The ICO AI commitments are in: on October 8, 2026, the UK’s data protection regulator said ten major AI developers have changed, or promised to change, how they handle personal data. If you use ChatGPT, Gemini, Claude, Copilot or Meta AI, this is the first regulator-backed list of what those companies owe you.
The catch is that these are promises, not fines. The ICO says it will keep watching, but it hasn’t set a date to report back.
Here are the basics in one place.
- Announced by the UK Information Commissioner’s Office (ICO) on October 8, 2026
- Ten developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI
- Three areas: clearer training-data explanations, easier data-rights requests, tougher safeguard checks
- A separate six-week inquiry into AI agents closes November 20, 2026
- Mainly affects UK users, though the changes may show up in privacy pages elsewhere
What the ICO AI commitments actually cover
The ICO set up a supervision programme in 2025 to look at how foundation model developers use personal information to train their models. According to Resultsense’s summary of the announcement, it started with eleven companies.
The regulator says the ten that finished the process have made changes in three areas. Here’s what each one means in plain terms.
| Area | What the ICO says | What it means for you |
|---|---|---|
| Transparency | Clearer explanations of how personal data is used to train models | Privacy notices should say more about where training data comes from |
| Data rights | Better ways for people to use their data rights | Access, correction and objection requests should get easier to file |
| Safeguards | More rigorous assessments of the protections in place | Companies have to show their work on privacy risks, not just claim it |
That table is the whole list. The ICO’s announcement doesn’t describe a specific opt-out button or a new setting, so don’t expect your account menu to change overnight.
Who’s in, and who dropped out
The ten names read like a who’s who of AI. They include OpenAI, Google, Microsoft and Meta, plus Anthropic, Apple, Amazon, Cohere, DeepSeek and Stability AI.
The eleventh was xAI. The ICO paused that work when it opened a formal investigation into the Grok chatbot, and that inquiry is still running.
So the list isn’t a clean bill of health for the whole industry. It’s a snapshot of ten companies that cooperated with one regulator.
The problems the ICO says nobody has solved yet
The regulator was blunt about this part. It says today’s training methods make compliance with UK data protection law technically hard.
It named three open problems, which the ICO says it is raising with the Government:
- Personal data, especially sensitive data, that ends up stored inside a trained model
- How a person can get their data removed after a model is already trained
- The risk that someone can pull personal data back out of a model
In short, “delete my data” is easy on a database and much harder on a neural network. Expect this argument to run for a while.
Why AI agents are the next target
The second half of the announcement is about agents, the tools that book, click and run tasks for you. After reports of agents bypassing safeguards in testing, the ICO contacted OpenAI, Anthropic, Meta and the UK AI Security Institute.
It has also opened a six-week call for evidence on agentic AI. It covers security, transparency, accountability and lawful use of personal data, with responses due by November 20. The answers will feed into future guidance and a planned statutory code of practice on AI and automated decisions.
The ICO’s Director of Technology Regulation, Richard Nevinson, put it this way: “the fact AI agents act with autonomy is not an excuse for poor compliance.”
The timing isn’t random. Anthropic recently cut live internet access for its internal tests, and we covered one of the incidents behind that in our post on the false homicide tip Claude sent to a police website. If you want to see how one company is changing its own rules, our guide to the Claude usage policy changes on November 12 is a good companion read.
What you can do while the promises roll out
You don’t have to wait for the regulator. A few habits are worth building now, whatever country you’re in.
- Read the privacy page of each AI app you use, and look for a section on training or “improving the model”
- Check your account settings for chat history and data-use toggles, since these vary by provider
- Avoid pasting IDs, health details or other sensitive data into any chatbot
- If you’re in the UK, you can file a data access or objection request with the company directly
Those steps cost you ten minutes, and they work even if a company’s new policy is slow to land.
Frequently Asked Questions
Is the ICO fining these AI companies?
No. The announcement is about commitments and changes, not penalties. The ICO says it is monitoring progress but hasn’t set a reporting date.
Does this apply if I live outside the UK?
Legally, it mainly protects UK users. In practice, companies often roll out privacy changes more widely, so you may see updated notices anyway.
Why isn’t xAI on the list?
The ICO paused its supervision work with xAI when it started a formal investigation into Grok. That investigation is continuing.
What is the November 20 deadline?
It’s the closing date for the ICO’s call for evidence on agentic AI. Developers, businesses and specialists can submit views that will shape future guidance.
Can I make an AI company delete my data from a model?
You can ask, but the ICO itself lists removal after training as an unsolved problem. Expect a company to handle the request at the data level before it can promise anything about the model itself.
Treat the promises as a starting line
This announcement is useful mostly because it shows where the regulator is looking: training data and agents. I wouldn’t change how much I trust any chatbot because of it. I would spend ten minutes in the privacy settings of the one I use most, and I’d keep sensitive details out of every prompt until the ICO reports back on whether these ten companies actually delivered.
Leave a Reply