Developing
The document is not binding; the closing date comes from the ICO's consultation page, not the PDF.
In 60 seconds
- Six themes: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing.
- The ICO says terms of service or a user's instruction do not automatically supply a lawful basis for all downstream processing.
- Legitimate interests must be backed by an assessment and cannot be presumed; controllership should be read broadly.
- The ICO says it is "exploring the application of agentic AI in the adtech ecosystem" and will publish a report later in 2026.
Impact Layer
- What changed
- The UK regulator has set out its current reading of data protection for AI agents and asked for evidence.
- Why it matters
- Agents that act for users raise controller and lawful basis questions, and adtech is explicitly in scope.
- Who is affected
- Companies building or using AI agents in the UK, adtech firms and privacy teams.
- Martech stack area
- AI, Data
- Stack impact
- Consider responding by November 20, and review how your agents obtain a lawful basis and who is the controller at each step.
- Business impact
- Moderate Based on PPC Land's reading of the ICO's 37-page document (version 1.0.13). It is not binding, the adtech report's scope and date and the statutory code's publication date are not specified.
- Related technologies
- What to watch
- The adtech report and the draft statutory code.
The UK Information Commissioner’s Office (ICO) published its call for evidence on agentic AI on October 8, 2026, according to PPC Land. The document is 37 pages, version 1.0.13.
Deadline and structure
- Responses close at the end of November 20, 2026, through the ICO’s Citizen Space portal.
- Six themes: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing.
- Seven adoption questions, plus two annexes: nine system components and 17 defined terms.
- The evidence will inform guidance and a statutory code of practice on AI and automated decision-making.
Positions
- Terms of service or a user’s instruction does not automatically supply a lawful basis for all downstream processing.
- Legitimate interests must be backed by an assessment and cannot be presumed.
- Controllership should be read broadly: choices about permissions, protocols and tools may carry controller responsibility.
- Agent autonomy does not reduce fairness or purpose limitation obligations.
Adtech
The ICO says it is “exploring the application of agentic AI in the adtech ecosystem” and will publish a report later in 2026. Its scope and date are not specified.
Our read
The positions are readings of existing law, not new rules. They tell you what the regulator will ask first.
Sources
- PPC Land: UK ICO gives AI agent firms until November 20 to submit evidence (opens in a new tab)
Source for the call for evidence, positions and gaps.