AI agents and UK consumer law

The Competition and Markets Authority published direct guidance for businesses using AI agents on 9 March 2026. Its central point is simple: the same consumer rules apply whether a customer deals with a person or an AI agent. Using a third-party product does not transfer the business's responsibility to the vendor.

That matters because customer-facing agents are moving beyond drafting. They can recommend products, answer cancellation questions, process refunds and run marketing workflows. A fluent answer can now create a real customer outcome.

Define the agent's authority in plain English

Write a one-page authority statement before connecting the agent to live customers. It should answer:

• Can it give information, or can it make a decision?
• Can it create a refund, or only prepare one for approval?
• Can it apply a discount or change a price?
• Can it send messages without review?
• Which cases must go to a person?
• Who can suspend the workflow?

Avoid vague limits such as “low-risk queries”. Name the amounts, products, customer groups and actions. If the agent can issue refunds up to £50, say so. If every complaint involving a vulnerable customer goes to a named team, encode and test that route.

Test rights, not just happy paths

Product demos usually cover a clean order and a clear question. Consumer harm appears in the exceptions.

A useful pre-launch test pack includes:

1. faulty goods inside and outside the normal return window;
2. a customer relying on an extended returns promise;
3. cancellation of a subscription near renewal;
4. a price that has unavoidable charges;
5. a promotion with eligibility limits;
6. a customer who changes their account details mid-conversation;
7. a complaint that needs human judgement; and
8. ambiguous or contradictory source material.

Record the expected answer before running the test. A thumbs-up rating from staff is not enough. Check whether the outcome respects the contract, the published policy and the customer's statutory rights.

Be clear when the customer is dealing with AI

The CMA says businesses should consider labelling an AI agent where the customer could otherwise be misled, particularly where knowing it is AI might affect their decision.

The message should sit inside the interaction, not only in general terms. It should also explain the route to a person. Do not describe an automated service as a “specialist”, imply a human has reviewed an answer when nobody has, or hide a difficult escalation path behind repeated bot replies.

Monitor outcomes after launch

Testing before launch is only the baseline. Models, prompts, connected knowledge and business policies change.

Review a sample of completed journeys every week during a pilot. Track:

• incorrect prices, rights or product statements;
• refusals that should have been escalated;
• actions outside the authority statement;
• complaints and corrected decisions;
• differences affecting vulnerable customers; and
• the time between a known problem and a fix.

Set a stop condition. For example: suspend automated refund decisions after one serious rights breach, or move all cases to human approval if the error rate exceeds an agreed threshold. The owner must be able to disable actions without waiting for a software release.

Treat procurement as part of compliance

Ask the vendor for evidence, not a generic assurance. Useful questions include:

• Which actions can an administrator disable?
• Can rules vary by product, country or customer type?
• Are conversations and actions exportable for review?
• How quickly can a model or prompt change be rolled back?
• What happens when the agent cannot retrieve current policy?
• Does the supplier test consumer-law scenarios relevant to your business?

The CMA notes that breaches can lead to enforcement, including fines of up to 10% of worldwide turnover and possible compensation. That makes “the vendor said it was compliant” a poor control.

Start with a reversible pilot

The safest first use is usually a narrow information or drafting task with a visible human hand-off. Run it against one approved knowledge source, one owner and a fixed test set. Measure correct outcomes, not conversation volume.

Use the AI workflow readiness assessment to define ownership, approved data, review and stop conditions before the pilot. This checklist is operational guidance, not a substitute for advice on a particular consumer-law question.

Source basis

• Competition and Markets Authority: complying with consumer law when using AI agents
• Competition and Markets Authority: agentic AI and consumers