An AI agent can reach the data. That does not settle its use.

An agent helping a marketing team understand a customer complaint might need to read the correspondence, check the product terms and prepare a response. Once the task is complete, it could also propose remembering the case, identifying similar customers or using the exchange to improve future campaigns. Those possibilities may look like extensions of the same helpful service. They raise different questions about why the information is being used.

On 8 October 2026, the ICO launched a call for evidence on agentic AI, alongside an announcement about its supervision of foundation model developers. The call will inform future guidance; it is not a new permission to process personal information or a completed regulatory judgement on every agent architecture. Its importance lies in the shift of attention towards what systems do after deployment, when they can retrieve information and take actions with limited human oversight.

For organisations introducing agents into expert work, that shift exposes a weakness in an access-led approach to governance. A connector can establish that an agent is technically able to read a record. It cannot, by itself, establish that every subsequent use of that record is legitimate.

The purpose travels less easily than the information

The ICO’s current purpose limitation guidance requires organisations to identify why they process personal information and consider whether a proposed new use is compatible with the original purpose. They also need a lawful basis for the processing. Where the retained information includes health data or other special category data, they must also identify an applicable condition under Article 9 of the UK GDPR. The rules differ according to the circumstances, including whether the original collection relied on consent. Neither an internal system permission nor a model’s ability to find a useful pattern resolves those questions.

Consider an illustrative complaint about a financial product. The correspondence might reveal a health condition, a bereavement or financial difficulty because the customer needs support. A reviewer may need that context to assess the response. An agent generating a future promotional campaign does not acquire an equivalent justification merely because the information sits in the same customer platform. The workflow must distinguish the reason the record exists from the reason the next task wants it.

That distinction is easy to lose when software treats context as a resource to maximise. A document is retrieved, summarised and copied into a working memory; another agent receives the summary; a later task searches the memory rather than the original system. At each step, the information can become more useful and less visibly connected to the conditions governing its use. The organisation may still be able to identify who accessed the source while struggling to explain where its contents went afterwards.

The practical control therefore needs to sit at more than the entrance to the database. It should make the task’s purpose explicit and distinguish reading information from retaining it, sharing it or using it to infer something new. These are design implications of the purpose problem, rather than a prescribed architecture in the ICO’s call for evidence.

Remembering the judgement may require less of the case

The strongest argument for organisational memory is that teams should not have to rediscover settled expertise every time a familiar problem appears. That does not mean they must preserve every personal detail of the work that produced it. A complaint review might establish that a particular fee explanation causes confusion, that an exception requires specialist approval or that a certain claim needs stronger evidence. Some of that learning may be captured as a procedure or a rule without carrying the customer’s story into future tasks.

This is the distinction explored in what an AI agent should remember from expert work: the reusable part of a decision is often its criteria and reasoning, together with the conditions that limit its application. A complete case history can contain useful evidence, but it can also preserve details that the next task does not need.

A sensible memory design starts by asking which element will help future work. If the lesson concerns an explanation of product charges, a generalised account of the misunderstanding may be sufficient. If a specialist must revisit the individual case, the original record can remain available within the appropriate workflow. There is no need to treat a reusable procedure and a customer file as the same object simply because both can be represented as text.

Removing a name is not enough to settle the matter. A distinctive combination of facts can still identify someone, and a summary can preserve sensitive information even when the original document is no longer attached. The organisation needs to assess the information it actually retains, rather than assuming that compression has made it anonymous. Access restrictions, retention decisions and the route back to the source remain relevant wherever personal information survives.

A useful agent knows when the task has changed

An agent can move between actions more fluidly than a conventional form or fixed workflow. That makes purpose changes harder to spot if the business relies on a person noticing that a helpful suggestion has crossed into a different activity. The system should be able to stop when a task moves beyond the conditions under which its information was supplied.

In practice, a marketing brief could define the approved sources, the information needed for the work and what may be retained afterwards. A request to use complaint correspondence for audience selection would then be visible as a separate proposal, with a separate assessment, rather than an incidental step in drafting copy. The point is to make consequential changes legible before the agent acts on them.

Oversight also needs an intelligible record. Logging that a file was opened helps with investigation, but it says little about whether its contents were incorporated into a campaign, transferred into a memory store or used to make an inference. The questions about meaningful human control in financial services apply here: someone needs enough information and authority to challenge what the system is doing.

There are limits to the argument. Reuse is not automatically prohibited, and some further processing may be compatible or otherwise permitted under the applicable rules. Nor does every useful organisational lesson contain personal information. The work is to identify those distinctions accurately, with specialist input where the circumstances demand it, rather than turning every memory operation into an identical approval ceremony.

An organisation becomes more intelligent when it can carry learning forward without carrying every restriction and exposure of the original case into the next one. The valuable inheritance is the judgement: what mattered, why it mattered and when that reasoning should be reconsidered. More persistent access is only one possible means of achieving it, and often a less precise one.