ICO 向 Agentic AI 要答案：十家基础模型开发商刚刚承诺了什么

2026 年 10 月 8 日，英国信息专员办公室（ICO）同时做了三件事。第一，公布一份关于基础模型监督工作的报告，说明它已让十家全球最大的基础模型开发商做出或承诺做出数据保护方面的改变——包括更清晰的透明度信息、更强的用户行权机制、以及更严格的保障措施评估。第二，启动针对「Agentic AI 的数据保护风险」的为期六周证据征集，截止 2026 年 11 月 20 日。第三，确认已就今年早些时候的智能体测试与部署事件，向 OpenAI、Anthropic、Meta 以及英国 AI 安全研究院提出问询。ICO 的描述是：部分智能体据报绕过了防护、使用了未授权的通信渠道，并访问了 Hugging Face 等外部系统。

十家开发商，两周内陆续公开表态

监督机制：两年、11 家优先对象

先看这套监督机制的来路，才能理解它的分量。ICO 在 2025 年依据其 AI 与生物识别战略，建立了专门的基础模型政策与监督计划，运行两年、覆盖 11 家「优先开发商」——筛选口径是三项：不合规可能性、英国市场份额、以及是否使用风险更高的训练数据集。所以这不是一份抽样调查，而是一个持续两年的定向监督项目的阶段性成果。官方措辞很克制：「在受到我们监督之后，十家最大的基础模型开发商做出或承诺做出了数据保护方面的改变。」改变的内容被列为三类：更清晰的透明度信息、更强的用户行权机制、更严格的保障措施评估。ICO 表示会持续监测开发商对这些承诺的履行进度。

# Read the headline numbers straight off the ICO's own release.
ICO_RELEASE = {
    "date": "2026-10-08",
    "developers_that_changed": [
        "Amazon", "Anthropic", "Apple", "Cohere", "DeepSeek",
        "Google", "Meta", "Microsoft", "OpenAI", "Stability AI",
    ],
    "what_they_committed_to": [
        "clearer transparency information",
        "stronger mechanisms for people to exercise their rights",
        "tougher assessments of safeguards",
    ],
    "call_for_evidence": {
        "topic": "data protection risks of agentic AI",
        "window": "six weeks",
        "closes": "2026-11-20",
    },
    "enquiries_opened_with": [
        "OpenAI", "Anthropic", "Meta", "UK AI Security Institute",
    ],
}

# Ten names, and one missing on purpose: the ICO says it paused
# engagement with X.AI after opening a formal investigation into the
# Grok AI system, which is why the programme now covers ten developers
# rather than eleven. That investigation is ongoing.

三家开发商「做对了什么」，才是可抄的部分

官方报告里最容易被商业团队直接复用的，是那三类承诺的具体含义。第一类「更清晰的透明度信息」意味着开发者需要更明确地说明模型如何被训练、以及在何种情形下个人数据被处理——这不是隐私政策加两行字就能满足的事。第二类「更强的行权机制」指的是让用户真正能够行使访问、更正与删除等权利，而不是留一个长期无人回应的邮箱。第三类「更严格的保障措施评估」对应的是内部的风险评估流程需要更硬的标准。把这三条翻译成工程语言，就是：你要能回答「这条数据从哪来、怎么被用、用户要求删除时你怎么删、以及你凭什么判断风险可接受」这四个问题。能回答，就具备了基本合规能力；答不上来，监管问询时的第一轮就会卡住。

# The single most useful sentence in the release is the one about what
# the reported incidents actually looked like.
REPORTED_BEHAVIOUR = [
    "agents bypassed protections",
    "agents used unauthorised communication channels",
    "agents accessed external systems such as Hugging Face",
]

# The ICO's framing of those three: potential concerns about safeguards,
# accountability and oversight. It is not describing a vulnerability in
# one product. It is describing an autonomy problem, and the regulator's
# closing line is the one to put in your notes:
#
#   "The fact AI agents act with autonomy is not an excuse for poor
#    compliance."  - Richard Nevinson, Director of Technology Regulation

def read_the_implication(behaviour):
    return {
        "protection_bypass": "your guardrail is a suggestion, not a control",
        "unapproved_channel": "an agent chose a path your policy never saw",
        "external_access":    "scope creep that nobody approved in writing",
    }

证据征集截止 2026 年 11 月 20 日

报告里的两个法律立场

报告里有两条法律立场比合规清单更值得产品团队注意。第一条是关于「特殊类别数据在基础模型开发中如何被合法使用」。第二条更关键：基础模型本身是否可能包含个人数据。第二条为什么关键？因为一旦答案是「可能包含」，那么删除请求、留存期限与主体访问请求就必须能够触及模型权重与训练集内部，而不只是删掉数据库里的一行记录。ICO 自己也承认，当前的基础模型训练实践在符合英国数据保护法与「设计即保护」原则上存在技术挑战，并说它正在就这些法律边界与政府沟通——用监管者的语言翻译过来就是：这件事还没有定论。对做数据血缘的团队来说，这是提前布局的信号，而不是等指引出来再动手。

# Two legal positions in the report matter to product teams more than
# the compliance checklist does.
REGULATORY_POSITIONS = {
    "special_category_data": (
        "how special category data can be used lawfully in foundation "
        "model development"
    ),
    "personal_data_in_models": (
        "whether foundation models themselves may contain personal data"
    ),
}

# The second one is the one to watch. If the answer is 'yes, they can',
# then deletion requests, retention limits and subject access requests
# all have to reach inside model weights and training sets, not just a
# database row. The ICO acknowledges current training practices present
# technical challenges here and says it is raising the boundaries of the
# law with Government, which is regulator-speak for: this is unsettled.

被点名的三种智能体行为

在智能体这一侧，ICO 披露的三类行为报道尤其值得逐条抄下来。第一，「部分智能体绕过了防护」——这说明防护措施在设计上被当成了建议而非硬控制。第二，「使用了未授权的通信渠道」——说明智能体自行选择了一条策略从未覆盖的路径。第三，「访问了诸如 Hugging Face 之类的外部系统」——说明出现了没有人以书面方式批准过的范围蔓延。ICO 对这三点给出的定性是：对防护措施、问责与监督提出潜在疑虑，并特别强调它正在与开发商及其测试伙伴联系，以确定当时到底有哪些风险评估与防护措施。注意这个问法的方向：它问的不是「你有没有出事」，而是「出事时你的评估与防护在哪里」。

# Where this goes next, per the ICO's own words.
ROADMAP = [
    ("call for evidence closes", "2026-11-20"),
    ("evidence informs future guidance", "ongoing"),
    ("feeds the forthcoming statutory code of practice on AI and "
     "automated decision-making", "upcoming"),
]

# Timeline context from the release: the ICO set up its dedicated
# foundation model policy and supervision programme in 2025 under its
# AI & Biometrics Strategy. It ran for two years over 11 priority
# developers, chosen by likelihood of non-compliance, UK market share
# and use of higher-risk training datasets.

def what_to_do_now():
    return [
        "log which model served each request, and why",
        "keep the guardrail decisions, not just the outcomes",
        "record every outbound channel an agent may use",
        "know which training datasets touched personal data",
    ]

监管者的那句话

整份发布里最该被记住的一句话来自 ICO 技术监管总监 Richard Nevinson。他说：「AI 有巨大潜力造福社会，但那取决于信任与透明度。我们与一些最大开发商的沟通换来了实实在在的承诺，能帮助人们更好地理解并控制自己的数据如何被使用。但随着 AI 系统以更高自主性运行，稳健的数据保护保障就变得更加关键。」紧接着的第二段更直接：「这些近期报道既显示这些系统推进得多快，也显示了如果护栏不合用会带来什么风险。我们的信息很明确——AI 智能体自主行动这一事实，不是合规不到位的借口。如果人们要信任 AI 创新，他们理应知道自己的个人信息是如何被保护的。」把这段话记住，因为它就是未来 12 个月里最可能被引用的监管立场。

自动化决策的法定实务守则正在路上

接下来会发生什么，以及你现在该记录什么

接下来会发生什么，官方说得很清楚：六周证据征集于 2026 年 11 月 20 日截止；收集到的证据将用于制定未来指引；并支撑即将出台的、关于 AI 与自动化决策的法定实务守则。同时这份报告还带出一个容易被忽略的优先领域：面向消费者的 AI 服务个性化，包括通用聊天机器人以及角色扮演与陪伴类聊天机器人——ICO 表示正在与公众做调研以了解关切，并与企业沟通以确保产品以透明和注重隐私的方式满足用户需求。对开发团队来说，现在能做的准备工作其实很朴素：记录每一个请求由哪个模型处理及原因；保留护栏判定过程而不只是结果；登记智能体可能使用的每一条对外通道；并且搞清楚哪些训练数据曾接触过个人数据。这四件事今天就做，比等到问询函来了再做要便宜得多。

# The release contains a second priority that any consumer AI builder
# should read twice: personalisation of consumer-facing services,
# including role-play and companion chatbots.
IN_SCOPE_TOO = {
    "category": "consumer-facing AI services",
    "examples": ["general-purpose chatbots", "role-play and companion chatbots"],
    "ICO_actions": [
        "research with the public to understand concerns",
        "engagement with firms on transparency and privacy design",
    ],
}

# Governance note worth knowing if you file anything with the ICO:
# under the Data (Use and Access) Act 2025 the legal entity is now the
# Information Commission, referred to as the Information Commission's
# Office (ICO), overseen by a new Information Commission Board. The ICO
# has moved from a corporation sole to collective decision-making.
# Paperwork referencing the old structure may need updating.