The ICO, faced with achieving the goals of the growth agenda, has written(1) to the government offering its views on future action and work currently underway to facilitate the use of AI in a privacy-friendly way. The ICO’s aims are twofold. Firstly, to ensure public trust in the use of AI, and secondly, to offer legal certainty for businesses by making clear how data protection law applies when deploying AI systems, including AI agents and agentic systems.

The ICO says in its letter to the government that it will:

• develop an AI & ADM statutory code of practice providing regulatory clarity to organisations developing and deploying AI and ADM systems and tools
• listen to the public’s concerns and work with major tech companies to ensure that their products meet their customers’ demands in a transparent and privacy-focused way
• produce a “how to” guide to support the public to take informed decisions about the use of their personal data by online AI tools and services
• publish a transparency resource to support organisations, in particular SMEs and public bodies, so that they can undertake appropriate data protection due diligence when procuring “off the shelf” cloud-based AI tools and services
• publish guidance on how to ensure agentic systems comply with the UK GDPR, working to ensure organisations developing and deploying agentic AI tools and systems understand their data protection obligations and place consumer trust and privacy at the heart of system design and application development
• streamline and rebrand the ICO’s Innovation and Sandbox services to make them simpler for organisations developing and deploying AI to access and understand.