Home › Answers › Data, privacy and GDPR
Can AI agents be trusted?
Short answer
Only with limits. AI agents can book, buy, reply and edit files for you, but the NCSC warns they "may interpret instructions and goals in literal or unexpected ways" and that built-in safety controls "may be bypassed". Give it minimal access, approve anything costly or customer-facing, and keep a way to stop it.
What the UK authorities say
- NCSC (August 2026): the more autonomy an agent has, the more controls it needs. Decide on red lines first, keep humans approving important actions, restrict what the agent can reach, give it its own limited credentials, log what it does, and keep the ability to "pull the plug".
- ICO (January 2026 report on agentic AI): agents raise data protection risks, including unclear responsibility, collecting more data than needed and weaker transparency. Your business stays responsible for complying with UK GDPR. The ICO's call for evidence on agentic AI is open until 20 November 2026.
Rules for a small business
- Start with suggestions, not actions. Let the agent draft and you send.
- Approve every payment, booking and customer message until you've watched it work for weeks.
- Give it a separate account with limited access, not your main email and bank login.
- Never let it read untrusted content and act on it unattended. A web page or email can contain hidden instructions (prompt injection).
- Check the bill. Agent features often run on credits, and long tasks use a lot.
- Keep a log of what it did, and review it.
Related questions
What is an AI agent?
An AI tool that carries out tasks on your behalf, such as filling in forms, sending emails or updating a spreadsheet, rather than just answering questions.
Are AI agents legal to use in the UK?
Yes. The usual laws still apply to what the agent does for you, including UK GDPR, consumer law and contract law.
How do I use AI agents for my business?
Pick one repetitive task, such as chasing unpaid invoices or sorting enquiries, and run it with approval switched on. See how to use AI in a small business.
Sources
- NCSC: managing the cyber risk of agentic AI (20 August 2026)
- ICO tech futures: agentic AI
- ICO: agentic AI call for evidence
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI read my WhatsApp messages?
- Can I put customer data into ChatGPT?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.