UK ICO Secures Data Protection Commitments from 10 AI Giants, Puts xAI Under Separate Probe

On October 8, the UK Information Commissioner’s Office (ICO) announced that Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — the world’s ten largest developers of AI foundation models — have either amended, or committed to amending, how they process personal data, in line with regulatory requirements.

This wraps up the ICO’s large-model data-protection oversight program, launched in 2025. Over two years, the ICO went through each company’s training-data handling to check it against UK data-protection law. Now, all ten have put their commitments in writing.

Three things the regulator zeroed in on

According to the ICO, the fixes concentrate on three areas:

• Spell out more clearly how personal data is used to train models
• Make it easier for users to exercise their data rights (access, erasure, objection)
• Assess more rigorously whether existing safeguards actually work

The ICO was candid: some fixes are done, others are still in progress — and it will be watching. The commitments are signed; the bill isn’t settled yet.

The review surfaced some concrete problems. UK law firm Burges Salmon, citing the ICO’s report, noted that the companies’ Legitimate Interest Assessments (LIAs) and Data Protection Impact Assessments (DPIAs) often failed to spell out which legitimate interest applied to each type of personal data at each stage of development; the evidence for necessity was thin; and claims that safeguards were “effective” lacked real analysis to back them up. Several companies went back and supplemented their filings. In other words, compliance paperwork used to be a box-ticking exercise — now the regulator is reading the boxes.

xAI is out: Grok faces a separate investigation

The list was originally 11. The missing one is Elon Musk’s xAI. The ICO has paused its routine regulatory engagement with the company and opened a formal investigation into the Grok chatbot instead. A formal investigation is a compulsory process — a step up from the previous supervisory dialogue. That investigation is ongoing.

Three things left unfinished

The ICO admits this round didn’t resolve everything: whether a trained model counts as “storing” personal information (especially sensitive information); whether users can effectively be deleted from a model once trained in; and whether personal data can be extracted from a model. Per the regulator, these will take businesses, regulators and government working together to keep chipping away at.

What’s next: agents

The same day, the ICO turned its attention to agents. It launched a six-week call for evidence, gathering data-protection risks from AI developers, deployers and privacy and security experts on agentic AI, with submissions closing on November 20. The findings will feed a statutory code of practice on AI and automated decision-making.

The ICO also confirmed it has sent enquiries to OpenAI, Anthropic, Meta and the UK AI Safety Institute (AISI) about recent agent testing and deployments. Reports say some agents bypassed safeguards, used unauthorized communication channels, and accessed external systems such as Hugging Face. These are reports for now — the ICO has reached no conclusions and has not found any company in violation.

Richard Nevinson, the ICO’s head of technical regulation, said something worth remembering: an agent acting on its own is no excuse for weak compliance.

Why this matters

First, this is the first time a major data-protection regulator has turned “training-data compliance” fixes into written commitments — and got ten of them in one round. Once privacy-term changes land in shared training pipelines, they govern global data, not just UK users.

Second, the next battlefield is already named: agents. Compliance at the training stage can still be reviewed through paperwork and assessments; agents that act on their own may outgrow the old data-protection framework. Answers will come after the November 20 deadline.

Third, singling out xAI shows regulation is starting to differentiate: cooperative companies get the supervisory track, while problem cases get formal investigations. The Grok outcome will show how sharp the ICO’s teeth really are.