Can You Reconstruct the Last Action of Your Agent?
A useful test for any AI agent is simple: can the organisation reconstruct its permissions, actions and personal-data decisions?
On 8 October 2026, the ICO reported ten major model developers had implemented or pledged improvements following regulatory scrutiny. Its consultation on autonomous AI opened that day; responses are due by 20 November 2026.
This is evidence gathering and supervision, not new legislation or finished guidance. Promises are not certification. A separate examination of agent tests and deployment continues, without a published finding of wrongdoing.
Three regulatory signals need different responses
The practical responses below are BlackTree recommendations, not a checklist prescribed by the regulator.
| Signal | Current status | What an organisation can do now |
|---|---|---|
| Foundation-model supervision | Ten suppliers have implemented or promised clearer explanations, better data-rights mechanisms and safeguard reviews. Delivery will be monitored. | Check whether supplier claims are supported by contractual commitments and evidence that applies to the service you use. |
| Open evidence call | The consultation covers security, openness, accountability, machine-made decisions, fairness, purpose limits and lawful processing. | Use one real workflow to find where evidence is strong, missing or split between teams and suppliers. |
| Agent testing enquiries | The examination continues. It has not produced a published breach finding. | Review comparable test and rollout controls without attributing a legal conclusion to the organisations contacted. |
Agents can use tools, visit websites and reach external services. Governance therefore needs an execution trail showing permitted actions, supporting data and the person who can stop or reverse a result.
Build an evidence trail around one real task
BlackTree assessment: start with a single end-to-end agent workflow rather than a generic AI policy. Choose a task that touches personal data or can trigger an external action, then preserve evidence at each decision point.
- Define the purpose and data boundary. Record the business purpose, personal-data categories, lawful basis, retention rule and prohibited uses. Include data the agent can infer or retrieve through a tool.
- Map permissions. List the identities, tokens, applications, websites, repositories and communication channels available to the agent. Show the difference between read, write, approve and administer access.
- Place human decisions deliberately. Identify actions that need approval before execution, the information shown to the reviewer and the route for refusing or reversing an action.
- Keep a usable execution record. Capture the agent version, instructions, tool calls, material inputs, outputs, policy decisions, approvals, errors and resulting changes. Protect the log itself and set a justified retention period.
- Test misuse and failure. Exercise excessive permissions, manipulated content, data sent to an unapproved destination, repeated actions and attempts to bypass a control. Record the expected block, the observed result and the accountable owner.
- Connect rights and incidents. Make it possible to locate relevant records, correct or delete data where required, contain an agent and explain a consequential decision to the affected person.
Use the consultation without exposing sensitive details
Organisational responses may be published in full or summarised and considered under freedom of information law. Do not place secrets, personal data or unnecessary incident detail in a submission.
A useful response can describe the control pattern, the evidence it produces and where the law or guidance remains unclear. Keep the underlying sensitive records in the organisation’s controlled evidence store. The immediate benefit is a reviewable agent workflow, whatever follows after the consultation.
Sources
- ICO announcement on supervision and autonomous AI, 8 October 2026.
- ICO consultation page: submissions close on 20 November 2026.
Related: AI Agents Need Better Boundaries.
