UK savings: 5% interest rate deals may not last, say experts | Savings rates

Foundational AI models are created in part by processing personal information and copyrighted material. As governments around the world attempt to realize forecasted economic gains from the commercial products based on these models, they are also navigating a backlash that demands some minimal degree of accountability and trust. The latest attempt to impose that accountability in the UK comes in the form of a commitment the Information Commissioner’s Office says it has obtained from 10 foundational AI model developers to improving their data protection practices.

A report from the ICO titled “Building trust and transparency into generative AI development: our work to create regulatory certainty” sets out the regulator’s position. The report says that personal data used to train foundational models must only be processed when the developer has identified a lawful basis for doing so, with a meaningful degree of transparency, with mechanisms for people to exercise their rights and with “safeguards in place to materially reduce risk.”

The developers making changes or agreeing to make them are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI.

Missing from that list is X and X.AI, which instead will be investigated for possible violations of personal data protection rules and the potential of those violations to fuel harmful sexualized material.

The report frames foundational AI models as the bedrock of a whole new ecosystem of generative AI and agentic AI services that operate across the economy. The technology will yield “significant opportunities.”

As such, part of the ICO’s current push is a call for evidence on agentic AI from now until November 20 to inform future guidance. The regulator has also asked OpenAI, Anthropic, Meta and the UK’s AI Security Institute some questions about recent tests and deployments of AI agents.

The dedicated foundation model supervision program was established under the ICO’s 2025 “AI and biometrics strategy.” The ICO has said that its job is to inspire confidence in the responsible deployment of AI.

The ICO notes that foundational models are “trained on vast datasets that often include significant volumes of personal data.” It argues that developers and the public “must be confident that foundation models are developed responsibly and in line with data protection law.”

The report does not mention any lack of confidence expressed by the foundational model developers about their practice of ignoring personal data protection and copyright rules thus far. The ICO also doesn’t seem to have any confidence itself, suggesting merely that their practices raise “novel questions and risks that we need to explore.”

A sceptic, or observer of the age assurance debates, might ask if the most central of those questions is what happens when a company ignores the law, but is very large.

What the report does make clear is that the practices the ICO is concerned about are all covered under existing law, mainly UK GDPR. The bulk of the report maps the commitments the regulator is demanding against statutes on the books.

Dialogue, monitoring and stakeholder engagements are expected going forward.