UK regulators on AI agents: existing law applies, and the CMA sets out what it expects of a business

On 30 October 2026 the Digital Regulation Cooperation Forum, or DRCF, published a three-page joint statement on AI agents. Its members are the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO) and Ofcom.

The statement is about personal AI agents, which act for a user, for example by making purchases or contacting businesses. The regulators say they welcome the technology and that it could change how people use digital services. They also say agents may amplify and speed up risks and bring new ones. Their examples are fraud and scams, personal data shared in ways users do not expect, and misleading recommendations, decisions or information.

The statement asks firms developing or deploying personal agents to think about six things. They are how a consumer can tell when and how the agent acts for them, and how authority to act is given. They also cover how personal data is used, and how commercial interests that may shape the agent's recommendations are made clear to users. The last two are who is accountable for the agent's decisions, and how people get redress when something goes wrong.

The regulators say "existing legal and regulatory frameworks apply to personal AI agents". They name competition, consumer and data protection law, online safety, financial services, payments and cyber security. They add areas outside their own remits, such as product safety. The statement also says an agent's autonomy does not reduce the responsibility of the organisation that deploys it to comply with the law.

The regulators say they already track the market, talk to firms that build and deploy agents, publish guidance, share intelligence and run sandboxes. They are working together and with Government to find gaps in compliance, and describe that work as progressing at pace. Where they reasonably suspect conduct that breaks the law and risks harm, they say they will not hesitate to use their powers.

The statement strongly encourages firms developing or considering personal agents to engage and test with the regulators early. Contact is through each regulator's website or the DRCF at drcf@ofcom.org.uk. The statement sets no new rule, deadline, consultation or fine figure.

Four regulators have said together that the laws they already enforce cover personal agents, without adding a new duty. A firm can read that as notice that an agent's mistakes are likely to be treated as the firm's own.

A product team can use the six points as a checklist, with evidence for each. That evidence can be a label in the interface, a record of what the user authorised and a data map. It can also be a disclosure of paid placements, a named owner and a complaints route.

A firm's own agent may answer its customers, which is the case the CMA guidance below covers. Its customers' personal agents may also arrive to buy from it or contact it, which is the case the DRCF statement describes.

Firms in financial services, payments or online services are also likely to deal with more than one of these regulators on the same agent. The statement names each remit, and the regulators say they share intelligence.

The CMA's guidance, Using AI agents: complying with consumer law, was first published on GOV.UK on 9 March 2026. It was updated on 30 October 2026, with the note that the DRCF joint statement had been published.

It is written for a business that uses AI agents with its customers. Its examples are handling customer queries, processing refunds, recommending products and running marketing campaigns. The CMA says the same rules apply whether the work is done by AI or by human agents, and that customers must be treated fairly either way.

The guidance says a business is responsible for what an AI agent does in the same way it is responsible for what an employee does. That holds even if someone else designed or provides the agent. When buying an agent from a third party, the CMA suggests using the guidance to discuss compliance with them.

Breaking consumer protection law can bring action from enforcement authorities, including the CMA. The guidance says a business could be fined up to 10% of its worldwide turnover, and possibly made to compensate affected consumers.

It asks a business to tell customers when they deal with an AI agent. That means considering a label so people are not misled into thinking a person is serving them, and saying so where it might affect their decisions. The guidance also says not to overstate what the AI does or can do.

The guidance asks a business to train the agent on the data it needs, and to prompt it to respect statutory rights and contract terms such as cancellation rights. Training also covers not misleading customers by what the agent says or leaves out, and obtaining consents properly. The guidance stresses testing, such as A/B testing and unit testing, and using the results to improve the agent before it goes live. A business that does not train the agent, or does not check that its provider has, may break the law.

The guidance asks for regular monitoring that the agent gives the right results and complies with consumer law, noting that models can hallucinate, or make things up. It asks for a human in the loop, actively checking the agent's decisions. When a problem appears, the business should fix it quickly, for example by refining prompts or workflows, especially at scale or with vulnerable customers.

The guidance gives four worked examples. A marketing agent must follow the Digital Markets, Competition and Consumers Act 2024. Prices include all unavoidable charges, paid endorsements are labelled, offers are genuine and someone with the right experience reviews the work regularly. The CMA's failure case is an agent that does not make influencers label endorsements.

A refund agent must apply the Consumer Rights Act 2015 for faulty goods, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 for a change of mind. It must also apply the business's own terms. The failure case is an agent that ignores an extended returns policy.

A customer service agent must answer accurately about prices, products and rights, give the information people need to decide, and not make rights hard to use. A deal comparison agent must disclose how much of the market it looked at, what data it searched and its limits. Its results must match the customer's criteria, and its coverage, ranking and links with suppliers must be disclosed. The guidance points to the DRCF AI and Digital Hub for case studies and to Business Companion for impartial legal guidance.

A companion CMA report, Agentic AI and consumers, has the same publication and update dates. It describes agents as systems that sense, decide and act, and says deployment today is mostly bounded and controlled. It is concentrated in customer service, commerce and sales, software and IT operations, and internal process automation. The report states that UK consumer law applies whether decisions are made by people or by AI.

The guidance compares an agent with an employee, so the training, supervision and correction a business gives customer-facing staff is a likely model for its agent. The guidance says a business that skips the training, or does not check a supplier's, may break the law.

Two of the CMA's failure cases suggest where agents are likely to slip. One is a business's own terms that go beyond the legal minimum, such as a longer returns period. The other is a labelling duty, such as marking paid endorsements.

Buying the agent from a vendor leaves the responsibility with the business. The guidance suggests discussing compliance with the provider, which can mean asking how the agent was trained and tested on the rules above.

Our analysis is that a US or Gulf company selling to UK consumers is likely in scope of UK consumer law for those sales. An agent serving those customers is then likely to be measured against this guidance.