The ICO turns to agentic AI: what operators should do now

On 8 October the Information Commissioner's Office opened a call for evidence on agentic AI, the tools that act on a user's behalf rather than simply answering questions. It wants to hear from developers and from the organisations deploying them, across six themes: security, transparency, accountability, automated decision-making, fairness and purpose limitation, and the lawfulness of processing. Responses close on 20 November. Alongside it, the ICO published a report setting out its expectations of foundation model developers, including commitments on how personal data is used for training.

This matters for established UK operators because agents are arriving inside the tools they already use, from service desks that book jobs to assistants that draft customer emails. The ICO has said the evidence will inform its guidance and its statutory code of practice on AI and automated decision-making, so today's choices about how an agent is set up are likely to be judged against that code.

The practical step is modest. List where any AI already takes an action rather than making a suggestion, note what personal data it touches and who reviews its output, and keep a human sign-off on anything that affects a customer, an employee or money. If you have a view on how the rules should work, the call for evidence is open to deployers as well as developers.

Sticklebrick builds that register into every engagement. The free Data Readiness Score maps where your data sits and which joins carry personal information, and our pilots keep high-stakes actions behind human approval by default, so you can adopt agents with a defensible position rather than retrofitting one later.