UK AI Agent Consumer Protection Guidance

Overview

The Competition and Markets Authority’s Complying with consumer law when using AI agents is business-facing guidance published on 9 March 2026. It explains how businesses can use agentic AI to engage with customers while complying with existing consumer protection law. Examples cover customer queries, refund processing, product recommendations, marketing campaigns, and deal comparison services. The CMA recognises potential benefits for productivity, efficiency, economic growth, and customer experience, and connects responsible deployment with consumer confidence.

The guidance is published and active, but is not independently binding legislation. Its recommendations explain existing legal responsibilities rather than creating a separate AI regulatory regime. Using AI does not change a business’s responsibility to treat consumers fairly: the same consumer-law principles apply to human interactions, AI interactions, and information generated by an agent. Businesses remain responsible for unlawful agent conduct, including where another organisation designed or supplies the agent. The guidance creates no separate AI licensing system, statutory implementation deadline, transition period, or standalone penalty.

Definitions and Scope

The guidance uses ‘AI agents’ and ‘agentic AI’ for AI applications carrying out business functions such as handling queries, processing refunds, recommending products, and managing marketing. Its practical scope includes direct interaction with customers and indirect effects, including material produced for marketing campaigns. Compliance therefore depends on the task performed and its effects on consumers, rather than a technical label. The document does not establish a formal statutory definition, minimum level of autonomy, or legally defined agent risk tiers.

‘Hallucination’ describes nonsensical or inaccurate results an AI model can generate, including through misinterpreting data. A ‘human in the loop’ means active checking that decisions are correct, results are expected, and tasks are completed lawfully; merely making a person theoretically available is not the operational approach described. Prompts and workflows are mechanisms for refining performance. Statutory rights, contractual terms, and necessary consumer-law consents derive their substance from applicable legislation and customer contracts. Vulnerable customers receive particular attention when identifying the urgency of corrective action, without a new vulnerability definition or classification procedure.

Governance and Regulatory Context

The CMA issues the guidance in its consumer protection role and identifies enforcement authorities, including itself, as potential sources of action against unlawful conduct. A deploying business remains responsible for its agent in the same way that it is responsible for an employee’s conduct. Purchasing an agent from a third party does not remove this responsibility. Businesses should discuss consumer-law requirements with suppliers and check that externally provided agents have been appropriately trained. The document does not mandate an AI compliance officer, internal committee, accreditation scheme, new supervisory authority, or particular organisational structure.

The official publication page records an update on 30 October 2026 adding information about a Digital Regulation Cooperation Forum joint statement on protecting people and businesses in an agentic AI economy. The notice describes work across the CMA, Financial Conduct Authority, Information Commissioner’s Office, and Ofcom, continued collaboration with government, and the application of existing frameworks as personal agents grow. It supplements institutional context without substantively amending the March guidance, transferring business accountability, or creating a joint approval process.

This is United Kingdom guidance, not an international treaty, mutual-recognition arrangement, or harmonised technical standard. Its recommendations do not incorporate a foreign AI regime or establish equivalence, overseas certification recognition, international supervisory procedures, or cross-border data-transfer conditions. References to an internationally significant AI market do not create cross-border compliance rules. The reference to worldwide turnover concerns the potential financial penalty, rather than defining the territorial scope of every underlying obligation. Multinational businesses must address applicable overseas obligations separately.

Transparency and Consumer Rights

Businesses should consider labelling an AI agent where consumers might otherwise believe they are receiving a service from a person. When dealing with AI rather than a person might affect consumers’ decisions, that fact should be disclosed. This is a context-sensitive application of consumer law, not an unconditional labelling requirement for every use of AI. Businesses should avoid exaggerating AI’s role, involvement, or capabilities, and should communicate accurately about what a service can and cannot do.

Marketing agents should provide accurate product information and prices, include unavoidable charges, properly identify paid endorsements, and present only genuine offers and price reductions. Refund agents should distinguish the nature of a request, applicable statutory rights, relevant time limits, amounts due, and contractual benefits such as extended returns policies. Customer-service agents should answer accurately about products, prices, cancellation, and other rights without obstructing their exercise. Comparison agents should match customer criteria and explain market coverage, searched data, limitations, ranking, and supplier links. Misleading omissions, presentation, and decision rules can breach consumer law even without a fabricated statement.

Training, Testing, and Implementation

Implementation begins with the functions assigned to an agent and their direct or indirect effects on customers. Businesses should identify relevant data and configure prompts and workflows to respect statutory rights and contractual terms, avoid misleading statements and omissions, and obtain necessary consumer-law consents properly. These consent recommendations are not a comprehensive account of data protection requirements. Supplier procurement should include checks that appropriate training steps have been taken, rather than an assumption that an externally supplied system is automatically compliant.

Testing is crucial to training. A/B testing and unit testing are examples, not exclusive prescribed methods. Businesses should evaluate results and improve performance where necessary before deployment. Marketing workflows should support correct pricing and endorsement disclosure; refund workflows should reflect legal rights and contractual returns terms; customer-service workflows should support accurate information and access to rights; comparison workflows should match preferences and explain relevant limitations. These are applications of general consumer-law principles rather than licensing conditions.

The guidance does not prescribe a model architecture, mandatory certification, standard test suite, retention period, or formal impact-assessment template. Appropriate operational processes nevertheless need to ensure that the chosen agent performs its tasks lawfully in the actual customer context. Implementation continues after deployment through experienced human review and prompt correction. Training and initial testing do not replace checking how the system behaves in real interactions.

Monitoring, Evaluation, and Remediation

Businesses should regularly check that agents deliver correct results, behave as intended, and comply with consumer law. Active human oversight addresses the risk of models misinterpreting data or hallucinating inaccurate outputs. Someone with appropriate experience should review the relevant marketing campaigns, refund exchanges, customer-service responses, and comparison results. Reviewing responses to different customer queries helps assess whether rights and accurate information are consistently supported. Complaints and customer feedback are specifically relevant to customer-service and comparison applications.

The guidance emphasises regular checking and appropriate monitoring processes rather than a numerical review frequency, sampling percentage, reporting interval, or accuracy threshold. Evaluation should lead to action when outcomes are non-compliant or potentially non-compliant. Businesses should act quickly, including by refining prompts or workflows. Particular urgency applies where an agent interacts with large numbers of people, its outputs can reach a large audience, or it serves vulnerable customers.

Corrective examples include addressing unlabelled influencer endorsements, an omitted extended returns policy, inaccurate cancellation advice, and recommendations that fail to match search criteria. The document creates no fixed remediation deadline or mandatory external incident-reporting procedure. Rapid correction is nevertheless important because an unresolved defect can allow unlawful conduct to continue. Human oversight must be active and connected to improvements, rather than limited to a nominal escalation option.

Enforcement, Liability, and Redress

Breaches of underlying consumer protection law can lead to action by enforcement authorities, including the CMA. A business could face a fine of up to 10% of its worldwide turnover and could be required to compensate affected consumers. These consequences arise from the existing consumer protection framework, not from an independent penalty provision in the guidance. Failure to follow an operational recommendation does not automatically attract the maximum fine: the enforcement consequences concern breaches of applicable law.

The business remains accountable when unlawful conduct is carried out by an AI agent, including one designed or provided by another organisation. Supplier involvement and human review do not transfer accountability away from the deploying business. The guidance does not allocate contractual liability between deployer and supplier, prescribe compensation formulas, or describe criminal offences. It points businesses towards the CMA’s consumer protection and direct consumer enforcement powers. Appeals and challenges operate under the applicable enforcement framework; the document creates no standalone AI-agent appeal procedure, appellate forum, or appeal deadline.

Relationship to Legislation and Other Guidance

The Digital Markets, Competition and Consumers Act 2024 is expressly identified for marketing, customer-service, and comparison-service compliance. The examples address accurate product and price information, inclusion of unavoidable charges, genuine discounts, properly labelled paid endorsements, and material information about comparison results. The Consumer Rights Act 2015 is identified for statutory refund rights, including faulty goods. The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 are identified for relevant cancellation and refund rights, including situations where consumers change their minds.

Customer contracts also matter. An agent must account for contractual benefits, such as an extended returns period, alongside statutory rights. The guidance connects existing rules with AI-enabled workflows rather than replacing legislation or contractual analysis. It does not comprehensively reproduce the legislation or set out every transaction-specific time limit and remedy amount. It also signposts further CMA guidance on fair treatment and fair contracts, Business Companion legal guidance, and DRCF AI and Digital Hub case studies. Its consumer-law focus is not an exhaustive account of all legal obligations affecting AI deployment.

Implementation Timeline

Sources and References