AI personal data: ten firms agree changes after ICO review

What happened

Amazon, Google, Microsoft and OpenAI are among ten AI companies that have agreed to changes in how they handle personal data, following scrutiny from the UK's Information Commissioner's Office (ICO), according to reporting by The Register. The regulator has not closed its questions, and the ICO's review is continuing.

The reporting names four of the companies and says six more have joined the commitments. The summary available for this briefing does not set out the specific changes each company has agreed to, so readers who need those details should consult the original article before relying on any particular commitment.

Why it matters

Large AI models are built and run on enormous volumes of data, and much of that data can relate to identifiable people. When a regulator examines how that data is used, the question shifts from abstract AI principles to the practical handling of personal information: what is collected, how it is used to train and operate systems, and what individuals are told and can control. For organisations deploying AI in customer-facing services, these are no longer back-office compliance concerns. They determine whether customers feel informed and in control when an AI feature touches their details.

The fact that commitments are arriving while the ICO's inquiry remains open also matters for planning. Leaders should expect that expectations around AI and personal data will be shaped through ongoing dialogue with regulators, not a single settled ruling. That makes it important for digital transformation teams to design data governance that can adapt as those expectations change, rather than treating a current compliance position as permanent.

By the numbers

• 10 companies have agreed to changes: four named in the reporting (Amazon, Google, Microsoft and OpenAI) and six others.
• 8 October 2026 is the date of The Register's report on the commitments and the ICO's continuing questions.

The Renascence take

Most readers will treat this as a privacy headline. The more useful signal is that the industry is responding to a regulator while the regulator is still asking questions, which means the customer experience of AI will be shaped by a continuing negotiation rather than a fixed rulebook.

Voluntary commitments are a starting point, not a destination, and customers rarely experience them as policy; they experience them as a consent screen, a privacy notice or a sense that a product is quietly making decisions about them. The behavioural principle underneath is simple: trust collapses when people discover data use they did not expect, so transparency has to be designed into each touchpoint, not appended to a policy page. A customer-obsessed operator should map every place where AI features draw on personal data, test whether a non-expert can explain what happens to their information, and build the ability to change those flows quickly as expectations evolve.