New ICO ‘Tech Futures’ report on agentic AI
You can read the full report here.
Last week, the Information Commissioner’s Office (ICO) published its Tech Futures report on agentic AI, setting out its thoughts on how the technology may develop and be used in the coming years.
To develop this report, the ICO analysed current agentic AI capabilities and expected technical developments, identified data protection risks specific to agentic systems beyond those seen in generative AI, and explored privacy-friendly innovation opportunities.
The report examines the data protection considerations organisations will need to address as they explore deploying agentic AI, highlighting both the risks and the potential opportunities. It also outlines four future scenarios (outlined below) around how agentic AI capabilities could evolve and how organisations might adopt them over the next two to five years.
What are AI agents and agentic AI?
The ICO report describes an AI agent as a software or a system that can carry out processes or tasks with varying levels of sophistication and automation. Whereas agentic AI is defined as systems that go beyond generative AI by combining language capabilities with tools and autonomous decision-making. These systems can complete open-ended tasks like booking travel, writing and testing code, or handling customer transactions with minimal human oversight.
Agentic AI adoption opportunities for organisations and consumers
The report sets out potential opportunities, with a particular focus on ‘agentic commerce’ where personal AI agents could help customers by anticipating their shopping needs and making purchases on their behalf. The ICO explains how agents may be able to learn from customers' preferences, behaviours, and even upcoming events, all of which could make shopping much easier and create new opportunities for businesses to engage with customers more effectively.
Potential data protection challenges
The report highlights novel risks that agentic systems may pose:
- Responsibility and ownership: working out who is the data controller and who is the processor may be more challenging when multiple companies provide different parts of an agentic system.
- Data concentration: personal AI assistants in particular may accumulate significant amounts of personal information in one place.
- Scaled-up automation: these systems can automate much more complex decisions, triggering stricter rules on automated decision-making.
- Purpose creep: the open-ended nature of agentic tasks makes it tempting to define data processing purposes too broadly.
- Data minimisation challenges: autonomous systems might process more personal information than necessary to complete their tasks.
- Sensitive data risks: higher chance that systems will accidentally use or infer sensitive personal information.
- Transparency issues: more complex systems may make it harder to explain how they work and enable individuals to exercise their rights.
- New security risks: as autonomous systems become more advanced and more independent, they may pose new ways for hackers to attack
Data protection opportunities:
The ICO identified innovation opportunities with agentic AI that have the potential to support data protection and information rights and contribute to privacy-positive outcomes. Potential areas include:
- Data protection compliant agents
- Agentic controls
- Privacy management agents
- Information governance agents
- Ways to benchmark and evaluate agentic systems
Four future scenarios
To explore how agentic AI might develop in practice, the ICO have set out four possible future scenarios based on two factors. These are the capability of AI agents and the extent to which they are adopted. These scenarios are intended to illustrate how different combinations of capability and uptake could shape both the benefits of agentic AI and the data protection risks that may arise.
1. Low capability and low adoption – scarce and simple agents: in this future, agentic AI is not significantly more sophisticated than current chatbots and is not widely used.
2. Low capability and high adoption – just good enough to be everywhere: agentic AI is widespread, but its limited capabilities may lead to harms from failures, such as misinterpreted tasks or failures on edge cases.
3. High capability, and low adoption – agents in waiting: the technology is highly capable but not widely adopted, with potential harms arising from agents working as intended but accessing large amounts of personal data and diminishing privacy.
4. High capability and high adoption – ubiquitous agents: in this scenario, highly capable agents are widely adopted across various aspects of life and work, presenting both opportunities and significant data protection challenges.
What comes next?
The ICO will host workshops to gather more information on agentic capabilities, adoption patterns, and how industry is managing data protection risks. They are updating guidance on automated decision-making and profiling, taking account of the Data (Use and Access) Act, with public consultations due to start this year.
Through the Digital Regulation Cooperation Forum (DRCF), the ICO is working with its partner regulators to understand wider implications. They have launched a Thematic Innovation Hub on agentic AI, which innovators are invited to participate in. The ICO is encouraging organisations to use their innovation services and, for public interest applications, the Regulatory Sandbox.
techUK's work on agentic AI
Agentic AI is a live and rapidly evolving area that techUK are exploring in depth this year. We are particularly keen to learn from organisations developing and adopting agentic AI systems, to better understand emerging use cases, challenges, and implications.
If you would like to share insights or discuss how you can get involved in our agentic AI work, please get in touch with Kir Nuthi and Usman Ikhlaq.
Kir Nuthi
Kir Nuthi
Kir Nuthi is the Head of AI and Data at techUK.
She holds over seven years of Government Affairs and Tech Policy experience in the US and UK. Kir previously headed up the regulatory portfolio at a UK advocacy group for tech startups and held various public affairs in US tech policy. All involved policy research and campaigns on competition, artificial intelligence, access to data, and pro-innovation regulation.
Kir has an MSc in International Public Policy from University College London and a BA in both Political Science (International Relations) and Economics from the University of California San Diego.
Outside of techUK, you are likely to find her attempting studies at art galleries, attempting an elusive headstand at yoga, mending and binding books, or chasing her dog Maya around South London's many parks.
- Email:
- [email protected]
Usman Ikhlaq
Usman Ikhlaq
Usman joined techUK in January 2024 as Programme Manager for Artificial Intelligence.
He leads techUK’s AI Adoption programme, supporting members of all sizes and sectors in adopting AI at scale. His work involves identifying barriers to adoption, exploring solutions, and helping to unlock AI’s transformative potential, particularly its benefits for people, the economy, society, and the planet. He is also committed to advancing the UK’s AI sector and ensuring the UK remains a global leader in AI by working closely with techUK members, the UK Government, regulators, and devolved and local authorities.
Since joining techUK, Usman has delivered a regular drumbeat of activity to engage members and advance techUK's AI programme. This has included two campaign weeks, the creation of the AI Adoption Hub (now the AI Hub), the AI Leader's Event Series, the Putting AI into Action webinar series and the Industrial AI sprint campaign.
Before joining techUK, Usman worked as a policy, regulatory and government/public affairs professional in the advertising sector. He has also worked in sales, marketing, and FinTech.
Usman holds an MSc from the London School of Economics and Political Science (LSE), a GDL and LLB from BPP Law School, and a BA from Queen Mary University of London.
When he isn’t working, Usman enjoys spending time with his family and friends. He also has a keen interest in running, reading and travelling.
techUK - Seizing the AI Opportunity
The UK is a global leader in AI innovation, development and adoption.
AI has the potential to boost UK GDP by £550 billion by 2035, making adoption an urgent economic priority. techUK and our members are committed to working with the Government to turn the AI Opportunities Action Plan into reality. Together we can ensure the UK seizes the opportunities presented by AI technology and continues to be a world leader in AI development.
Get involved: techUK runs a busy calendar of activities including events, reports, and insights to demonstrate some of the most significant AI opportunities for the UK. Our AI Hub is where you will find details of all upcoming activity. We also send a monthly AI newsletter which you can subscribe to here.
Upcoming AI Events
AI Vision to Value Conference: Delivering the UK's AI Opportunities Action Plan
Central London Conference
Latest news and insights
Subscribe to our AI newsletter
AI and Data Analytics updates
Sign-up to our monthly newsletter to get the latest updates and opportunities from our AI and Data Analytics Programme straight to your inbox.
Contact the team
Kir Nuthi
Kir Nuthi
Kir Nuthi is the Head of AI and Data at techUK.
She holds over seven years of Government Affairs and Tech Policy experience in the US and UK. Kir previously headed up the regulatory portfolio at a UK advocacy group for tech startups and held various public affairs in US tech policy. All involved policy research and campaigns on competition, artificial intelligence, access to data, and pro-innovation regulation.
Kir has an MSc in International Public Policy from University College London and a BA in both Political Science (International Relations) and Economics from the University of California San Diego.
Outside of techUK, you are likely to find her attempting studies at art galleries, attempting an elusive headstand at yoga, mending and binding books, or chasing her dog Maya around South London's many parks.
- Email:
- [email protected]
Usman Ikhlaq
Usman Ikhlaq
Usman joined techUK in January 2024 as Programme Manager for Artificial Intelligence.
He leads techUK’s AI Adoption programme, supporting members of all sizes and sectors in adopting AI at scale. His work involves identifying barriers to adoption, exploring solutions, and helping to unlock AI’s transformative potential, particularly its benefits for people, the economy, society, and the planet. He is also committed to advancing the UK’s AI sector and ensuring the UK remains a global leader in AI by working closely with techUK members, the UK Government, regulators, and devolved and local authorities.
Since joining techUK, Usman has delivered a regular drumbeat of activity to engage members and advance techUK's AI programme. This has included two campaign weeks, the creation of the AI Adoption Hub (now the AI Hub), the AI Leader's Event Series, the Putting AI into Action webinar series and the Industrial AI sprint campaign.
Before joining techUK, Usman worked as a policy, regulatory and government/public affairs professional in the advertising sector. He has also worked in sales, marketing, and FinTech.
Usman holds an MSc from the London School of Economics and Political Science (LSE), a GDL and LLB from BPP Law School, and a BA from Queen Mary University of London.
When he isn’t working, Usman enjoys spending time with his family and friends. He also has a keen interest in running, reading and travelling.
Sue Daley OBE
Sue Daley OBE
Sue leads techUK's Technology and Innovation work.
This includes work programmes on cloud, data protection, data analytics, AI, digital ethics, Digital Identity and Internet of Things as well as emerging and transformative technologies and innovation policy.
In 2025, Sue was honoured with an Order of the British Empire (OBE) for services to the Technology Industry in the New Year Honours List.
She has been recognised as one of the most influential people in UK tech by Computer Weekly's UKtech50 Longlist and in 2021 was inducted into the Computer Weekly Most Influential Women in UK Tech Hall of Fame.
A key influencer in driving forward the data agenda in the UK, Sue was co-chair of the UK government's National Data Strategy Forum until July 2024. As well as being recognised in the UK's Big Data 100 and the Global Top 100 Data Visionaries for 2020 Sue has also been shortlisted for the Milton Keynes Women Leaders Awards and was a judge for the Loebner Prize in AI. In addition to being a regular industry speaker on issues including AI ethics, data protection and cyber security, Sue was recently a judge for the UK Tech 50 and is a regular judge of the annual UK Cloud Awards.
Prior to joining techUK in January 2015 Sue was responsible for Symantec's Government Relations in the UK and Ireland. She has spoken at events including the UK-China Internet Forum in Beijing, UN IGF and European RSA on issues ranging from data usage and privacy, cloud computing and online child safety. Before joining Symantec, Sue was senior policy advisor at the Confederation of British Industry (CBI). Sue has an BA degree on History and American Studies from Leeds University and a Masters Degree on International Relations and Diplomacy from the University of Birmingham. Sue is a keen sportswoman and in 2016 achieved a lifelong ambition to swim the English Channel.
- Email:
- [email protected]
- Phone:
- 020 7331 2055
- Twitter:
- @ChannelSwimSue,@ChannelSwimSue
Visit our AI Hub - the home of all our AI content:
Enquire about membership:
