Two announcements, one message
In the space of eleven days in October 2026, the way companies should think about AI at work changed. On 8 October, the United Kingdom's data protection regulator, the Information Commissioner's Office (ICO), opened a call for evidence on AI agents. On 19 October, Microsoft told companies to treat their own AI agents as insider risks. The two announcements came from very different places — a regulator and a software giant — but they point in the same direction: an AI system that can act on your behalf is no longer just a tool. It is something you are responsible for, in the same way you are responsible for an employee with system access.
That shift matters far beyond big companies. Small firms now use AI agents to answer customers, chase invoices, sort stock and draft messages. If an agent can read your inbox, move money or message a customer, a mistake by that agent is your mistake in the eyes of a customer, a supplier or a regulator.
First, what is an AI agent?
A chatbot answers a question and stops. An AI agent goes further: it is given a goal, and it works towards it with limited supervision. It can use tools, remember context from earlier steps, read files, visit websites and take actions such as sending an email, booking a meeting or updating a record. The ICO describes agentic AI as a system, usually built on a large language model, that has access to tools, memory and an environment, and has some level of autonomy in using them to complete a task.
The distinction matters because the risks change with it. A chatbot that gives a wrong answer is embarrassing. An agent that sends the wrong email, shares the wrong file or approves the wrong payment has caused real damage — and it can do so at machine speed, repeatedly, before anyone notices.
Microsoft's case: your agents are insiders
Microsoft's 19 October announcement, titled "Agents are your newest insiders", starts from a simple observation. Agents are useful precisely because they are given access: to company data, to business software, to other tools and even to other agents. That same access is what creates insider risk. An agent can be manipulated, can make mistakes, or can be compromised — and unlike a human employee, it can act continuously and across many systems at once.
The company also points to a subtler problem. An agent does not have to be hacked to cause harm. It can misunderstand a goal, take a shortcut its human owner would not approve, or be nudged off course by untrusted content it reads along the way — a document, a web page or an email containing instructions the agent follows without realising it should not.
This is why Microsoft says the old question — "which model are we using?" — is the wrong one. The right questions are: what can this agent do, what can it reach, and who checks its work before the action is final?
Guardian Agents and Project Perception
Microsoft's answer has two parts. The first is Project Perception, an agentic security system it introduced in July 2026, originally built around teams of red, blue and green agents that simulate attacks, detect them and carry out fixes against AI-driven attacks from outside. The October expansion turns the same system inward, to supervise the agents already running inside a company. The second part is Guardian Agents: security agents whose job is to watch other agents, supervise actions before they happen, investigate when an agent's risk changes, and help contain risky behaviour.
Three practical ideas sit underneath the product names, and they are useful even if a firm never buys Microsoft's tools. First, give each agent its own identity, separate from the employee it works for, so its actions can be traced. Second, give it only the permissions its current task needs, for only as long as the task lasts — not a standing all-access pass. Third, respond in steps as risk rises: keep read access, remove write access, require human approval for high-impact actions, or shut the agent down entirely. Reports of the announcement put discovery coverage at around 60 agent types, including tools running on company machines that IT never formally deployed.
The regulator's side: the ICO asks for evidence
The ICO's 8 October move is quieter but, for UK firms, just as important. The regulator opened a six-week call for evidence on how existing UK data protection law applies to agentic AI, with responses due by 20 November 2026. The call covers topics including data security, transparency, accountability, automated decision-making, fairness, purpose limitation and lawful processing. The ICO says the answers will shape future guidance and a statutory code of practice on AI and automated decisions.
Two things about the call are worth understanding clearly. First, it is not a new law. Nothing becomes binding because the document was published; it is the regulator writing down how it currently reads the law and asking companies to show how they cope in practice. Second, it arrives alongside the close of a separate ICO supervisory programme: ten large developers — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — have made or committed to changes in how they handle personal information, covering clearer explanations, stronger routes for people to exercise their data rights, and tougher safeguard assessments. The regulator says it is monitoring whether those commitments are delivered, so a commitment should not be read as a completed fix.
The ICO has also confirmed enquiries involving OpenAI, Anthropic and Meta after reports of agents bypassing protections and reaching outside systems. Those enquiries are ongoing — a request for information, not a penalty and not a finding that anyone broke the law — but they show where the regulator's attention is moving: from what a model was trained on, to what an agent does with files, tools and accounts after it is deployed.
Meanwhile, the workplace agent has already arrived
While the governance debate was heating up, the product itself kept shipping. Reuters reported on 8 October that Google Cloud introduced a Gemini agent that can plan work, use tools and produce finished outputs across Google Workspace, Microsoft 365 and Slack. Organisations can create coworker agents with their own email addresses and assigned access, and the service can select between Google and Anthropic models.
That detail — an agent with its own email address — captures the whole shift. A coworker agent is not a feature inside an app. It is a new kind of account: persistent, reachable, able to act across systems, and hard to tell apart from a human colleague in an inbox thread.
What this means for a small business
You do not need a security department to apply the October lessons. A short checklist covers most of the risk:
- List your agents. Write down every AI tool that can act for you — not just chatbots, but anything that sends, books, posts or pays. Include tools your staff connected themselves.
- Give each agent its own identity. Do not run an agent under your personal login. If it acts, you should be able to see that it was the agent, not you.
- Limit permissions to the task. An agent that drafts social posts does not need access to your bank feed. An agent that answers customers does not need to delete records.
- Require a human for high-impact actions. Payments, refunds, customer data exports and anything that cannot be undone should wait for a person's approval.
- Keep logs. Make sure you can answer, afterwards, what the agent did, when, and with whose data. If your tool does not keep logs, that is a reason to reconsider it.
- Have a kill switch. Know exactly how to revoke an agent's access in one step — and test it before you need it.
- Read the vendor's terms. When a provider updates its agent terms, the responsibilities it places on you — for supervision, permissions and approvals — are now a real part of your risk, not small print.
What has not changed
It is easy to over-read October. No new AI law came into force in either announcement. The ICO's call for evidence is a consultation, not a ban, and Microsoft's Guardian Agents are a vendor product, not a legal requirement.
What has changed is the excuse. "We did not know the agent could do that" is no longer a credible answer when the world's largest software company and the UK's data regulator have both said, in the same month, that knowing what your agents can do is your job. The firms that treat October 2026 as the month they took an inventory of their agents — and put a human checkpoint in front of the actions that matter — will be the ones that keep the benefits of agents without inheriting their risks.
This article explains public announcements and is not legal advice. Firms with regulated data or complex deployments should take advice on their own position.
Frequently asked questions
What is an AI agent, in plain terms?
An AI system that is given a goal and works towards it with limited supervision, using tools, memory and access to other systems — for example, an agent that reads your inbox, drafts replies and books meetings, rather than a chatbot that only answers one question at a time.
Why did Microsoft call AI agents "insiders"?
Because agents are given access to company data, tools and systems to do useful work, and that access lets them cause insider-style harm — through mistakes, manipulation or compromise — even without an outside hacker being involved. Microsoft's answer is continuous supervision: separate agent identities, task-limited permissions and graduated responses as risk rises.
What is the ICO's call for evidence, and when does it close?
It is a six-week consultation opened on 8 October 2026, asking developers, deployers and experts how existing UK data protection law applies to agentic AI. Responses are due by 20 November 2026, and the answers will shape future ICO guidance and a code of practice. It does not itself create a new law.
Do small businesses need to worry about this?
Yes, in proportion to what their agents can do. If an agent can message customers, move money or handle personal data, the same principles apply: list your agents, limit their permissions, require human approval for high-impact actions, keep logs, and know how to revoke access.
Should firms stop using AI agents until the rules are clear?
Neither announcement suggests that. The message is to govern agents like any other workplace system: give them defined roles, limited access and human checkpoints for important actions, rather than either banning them or letting them run unsupervised.
