Regulators on AI agents: you deploy it, you own it

On 30 October the Digital Regulation Cooperation Forum, which brings together the CMA, FCA, ICO and Ofcom, published a joint statement on personal AI agents: software that acts for people, such as making purchases or contacting businesses. The CMA updated its GOV.UK guidance on complying with consumer law when using AI agents the same day. The message from both is that consumer, data protection, competition, financial services, online safety and product safety law already apply to agents, without any new AI-specific legislation.

For an established UK operator, this closes off a tempting assumption: that an agent handling customer messages, refunds, bookings or supplier contact sits in a grey area until Parliament acts. The CMA is plain that if an agent you use breaks the law, you are responsible, and the regulators say an agent's autonomy does not reduce the responsibility of the organisation that deploys it. Because one agent can touch several regimes at once, a single slip could draw interest from more than one regulator.

Before an agent goes in front of customers or suppliers, list what it can do on its own, which rules each action touches, and where a person signs off. Keep its actions logged and reversible, test it against your refund, complaints and data-handling policies, and make sure the contract with your AI provider is clear about who does what if something goes wrong. If you cannot explain what the agent did and why, it is not ready to go live.

This is how we already build. Every integration we deliver uses scoped access, a full audit trail and human approval on high-stakes actions by default, so the deploying business can show its working. If you are weighing up an agent for customer service, scheduling or supplier contact, the free Data Readiness Score is a sensible first step, and a contained six-week Pilot on one workflow lets you prove the controls before you scale.