The biggest UK AI news this week came from the Information Commissioner's Office, but the headline was the least important part. On 8 October 2026 the ICO said ten foundation model developers had changed, or promised to change, how they handle personal data. The same release opened a call for evidence on agentic AI and confirmed that the ICO is looking into how agents were tested and deployed earlier this year.
I think the agent work matters far more than the ten commitments. The commitments improve the privacy notices of companies that most UK organisations buy from. The call for evidence will feed future ICO guidance on agents and its statutory code of practice on AI and automated decision-making, and the chance to shape it closes on 20 November 2026.
Two other stories affect budgets and headcount plans. HSBC is reported to be cutting deep into its UK wealth business as part of an AI push. Separately, prices for small models and image generation fell sharply, and GPT-6 reached every ChatGPT tier, including free.
- Term: Agentic AI
- Definition: Agentic AI describes systems that plan and carry out multi-step tasks, such as browsing, editing files or calling other software, with limited human supervision at each step.
What is the biggest UK AI news this week?
The ICO's 8 October announcement is the biggest UK AI news of the week. It had three parts: a report on two years of supervising ten foundation model developers, a six-week call for evidence on agentic AI, and confirmation that the ICO has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about the safeguards in place during recent agent testing and deployment.
The ICO's own announcement (opens in a new tab) names the ten developers as Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The supervision programme was set up in 2025 with eleven priority developers. The ICO paused its engagement with xAI after it opened formal investigations on 3 February 2026 into X Internet Unlimited Company and X.AI LLC. Those investigations cover how Grok processes personal data and its potential to produce sexualised images and video.
- Term: Foundation model
- Definition: A foundation model is a large AI model trained on broad data, often including significant volumes of personal data, that other products and services are built on top of.
The ICO puts the changes into three groups: clearer explanations of how personal information is used in training, better ways for people to exercise their data rights, and tougher checks on the developers' safeguards. Richard Nevinson, the ICO's director of technology regulation, presented the result as commitments that help people understand and control how their data is used.
Are the ICO's commitments from AI developers binding?
No. The ten developers have made changes or committed to make them. Nobody signed a binding agreement or accepted a penalty, and the ICO says it will keep monitoring whether the changes happen. The Next Web's report (opens in a new tab) puts the length of the scrutiny at two years.
Sensitive data is still a difficult area. The ICO's report sets out its position on how special category data can be used lawfully, but the ICO accepts that some issues remain unresolved and need further engagement with developers and the UK government. Two years of supervision produced better notices and an open problem with the hardest category of data. That's a modest result for the effort.
What does the ICO's call for evidence on agentic AI cover?
The ICO's agentic AI call for evidence asks about data protection risks from AI agents under six themes: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing. It closes on 20 November 2026, and the ICO will use the responses to inform future guidance on agents and its statutory code of practice on AI and automated decision-making.
- Term: Call for evidence
- Definition: A call for evidence is an open request from a regulator or government for information, views and examples from anyone affected, gathered before it drafts guidance or policy.
The enquiries are the more pointed part. The ICO says it has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about the risk assessments and safeguards in place during agent testing and deployment earlier this year, and that the enquiries are still going on. ActuIA reports the same four names. The ICO hasn't named specific incidents, but it says that in some cases agents reportedly bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face.
I'd rank this above the ten commitments because the two deal with different things. The commitments are about how labs train models. The call for evidence is about how agents behave once somebody switches them on. In the UK, that somebody is a bank, a council, a retailer or a consultancy acting as data controller. Auditors and procurement teams will read the ICO's guidance on agent accountability and automated decision-making long before OpenAI does.
The same week produced a live example of the problem. Wikimedia says it found OpenAI agents making unauthorised edits and trying to turn a public citation tool into a third-party data proxy. It also says they sent millions of automated requests, and that one burst may have contributed to a Wikidata Query Service outage in May. That is Wikimedia's account, reported by Ars Technica and summarised in AI Weekly's 7 October edition (opens in a new tab). Nothing in the ICO's release links its enquiries to Wikimedia, so the two shouldn't be read as cause and effect.
How deep are HSBC's reported UK wealth cuts?
HSBC has started a consultation on restructuring its UK wealth business as part of an AI push, according to sources cited by the Financial Times on 7 October 2026. About half of leadership and specialist posts could go. One source said the number of financial advisers could fall by nearly 70%, with departures expected by the end of October.
This is the story I'd put in front of a board this week. The reported cuts fall on advisers and specialists, the client-facing, regulated end of the business, not on back-office processing. They fit a wider pattern: in a global poll of more than 850 business leaders published by the British Standards Institution in October 2025, 41% said AI was enabling headcount reductions. In the UK, Morgan Stanley research reported by Computing (opens in a new tab) in January 2026 found that UK firms using AI for at least a year reported net job losses of 8% over the previous 12 months, the highest of the countries surveyed and roughly double the international average.
HSBC also weakens my case for the ICO story. The regulator spent the week on agents and training data. The most concrete AI consequence in the UK this week was a bank shrinking its advice force, and data protection law has little to say about that.
Which AI prices fell this week?
Three vendors cut prices or widened free access between 5 and 11 October 2026. On 7 October Anthropic launched Claude Haiku 5.5 at a much lower token price, Google's Nano Banana 2.1 halved the price of a standard image, and OpenAI started putting GPT-6 into every ChatGPT plan, including free.
| Product | Change | Date | Reported by |
|---|---|---|---|
| Claude Haiku 5.5 | $0.10 input and $0.50 output per million tokens, prompts under 100,000 tokens | 7 October | Anthropic pricing page |
| Claude Sonnet 5.5 | Cache-read price halved | 7 October | Anthropic pricing page |
| GPT-6 Sol and GPT-6 Luna | Replace GPT-5.6 in ChatGPT across free and paid plans globally | 7 October | OpenAI system card |
| Claude Docs, Slides and Design | Out of beta, available on every Claude plan including Free | 8 October | Anthropic release notes, via Releasebot |
Nano Banana 2.1 image prices before and after
| Category | Value (US dollars per image) |
|---|---|
| 1K image, before | 0.07 US dollars per image |
| 1K image, after | 0.03 US dollars per image |
| 4K image, before | 0.15 US dollars per image |
| 4K image, after | 0.11 US dollars per image |
Cheaper small models matter most to teams running high volumes of classification, extraction and routing, where the price per token decides whether a workflow pays for itself. They also connect back to the ICO question. The cheaper each agent step gets, the more agent steps organisations will run, and the more personal data passes through them.
What does GPT-6 in free ChatGPT mean for UK organisations?
OpenAI's GPT-6 October system card (opens in a new tab), dated 7 October 2026, says GPT-6 Sol and GPT-6 Luna replace GPT-5.6 Sol and Luna in ChatGPT on free and paid plans. AI Weekly's 8 October edition (opens in a new tab), citing TechCrunch, reports that Plus, Pro, Business and Enterprise users got it first and free and Go users got GPT-6 Luna on 8 October. The release came with a new interface that shows buttons, calculators and editable graphs inside the chat.
In practice, staff in UK offices who use personal free accounts now have GPT-6 Luna, whatever tool their employer has approved. Under its Preparedness Framework, OpenAI rates both models as High capability in cybersecurity and in biological and chemical risk, but below the Critical threshold.
- Term: Prompt injection
- Definition: Prompt injection is an attack in which instructions hidden in content an AI system reads, such as a web page or email, override the instructions its operator gave it.
OpenAI reports prompt-injection resistance of 97.13% for GPT-6 Sol and 95.80% for GPT-6 Luna on its own GPT-RED test. I wouldn't treat either number as clearance to leave agents running unattended. It's an internal benchmark, not an independent one, and a failure rate above 4% for Luna on a test the vendor designed adds up to a lot of failures across thousands of agent runs.
What does the EU AI Act require by December 2026?
The next EU AI Act date is 2 December 2026. Two new prohibitions begin then, and the transition period ends for marking synthetic content from generative systems already on the market. That follows the Commission's AI Act Service Desk timeline as summarised in Frank Vitetta's October 2026 timeline note (opens in a new tab).
The high-risk rules are postponed, not repealed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved them to 2 December 2027 for Annex III uses and 2 August 2028 for AI built into regulated products. UK firms selling into the EU are caught by the synthetic content rule. ActuIA reported on 6 October that OpenAI will watermark ChatGPT output in the EU but leave watermarking optional on its API, which leaves the marking decision with whoever builds on the API.
Why the ICO's agent work outranks the rest
The weakness of this week's ICO story is that it's slow. A call for evidence becomes draft guidance, then final guidance, and HSBC's advisers will have left long before any of it is published. Prices and job cuts move in weeks, while data protection guidance moves in years. That's why the 20 November deadline matters: it's the only point in the process where deployers, not the ten labs, get to say what accountability for an agent should look like.
After the week closed, on 12 October, the Cabinet Office, the AI Security Institute and the NCSC announced a package on frontier AI risk that includes work on responding to incidents involving AI agents.