Summary

• The CMA, FCA, ICO, and Ofcom published a joint position through the Digital Regulation Cooperation Forum on 30 October.
• Existing consumer, financial, privacy, and communications law continues to apply to activities performed using AI agents.
• Regulators will coordinate research and supervision while monitoring how personal agents interact with consumers and businesses.

Four UK regulators have agreed a coordinated approach to personal artificial intelligence agents, setting out how existing consumer, financial, privacy, and digital regulation will apply as software begins carrying out more activities on people’s behalf.

The Digital Regulation Cooperation Forum (DRCF) published the joint position on 30 October on behalf of the Competition and Markets Authority (CMA), Financial Conduct Authority (FCA), Information Commissioner’s Office (ICO), and Ofcom. Their work covers systems capable of pursuing tasks through multiple services, rather than limiting AI to generating information or answering questions.

Personal agents may compare commercial offers, communicate with suppliers, manage purchases, or carry out other activities under instructions from their users. As these applications become more autonomous, a single task can involve several organisations and different categories of regulated activity.

The regulators intend to share evidence and coordinate their responses while applying the legislation already governing those services. Their statement does not introduce a separate licensing system or new statutory duties for every AI agent, but it establishes a common approach to questions that increasingly cross regulatory boundaries.

Consumer obligations follow the automated transaction

Businesses using AI agents to interact with customers remain responsible for complying with consumer law. An automated system may answer questions, recommend products, process cancellations, or arrange refunds, but the organisation deploying it cannot transfer its legal responsibility to the software.

The CMA’s guidance makes clear that responsibility also remains with the business when an agent was developed by an external supplier. Companies procuring AI services must therefore consider how the systems will operate within their particular commercial processes, including the information they provide and the actions they are authorised to take.

A customer seeking a refund, for example, retains applicable statutory rights even when the request is handled automatically. An agent configured to discourage cancellations or withhold relevant information could expose its operator to enforcement action if the resulting conduct breaches consumer protection law.

Under the CMA’s direct consumer enforcement powers, serious infringements can lead to substantial penalties, including fines of up to 10% of worldwide turnover. The use of automated technology changes the means through which a service is delivered, rather than removing those consequences.

Transparency also influences compliance. A company may need to explain that an interaction involves AI when otherwise the customer could be misled about who is providing the service. The information given about the agent’s capabilities must also be accurate, particularly where customers rely on it when deciding whether to complete a transaction.

Autonomy changes the operational controls

Software that merely suggests an answer can leave a person responsible for deciding what happens next. An agent authorised to complete an action introduces another stage of operational risk because an inaccurate interpretation may result in a purchase, cancellation, disclosure, or other change before a human has reviewed the decision.

Those risks can arise from incomplete instructions, unreliable information, changing websites, or errors as the system coordinates several steps. A task that appears straightforward when described in natural language may require the agent to interpret terms, select between alternatives, and exchange information with external services.

The CMA advises businesses to test their agents before deployment and monitor their behaviour during operation. Those controls need to examine whether the system respects consumer rights and contract terms, obtains required consent, and avoids misleading customers.

Testing may include structured scenarios and comparisons between expected and actual results, while ongoing monitoring helps identify problems that emerge after the software is introduced. Organisations also need arrangements for correcting an agent quickly when its behaviour creates unlawful or potentially unlawful outcomes.

Human oversight is particularly relevant where errors could cause financial harm or affect vulnerable customers. Businesses must decide which activities can proceed automatically, when confirmation is appropriate, and how an employee can investigate or reverse an unintended result.

Personal information can cross several services

An agent arranging travel could require access to a user’s location, preferences, identity information, and payment details. Completing the task may involve exchanging some of that information with transport companies, booking services, and payment providers, bringing several data-processing relationships into a single interaction.

The ICO’s responsibilities remain relevant throughout that process. Organisations must consider the lawful handling of personal information, the purposes for which it is used, appropriate security controls, and the rights of individuals whose data is processed.

As agents become capable of retrieving information automatically, the permissions granted to them will influence both functionality and risk. Broad access may reduce the number of times a user needs to intervene, but it can also increase the amount of information available to the system and the consequences of an incorrect action.

Organisations will therefore need to align access controls with the activities the agent is expected to perform. Logging, data minimisation, retention arrangements, and mechanisms for reviewing unusual behaviour can help establish what happened when a transaction or disclosure is disputed.

The ICO has been examining these questions through its wider work on agentic AI, including how data protection obligations apply when systems move between information sources and external services. Cooperation through the DRCF allows that work to inform the approaches taken by regulators responsible for the other activities involved.

Commercial choice and financial services intersect

Personal agents may influence competition because they can determine which suppliers, products, or offers are presented to users. A recommendation could be affected by the information available to the agent, its commercial integrations, or incentives attached to particular transactions.

The CMA’s interest extends to whether those arrangements preserve informed consumer choice and comply with competition and consumer law. An agent choosing between suppliers may reduce search costs, although customers still need to understand relevant limitations or commercial relationships affecting the result.

Financial services introduce additional responsibilities when an agent interacts with regulated providers or processes activities subject to FCA requirements. The obligations depend on the activity and the organisations involved, rather than simply on the technology’s description as an autonomous agent.

Ofcom contributes its responsibilities for relevant communications and online services, while the four organisations can use the DRCF to examine problems involving more than one regulatory regime.

The coordination is intended to reduce gaps in understanding as businesses introduce systems that operate across several markets. It does not mean that every regulator has identical powers over every application.

Existing law provides the starting point

The DRCF members will continue monitoring the development and adoption of personal agents, sharing evidence and working with government as their capabilities and commercial uses change. Further guidance may emerge from individual regulators within their existing remits.

Businesses developing or deploying these systems already have obligations concerning the services they provide. Procurement decisions, technical safeguards, customer communications, and processes for correcting errors need to reflect those responsibilities before an agent is allowed to act independently.

The joint approach gives regulators a means of examining emerging activities without waiting for a single overarching AI agent law. As agents undertake more consequential transactions, the effectiveness of those existing protections will depend on how organisations implement and supervise the systems.