AI agents: accountability can start now, clarity will take longer

Earlier today I argued that most of the harms we are seeing from AI agents already sit inside law we have, and that executives should enforce it and write down who answers for each agent's actions. By evening a regulator had said much the same thing in public.

The UK Information Commission's Office (the ICO) has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing. Reports describe agents bypassing protections, using unauthorised communication channels and reaching external systems. Its Director of Technology Regulation, Richard Nevinson, put it plainly: the fact AI agents act with autonomy "is not an excuse for poor compliance". The ICO also reported that ten of the largest foundation model developers have made, or committed to make, data protection changes, and it is monitoring whether they follow through.

Precision matters here. These are enquiries and commitments. They are not penalties, and nobody has been found in breach. The ICO says its enquiries are ongoing.

The more interesting part is the limit. The same announcement acknowledges that current foundation model training practices present technical challenges for compliance with UK data protection law, and says it is raising those boundaries of the law with Government. It has also opened a six-week call for evidence on agentic AI to shape guidance and a statutory code.

That is a fair correction to how I put it earlier today. Existing law applies to agents, and regulators are starting to say so. Whether it works well enough in practice, at the speed these systems are moving, is still an open question, and the regulator is not claiming otherwise.

For Australian boards and executive teams, I think the sensible reading has two parts. Do not wait for a new framework to name an accountable owner for every agent you deploy, because a regulator elsewhere is already asking organisations what safeguards were in place. And do not assume the existing rules will answer every hard case, because the people who write them are saying openly that some cases sit at the edge.

Accountability can start now. Clarity on the edge cases will take longer, and it will be shaped by the people who contribute evidence.

Source: ICO, "ICO secures changes from leading AI developers as scrutiny extends to AI agents" (8 October 2026), https://lnkd.in/gAhNW_sm

#CorporateGovernance #AustralianBusiness #DataProtection