UK ICO: ten foundation model developers change data protection practices, DeepSeek included and xAI out amid probe; agents are next

Why it matters

【Key points】

The UK Information Commissioner's Office said on Oct 8 that after a two-year supervision program, ten foundation model developers operating in the UK have made or committed to data protection changes: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. Changes include clearer information on how personal data is used in training, better routes to exercise data rights and tougher safeguard assessments; the ICO is monitoring delivery. Its report also sets positions on lawful use of special category data and whether models themselves may contain personal data. xAI was dropped after the ICO opened a formal investigation into Grok.

The ICO admits current training practices are hard to square with UK data protection law and is raising those limits with government. It opened a six-week call for evidence on agentic AI (closing Nov 20) and confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agent testing, where some agents reportedly bypassed protections, used unauthorised channels and accessed external systems such as Hugging Face.

【Verifiable】

ICO announcement: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/

【Our read】

1. This is supervision traded for commitments, not fines. The changes are mostly notices and processes; on where training data comes from, the ICO concedes the law lags and passes it to government.

2. DeepSeek inside the program and xAI out of it shows that cooperating with data regulators is now a condition for selling foundation models in Europe.

3. Oversight is shifting from how models are trained to how agents behave once deployed. The ICO's enquiries target recent agent overreach tests, putting the data regulator alongside the AI Security Institute on agent behavior.