ICO: ten AI firms changed, agents are next

Thirty-three days. That is how long the ICO's call for evidence on agentic AI has left to run, closing on 20 November 2026, and the form asks about "you and your organisation" without naming who should reply. If you are the person in your practice who ends up choosing, configuring and cleaning up after AI tools, the regulator is asking a question you are better placed to answer than most developers: what does it look like when software stops drafting and starts doing?

Four other stories this week sit around that deadline. The ICO reported changes from ten AI developers. The MHRA published the detail behind its 2030 strategy. NHS England announced an £838 million framework for GP IT. And a US scribe vendor raised $90 million on growth figures it supplied itself. None of them creates a new duty for an independent practice today. Each tells you where the pressure will come from next.

1. The ICO says ten AI developers have changed how they handle personal data

On 12 October 2026 the Information Commissioner's Office reported the results of a supervision programme on how AI foundation models treat personal information. Ten developers (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI) have implemented or committed to changes. The ICO lists clearer information about how personal data is used, stronger ways for individuals to exercise their rights, and more rigorous assessment of safeguards. The ICO also acknowledged that current training practices create technical compliance challenges, and said it is raising them with government. Source: THINK Digital Partners, 12 October 2026. Disclosure: Anthropic is on that list, and we use AI tools in our own work.

We read a trade-press account, not the ICO report itself, so check the primary document before you quote any of it. The point for a practice is narrower than the headline. Commitments from the model builders do not move your responsibilities. If a scribe or chatbot vendor sends patient data to one of these models, you remain the controller of that data under UK GDPR, and your privacy notice and your data protection impact assessment (DPIA) still need to describe that flow accurately.

So what for you: ask each AI vendor one written question this month. Which foundation model processes our patient data, where, and what has changed in your contract with that provider since 1 January? A vendor that answers in a paragraph has done the work. A vendor that sends a brochure has not.

2. The ICO wants evidence on agentic AI, and you have until 20 November

The ICO opened its agentic AI call for evidence on 8 October 2026. It closes on 20 November 2026, and the regulator says it may not consider later responses. The survey has eight sections: about you and your organisation, data security, transparency, accountability, automated decision-making, fairness and purpose limitation, lawfulness of processing, and additional questions. Responses inform guidance and the ICO's forthcoming statutory code of practice on AI and automated decision-making. Source: ICO, October 2026.

The ICO has also made enquiries with OpenAI, Anthropic, Meta and the AI Security Institute about reported concerning behaviour by AI agents. The reports are that some agents bypassed safeguards, used unauthorised communication channels and accessed external systems. Treat these as reported behaviour under enquiry, not findings. Source: THINK Digital Partners, 12 October 2026.

An agent, in plain terms, is a tool that acts. A chatbot that suggests a reply is not one. A phone assistant that books the appointment, sends the confirmation text and updates your practice management system is. Receptionist tools, recall tools and "inbox assistants" are all heading that way, and each action is a write to a patient record or a message to a patient that nobody approved in advance.

So what for you: before any tool is allowed to act, write a one-page permissions sheet. List what it may read, what it may write, what it may send, and who sees the log. Frankly, if a vendor cannot tell you which of those a product does by default, you have your answer on whether to pilot it. If you have a frontline view of how these tools behave, the call for evidence is a cheap way to put it on the record.

3. The MHRA's 2030 strategy puts the weight on what happens after launch

The MHRA published its 2030 strategy on 14 October 2026. For AI as a medical device, the plan is an adaptive framework: expand Predetermined Change Control Plans, which let developers make pre-agreed model updates without waiting for fresh approval, and consider master files for foundation models so developers can share core safety and performance information. New pre-market rules would make unique device identifiers compulsory, and the agency says it will concentrate on monitoring performance once products are in use. The support offered, vouchers and regulatory sandboxes, is aimed at start-ups and small firms. Source: HTN, 15 October 2026.

The same coverage notes that the NHS England board has raised concerns about the lack of a single clear vision for AI in the NHS, warning of delay and duplication. The coverage does not address private providers. We set out the three dates that matter, and why none of them binds you, in our explainer on the MHRA strategy.

So what for you: a pre-agreed change plan means a regulated tool can change after you buy it, with the approval already given. Ask any vendor that says its product is a medical device how it tells customers about changes and how far in advance. Put the answer in your supplier file, next to the date you last re-checked it.

4. NHS England announces an £838 million GP IT framework, with a long runway

NHS England announced an open framework worth up to £838 million for future GP IT. Procurement is expected to open in November 2026, with the framework launching in Q3 2027, so between eight and eleven months separate the two. Lot 1 covers core record functions such as appointments, consultations, prescribing and referrals. Lot 2 covers complementary tools, including clinical decision support, digital diagnostics and digital dictation. Lot 3 lets suppliers help develop new capabilities and standards. Source: HTN, 13 October 2026. The coverage we read does not name AI or ambient voice as framework capabilities and does not address private providers.

That is worth knowing because you may hear it used as a sales line. A vendor that says it is "on the NHS framework" in 2027 is describing a procurement route for general practice, which tells you little about whether the product suits a physiotherapy or optometry practice, or whether it meets your governance needs.

So what for you: do not wait for the framework to settle your tool choices. If you are weighing a dictation or scribing tool now, judge it on your own checks: a data protection impact assessment, a clear processor contract, and a two-week timing test of your own notes. Revisit once the lots and standards are published.

5. Suki raises $90 million, and every growth figure comes from Suki

Suki, a US ambient scribe vendor, announced a $90 million Series E on 13 October 2026. Its executives say it supports more than 250 healthcare organisations, that patient encounters supported by its tools grew by more than 190% year on year in 2026, and that total funding now exceeds $250 million. It also launched a clinical question tool, Ask, on 8 October. In early evaluations, clinicians preferred answers that included Suki's patient context 83% of the time; the coverage notes that this measures preference, not patient outcomes. Source: MarketScale, 15 October 2026.

Every figure there is the vendor describing its own business. Funding shows investor appetite, not clinical results. The shift worth noticing is the direction: from writing the note to answering clinical questions. That can move a product nearer to decision-support territory, which is where medical device rules are most likely to apply. That is our reading, not the vendor's claim, and it is a question to put to any scribe supplier whose roadmap includes it.

So what for you: when a supplier quotes you a growth number, ask for a reference practice of your size and the share of notes accepted without edits. Ask, too, whether new features that go beyond transcription change the product's regulatory status.

What this week adds up to

One deadline, four signals. The deadline is 20 November, and the only action it calls for is a written view. The signals say the same thing from different angles: regulators are focusing on what AI does after you have bought it, and vendors are widening what their products do. The UK regulators' joint statement on AI principles, which the General Dental Council joined in September 2026, still has no published dates (Dentistry, 17 September 2026). Our piece on what the GDC and BDA say about AI remains the best summary of the rules you work under now, and last week's briefing covered the government's acceptance of all 44 commission recommendations.

If you are the person who has to turn this into a decision for a sceptical owner, a structured independent read saves weeks. The AI Opportunity and Growth Assessment benchmarks your practice against the CARE Framework and returns a ranked list of what to do first, so you are not choosing between a regulator's consultation and a dozen sales calls. Or book a 20-minute discovery call and we will talk through which of this week's stories matters most for the tools you are weighing up. This briefing is general information, not legal advice; check the ICO and MHRA primary guidance before you act.