Ten AI firms pledge data reforms after UK watchdog scrutiny
Major tech companies commit to tighter personal data handling following ICO review, though regulators warn compliance gaps remain in AI training practices.
Key points
- Ten major AI developers agreed to changes in personal data handling after UK privacy watchdog scrutiny.
- The ICO paused engagement with xAI to pursue a formal investigation into its Grok chatbot.
- Regulators note that current AI training practices still pose significant problems under UK data protection law.
Ten of the world's largest artificial intelligence developers have committed to tightening their handling of personal data following a supervisory program by Britain’s privacy watchdog, according to The Register. The Information Commissioner’s Office stated on Thursday that Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI have either implemented changes or pledged to do so.
The regulator’s review examined how these companies comply with UK data protection laws. The commitments cover clearer explanations of how personal information is used for training models, improved mechanisms for individuals to exercise their data rights, and stricter assessments of developer safeguards. These actions follow a supervisory program launched in 2025 that initially included eleven developers.
Context of the Regulatory Review
The number of participating developers dropped to ten after the ICO paused its engagement with Elon Musk’s xAI. The watchdog initiated a separate formal investigation into xAI’s Grok chatbot, distinguishing it from the broader supervisory program. This split highlights the regulator’s willingness to pursue formal enforcement actions when necessary, rather than relying solely on collaborative compliance measures.
Richard Nevinson, the ICO’s director of technology regulation, emphasized that AI’s societal benefits depend on trust and transparency. He noted that while getting companies to promise changes is one step, making current models comply with the law presents a separate challenge. The ICO acknowledged that resolving some issues will require cooperation between industry, regulators, and government.
Ongoing Compliance Challenges
The watchdog is not declaring victory and continues to monitor whether developers deliver on their promises. The ICO admitted that current AI training practices still pose problems under UK data protection law. Significant questions remain regarding personal data buried within models, particularly sensitive information, and how users can request removal of their details once an AI has been trained on them.
There is also the risk of personal information being extracted from models, including data developers never intended to retain. These technical challenges complicate efforts to ensure strict compliance with privacy regulations. The ICO’s focus is shifting toward autonomous AI agents that do not always adhere to standard operational rules, indicating a broader scope for future regulatory action.
What should you do?
Security and technology professionals should monitor developments in the ICO’s formal investigation into xAI, as outcomes may set precedents for other developers. Organizations using AI services should review vendor documentation for clarity on data usage and model training practices. It is important to verify that contracts include specific clauses on data rights and removal processes. Watch for updates on how regulators address the extraction of unintended data from trained models, as this may impact liability assessments.
What to do and how to stay safe: Amazon
- Review current vendor contracts to ensure they clearly define how personal data is used for training AI models.
- Verify that service providers have documented processes for allowing users to exercise their data rights, including removal requests.
- Monitor regulatory updates from the ICO regarding autonomous AI agents and data extraction risks.
- Assess internal safeguards to ensure they align with the stricter assessments mentioned by the developers’ commitments.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies agreed to change their data handling practices?
Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI agreed to changes after ICO scrutiny.
Why was xAI excluded from the group of ten developers?
The ICO paused its engagement with xAI to pursue a separate formal investigation into its Grok chatbot.
Does the ICO consider the compliance issues fully resolved?
No, the ICO states that current AI training practices still pose problems under UK data protection law and is monitoring developer promises.
