The ICO has not yet published final guidance on AI agents, but it is getting close. On 8 October 2026 it opened a six-week call for evidence on agentic AI, closing on 20 November 2026. Final guidance on automated decision-making is due this winter, and a statutory code of practice on AI and automated decision-making is in preparation. Until those land, UK GDPR applies to AI agents in full, including the new Articles 22A to 22D in force since 5 February 2026. This tracker lists every ICO publication on AI agents and automated decisions, newest first, with what each one means for a small firm.
Key facts
- Open now: ICO call for evidence on agentic AI, 8 October to 20 November 2026.
- In force: Articles 22A to 22D (automated decisions) since 5 February 2026.
- Due winter 2026: final ICO guidance on automated decision-making and profiling.
- In preparation: statutory code on AI and automated decision-making (SI 2026/425, in force 12 May 2026); no date set.
- Ongoing: ICO enquiries with OpenAI, Anthropic and Meta about recent agent testing.
On this page
- Every ICO publication on AI agents, newest first
- What is coming next?
- What should a small business do now?
- Frequently asked questions
- Sources
Every ICO publication on AI agents, newest first
| Date | Publication | What it means for a small firm | Status |
|---|---|---|---|
| 8 Oct 2026 | Call for evidence on agentic AI (six weeks) | Your chance to tell the regulator how you use agents. It covers security, transparency, accountability, automated decisions, fairness, lawful basis and governance. | Open until 20 Nov 2026 |
| 8 Oct 2026 | Results of foundation model supervision: changes secured from Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI | Expect clearer privacy information and better rights handling from the big model vendors. Enquiries into agent testing at OpenAI, Anthropic and Meta continue. | Published; monitoring |
| 12 May 2026 | SI 2026/425 in force: the ICO must prepare a statutory code on AI and automated decision-making | No new duties for you yet. The code will become the benchmark the ICO measures you against. | Code in preparation |
| 31 Mar 2026 | Draft guidance on automated decision-making and profiling, updated for the Data (Use and Access) Act | A DPIA is usually needed; human involvement has to be meaningful, not a rubber stamp. | Consultation closed 29 May 2026; final due winter 2026 |
| 5 Feb 2026 | Articles 22A to 22D of UK GDPR in force | Solely automated significant decisions are allowed with safeguards: tell people, let them make representations, offer human intervention, let them contest. | In force |
| Jan 2026 | ICO Tech Futures report on agentic AI | Early thinking, not guidance. It names agent-specific risks such as goal distortion and over-broad data access. | Published |
What is coming next?
- Agentic AI guidance. The ICO's guidance plans listed a consultation in September 2026 and a final version in autumn 2026. The call for evidence opened on 8 October instead, so expect draft guidance after it closes on 20 November.
- Automated decision-making and profiling guidance. Final version due winter 2026, after the consultation that closed on 29 May.
- Foundation models guidance. Listed as due autumn 2026, with no public consultation.
- Code of practice on AI and automated decision-making. Required by SI 2026/425 but with no deadline. It still has to pass a panel review and be laid before Parliament, so one law firm expects it in 2027 at the earliest.
What should a small business do now?
- Keep a short DPIA and an action log for every agent that touches personal data. The draft ADM guidance says a DPIA will usually be needed, and the log is how you explain what the agent did.
- Check every solely automated decision with a significant effect on a person (credit, pay, hiring, access to a service) against Articles 22A to 22D, and put a real person in the loop where you can.
- Consider responding to the call for evidence by 20 November 2026. The ICO wants to hear from deployers, not only developers. Two paragraphs on what you use agents for and what worries you is enough.
The full explanation of lawful basis, data minimisation, Articles 22A to 22D and DPIAs is in AI agents and UK GDPR: what the ICO expects.
Frequently asked questions
Has the ICO published guidance on AI agents?
Not final guidance yet. It published early thinking on agentic AI in January 2026 and, on 8 October 2026, opened a six-week call for evidence that closes on 20 November 2026. Draft guidance is expected after that. UK GDPR already applies to agents in full.
When will the ICO's automated decision-making guidance be final?
The ICO consulted on draft guidance from 31 March to 29 May 2026 and lists the final version as due in winter 2026. It covers the new Articles 22A to 22D introduced by the Data (Use and Access) Act 2025.
What is the ICO code of practice on AI and automated decision-making?
A statutory code the ICO must prepare under SI 2026/425, in force since 12 May 2026. It will set out good practice for developing and using AI and for automated decision-making, including children's data. No publication date has been set.
Can a small business respond to the ICO call for evidence?
Yes. The ICO invites developers, deployers and other experts, and a deployer is any organisation using an AI agent. Responses close on 20 November 2026 and cover security, transparency, accountability, automated decisions, fairness, lawful basis and governance.
Next: read AI agents and UK GDPR: what the ICO expects for what to do before you switch an agent on.
Read next
- AI agents and UK GDPR: what the ICO expects
- UK AI adoption statistics 2026
- What is agentic AI? Meaning, examples and UK rules
Sources
- ICO, ICO secures changes from leading AI developers as scrutiny extends to AI agents (8 October 2026) - call for evidence, developer commitments, agent enquiries
- ICO, Our plans for new and updated guidance: technology - timetable for agentic AI, ADM and foundation model guidance
- Bratby Law, SI 2026/425: the ICO AI and automated decision-making code - dates and process for the statutory code
- Freeths, ICO consults on updated automated decision-making and profiling guidance (2026) - draft ADM guidance
- ICO, Tech Futures: agentic AI (January 2026) - early thinking on agent risks
