Blog In the news
The ICO wants evidence on agentic AI by 20 November 2026: 5 hidden ways AI agents can leak confidential data, and the control that stops each one
Illustration
The news. On 8 October 2026 the Information Commissioner's Office (ICO) opened a call for evidence on how UK data protection law applies to agentic AI. It closes on 20 November 2026. Its questions include how organisations assign accountability for what an agent does, how agent actions are tracked, and how the safeguards on automated decision-making apply. The answers will feed into ICO guidance and a statutory code of practice on AI and automated decision-making.
If your firm uses AI agents, or plans to, those are the questions you should be able to answer for yourself. The five data paths below are where we start.
When people worry about AI and confidential data, they usually mean one thing: will the model provider keep my prompts, or train on them? That is a real question, and it has good answers. But an agent team raises four more, because agents do more than answer. They search, fetch pages, remember and write records.
Here are the five paths, and the control we put on each before any agent runs.
1. The model provider
The risk: your prompts are kept, or used to train future models.
The control: commercial terms with no training on your data, zero data retention where the provider offers it, and UK or EU regions. For the most sensitive work, the models run inside your own cloud account, so your data never leaves your tenancy.
2. The agents' tools
The risk: a web search sends its query to a search provider, and that query can contain the very thing you are trying to keep private. Worse, a fetched web page can hide an instruction telling an agent to send data somewhere it should not.
The control: agents on confidential work get no web access, or generalised queries only. Web access runs against an allowlist of sites, and a named person approves anything that leaves.
3. Memory
The risk: agents that remember between sessions are useful, but one client's facts must never surface in another client's session.
The control: a separate deployment, memory and log for every client. Nothing is shared between them.
4. The records
The risk: the minutes and audit logs that make a governed team trustworthy also hold the sensitive content.
The control: records are kept in your environment, encrypted, access-controlled and deleted on the retention period you set.
5. People and outputs
The risk: a case study, a demo or a shared link reveals more than anyone intended.
The control: everything is anonymised by default, nothing is made public without your written sign-off, and sharing is private unless you decide otherwise.
Choosing how private to go
Most firms fit one of three tiers:
| Tier | What it means |
|---|---|
| Standard | A commercial model service with no training on your data, UK or EU region where available, agents built in your cloud account. |
| Private cloud | Models run through your own AWS, Azure or Google account, under contracts you hold. |
| Fully private | Open-weight models on your own hardware with no outside calls. The most private option, at some cost in capability. |
What we will and will not promise
We will promise that your data stays in your environment, is never used to train a model, and that nothing leaves without a person approving it. Every action is logged in an audit trail so you can check.
We will not promise zero risk, because no honest supplier can. What we will do is show you each control working before your data goes in, and sign a data processing agreement under UK GDPR with the full sub-processor list.
