ICO tech futures report on agentic AI

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AAL-2026-0025

Kind

Guidance

Jurisdiction

United Kingdom

Last verified

15 September 2026

Added

15 September 2026

• The ICO states that as developing agentic AI increases the potential for automation, organisations remain responsible for data protection compliance of the agentic AI they develop, deploy or integrate in their systems and processes.
• It states that the specific design and architecture of agentic systems impact how data protection law applies and how people exercise their data protection rights.
• It flags implementations with no measures in place to secure access, monitor or stop activity, or control the further sharing of information.
• The report is part of the ICO's tech futures series and is not formal statutory guidance.

Accountability, Revocation, Limits. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

AccountabilityStated

Organisational responsibility survives the agent's autonomy, for systems the organisation develops, deploys or integrates.Information Commissioner's Office, ICO tech futures: agentic AI, primary source, 15 September 2026.

RevocationStated

The regulator names the absence of a way to stop an agent's activity as a risk, without prescribing a mechanism.Information Commissioner's Office, ICO tech futures: agentic AI, primary source, 15 September 2026.

LimitsStated

Securing access and controlling onward sharing of information are named as the measures whose absence creates risk.Information Commissioner's Office, ICO tech futures: agentic AI, primary source, 15 September 2026.

In the United Kingdom your existing data protection accountability already covers the agent. The practical consequence is a design question the ICO asks directly: can you secure what the agent reaches, see what it did, stop it, and control what it passed on. Four yes answers, written down, is the record to keep.

1. Information Commissioner's Office, ICO tech futures: agentic AIPrimary · 15 September 2026

• VerifiedGuidanceAAL-2026-0024

  IMDA Model AI Governance Framework for Agentic AI

  Singapore · verified 15 September 2026

  The framework opens by saying there is no consensus on what defines an AI agent, but that agents usually possess some degree of independent planning, decision making and action taking over multiple steps to achieve a user defined goal.

• Open questionOpen questionAAL-2026-0031

  Who is liable when a delegated agent exceeds its mandate

  Global · verified 15 September 2026

  The EU AI Act allocates duties to providers and deployers, and does not address an agent acting beyond its instructions.