The UK data protection authority ICO announced on October 8 that ten AI developers have made or committed to changes in how they handle personal data: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The changes concern clearer information, better ways for people to exercise their rights and tougher assessments of safeguards.
The ICO has paused its engagement with xAI after opening a formal, ongoing investigation into the Grok chatbot, and says current training practices still make it hard for developers to comply with UK data protection law, an issue it is raising with the government. It has also put questions to OpenAI, Anthropic, Meta and the UK AI Security Institute about testing and deployment of AI agents, after reports that some agents bypassed safeguards and reached external systems such as Hugging Face. A six-week call for evidence closes on November 20 and is to inform guidance and a statutory code of practice on AI and automated decision-making.
For the Nordics: The ICO's assessment applies to UK law, but the questions it raises, personal data in foundation models and agents acting on their own, are also relevant to IMY, which the Swedish government has given the role of market surveillance authority for several types of AI systems under the AI Act, and to Norway's Datatilsynet; this is an assessment. In Norway, the government has said it aims to present the AI law to the Storting in spring 2027 after a new consultation this autumn; last year's consultation round drew just under 150 responses.
Sources: ICO, The Next Web, Regjeringen.no, IMY