Who is responsible when an AI agent buys, switches or cancels for you? UK regulators say the business still is
The CMA, FCA, ICO and Ofcom have set out a joint approach to personal AI agents. Existing law still applies, while confirmations, logs, monitoring and redress become more important as systems gain authority to act.
The short version
- What happened
- The CMA, FCA, ICO and Ofcom published a joint statement on personal AI agents and promised continued regulatory coordination.
- Who it affects
- A personal agent could save households time when comparing tariffs or managing subscriptions, but an incorrect switch or purchase can have immediate financial consequences. Confirmation and accessible human redress matter most for people with less time, confidence or capacity to correct an automated error.
- What remains unproven
- Joint policy statement
Keep in mind
Joint policy statement
Existing law, not new legislation
No certification scheme
No agent performance dataset
Mostly bounded deployment today
No enforcement outcome
CMA guidance first published 9 March and updated 30 October
Multi-source analysis · 2 linked sources. Primary analysed source date: 30 October 2026. Earliest linked supporting source: 9 March 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
Delegating a task does not delegate legal responsibility
The UK’s four main digital regulators—the Competition and Markets Authority, Financial Conduct Authority, Information Commissioner’s Office and Ofcom—have published a joint statement on personal AI agents. Their central position is that existing legal and regulatory frameworks continue to apply as agents move from giving advice to taking actions across shopping, finance, communications and online services. The statement coordinates current work; it does not create a separate licence or safe harbour for agent providers.
The CMA’s accompanying guidance is explicit: if an AI agent a business uses does something illegal, the business remains responsible. Systems should be trained around statutory and contractual rights, monitored for errors, bias, complaints and unintended outcomes, and changed quickly when problems appear. Consumer protection focuses on the effect on a person—not whether the steering, pressure or misleading choice came from a human, an interface or an algorithm.[1][2]
More autonomy raises the need for confirmation, records and redress
The regulators distinguish today’s mostly bounded deployments from the more ambitious idea of agents that continuously compare prices, cancel subscriptions, switch providers or make purchases. In that future, persistent personal data, delegated payment authority and cross-service access could save time but also amplify hidden incentives, hallucinated information, discriminatory outcomes, fraud and lock-in. A shopping or finance agent that optimises for a provider’s revenue may not be a faithful representative of the user.
Practical safeguards in the guidance include clear disclosure of limits and commercial ties, mandatory confirmation before high-impact or irreversible actions, human escalation, complaint monitoring, audit logs and liability when an agent exceeds instructions. What remains unproven is whether consumer agents can meet those expectations reliably at scale. Enforcement cases, incident data and comparable performance measures will show whether the framework produces protection rather than policy language alone.[1][2]
The distinction that matters
Responsibility follows the service, not the interface
The regulators map familiar obligations onto a system that can sense, decide and act for a user.
Before action
Disclose limits, incentives and permissions
The user can make an informed delegation
During action
Confirm high-impact steps and monitor behaviour
Autonomy remains bounded by the user’s intent
After failure
Preserve logs, escalation and redress
A business cannot avoid responsibility by blaming the agent