the data law section.