Businesses are increasingly using AI agents to answer customer questions, process refunds, recommend products and run marketing campaigns. The Competition and Markets Authority (CMA) has published guidance on how UK consumer law applies when they do. It was first published on 9 March 2026 and last updated on 30 October 2026, the same day the CMA, the Financial Conduct Authority, the Information Commissioner's Office and Ofcom issued a joint statement through the Digital Regulation Cooperation Forum on preparing for personal AI agents.
The guidance does not create new law. It explains how existing consumer protection rules, in particular the Digital Markets, Competition and Consumers Act 2024 (DMCCA), the Consumer Rights Act 2015 and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, apply when an AI agent rather than a person deals with consumers. Its central message is simple: the business remains responsible for what its AI agent does.
Key points
- Consumer law applies in the same way whether customers deal with a person or an AI agent.
- A business is responsible for its AI agent as it is for its employees, including where a third party built or supplies the agent.
- Customers should be told when they are dealing with AI where that could affect their decisions, and the AI's capabilities should not be overstated.
- AI agents should be trained and tested to respect consumer rights, monitored with human oversight, and corrected quickly when something goes wrong.
- Under the DMCCA, penalties for breaching consumer law can reach 10% of worldwide turnover, and businesses may be required to compensate affected consumers.
Who this affects
The guidance is aimed at any business using agentic AI in customer-facing activities with UK consumers. That includes online retailers using AI customer service, platforms automating refunds and cancellations, brands using AI to create and run marketing, and comparison services that use AI to find and rank deals.
It is also relevant to businesses based outside the UK. UK consumer law can apply to overseas businesses that deal with or target consumers in the UK, for example exporters and e-commerce sellers in Türkiye or elsewhere selling directly to UK customers. Whether it applies in a particular case depends on the facts, but businesses selling into the UK should not assume that being based abroad takes their AI tools outside the rules.
The same rules apply to AI and to people
The starting point of the guidance is that consumers must be treated fairly whoever, or whatever, they are dealing with. A business is responsible for its AI agents in the same way as it is for its staff. This applies even where the agent was designed, trained or supplied by a third party.
That has a practical consequence for procurement. Contracts with AI providers should deal with consumer law compliance, rather than leaving the business to discover problems after an agent has gone live.
The stakes are significant. Since April 2025, the DMCCA has allowed the CMA to decide for itself whether consumer law has been broken and to impose penalties, rather than having to go to court. Fines can reach 10% of a business's worldwide turnover, and businesses can also be required to compensate consumers who have been affected.
Five things the CMA expects
1. Tell customers when they are dealing with AI
Businesses should be clear and open about their use of AI, particularly where customers might not expect it. Consumers must have the information they need to make informed decisions and must not be misled. Where the fact that a customer is dealing with an AI agent rather than a person could affect their decisions, the agent should be labelled as AI. Businesses should also avoid overstating what the AI does or what it can and cannot do.
2. Train AI agents to comply with consumer law
Businesses should think through how an agent's actions could affect customers, directly or indirectly, and give it the data and instructions it needs to:
- respect statutory rights and the business's own contract terms, such as cancellation rights;
- avoid misleading customers, whether through what it says or through what it leaves out;
- obtain any consents that consumer law requires.
Agents should be tested before deployment, for example through A/B testing or unit testing, and improved in light of the results. A business that does not train its agents properly, or does not check how a third-party provider has trained them, risks breaking the law and remains responsible.
3. Monitor how AI agents perform
AI agents can misread data or produce inaccurate or nonsensical outputs, often described as hallucinations. The guidance expects businesses to check regularly that their agents produce correct results, behave as intended and comply with consumer law, and to keep a human in the loop to review decisions and outputs.
4. Fix problems quickly
Where an agent produces outcomes that do, or may, breach consumer law, businesses should act quickly, for example by refining the prompts or workflows behind it. Speed matters most where the agent deals with large numbers of customers or with vulnerable customers. Delay can mean continuing unlawful conduct for which the business is responsible.
5. Keep compliance under review
Monitoring and correction are ongoing obligations rather than a launch-day exercise. The guidance repeatedly recommends that someone experienced reviews the agent's outputs, customer interactions and complaints on a regular basis.
Four examples from the guidance
| Use of AI | Main rules referred to | What the CMA expects | Example problem |
|---|---|---|---|
| Running a marketing campaign | DMCCA 2024 | Accurate prices and product information, including all unavoidable charges; paid endorsements properly labelled; genuine offers and price reductions | The agent does not consistently require influencers to label paid posts |
| Processing refund requests | Consumer Rights Act 2015; Consumer Contracts Regulations 2013; the business's own terms | Decisions that reflect the type of request and the different time limits and amounts that apply | The agent ignores the business's extended returns policy |
| Answering customer service queries | DMCCA 2024; statutory and contractual rights | Accurate answers about prices, products and rights; no obstacles to customers exercising their rights | The agent gives wrong information about product features or cancellation rights |
| Comparing deals | DMCCA 2024 | Results that match the customer's criteria; clear disclosure of how much of the market was searched, any limitations, how results are ranked and any supplier links | The agent shows deals that do not match the search criteria |
In each example the CMA's suggested response is the same: identify the problem through regular review and refine the agent's prompts and workflows.
A practical compliance checklist
The guidance sets out principles rather than a procedure. In practice, businesses using AI agents with consumers may find it useful to work through the following steps.
- Map where AI touches customers. List every customer-facing use of AI, including tools embedded in third-party platforms, and identify which consumer rules each one engages.
- Review supplier contracts. Check what AI providers commit to on accuracy, testing, logging, change control, incident notification and cooperation if a regulator asks questions.
- Write the rules down for the agent. Translate statutory rights, returns and refund policies, pricing rules and required disclosures into the instructions and reference material the agent works from, and keep them in line with the terms customers actually see.
- Test before launch, including edge cases. Use realistic scenarios such as late returns, faulty goods, partial refunds, promotional prices and customers who say they are struggling or confused.
- Disclose AI use clearly. Decide where and how customers are told they are dealing with AI, and make sure the agent does not describe itself or its abilities inaccurately.
- Keep humans involved. Sample conversations and decisions regularly, analyse complaints, and consider a clear route for customers to reach a person where a matter is complex or the customer may be vulnerable. A route to a person is good practice rather than a specific requirement of the guidance.
- Respond and record. Have a process for pausing or correcting an agent quickly, and keep records of reviews, problems found and fixes made.
Other rules that may apply
Consumer law is not the only framework that applies to AI agents. The joint statement from the CMA, FCA, ICO and Ofcom confirms that the regulators are coordinating their approach as personal AI agents become more widely used. Depending on what an agent does, data protection law, financial services rules or online safety rules may apply alongside consumer law, and each regulator may take an interest.
Businesses that also sell to consumers in Türkiye should note that Turkish consumer rules are separate and differ in their detail. Recent changes to the Turkish distance contracts regime are covered in our article on the amendments to the Turkish Regulation on Distance Contracts, and the practical steps for selling in Türkiye are set out in our guide to opening a retail store in Turkey. For businesses entering the UK market more generally, see UK market entry.
Is the CMA's guidance on AI agents legally binding?
The guidance itself is not legislation. It explains how the CMA views existing consumer law, such as the DMCCA 2024, the Consumer Rights Act 2015 and the Consumer Contracts Regulations 2013, when businesses use AI agents. The underlying law is binding, and the guidance indicates what the CMA is likely to expect when it assesses compliance.
Do businesses have to tell customers they are talking to an AI agent?
The guidance says businesses should be open about using AI, particularly where customers may not expect it, and should label AI agents where the fact that a customer is dealing with AI rather than a person could affect their decisions. Businesses should also avoid overstating what the AI can do.
Who is responsible if a third-party AI tool gets it wrong?
The business using the tool. The guidance states that businesses are responsible for their AI agents in the same way as for their employees, even where a third party designed or supplies the agent. Supplier contracts should therefore address consumer law compliance.
What are the penalties for breaching consumer law through an AI agent?
Under the DMCCA, the CMA can impose penalties of up to 10% of a business's worldwide turnover for breaches of consumer law, and businesses may be required to compensate affected consumers. Other enforcement authorities can also take action.
Does the guidance apply to businesses based outside the UK?
It can. UK consumer law can apply to businesses outside the UK that deal with or target consumers in the UK. Whether it applies to a particular business depends on how and to whom it sells.
Does the guidance cover business-to-business dealings?
The guidance is about consumer protection law, which protects individuals acting outside their trade or business. Dealings between businesses are governed mainly by contract law and other rules, although some businesses deal with both consumers and business customers through the same AI tools.
Source: Competition and Markets Authority, Complying with consumer law when using AI agents, first published 9 March 2026, last updated 30 October 2026. Public sector information licensed under the Open Government Licence v3.0.
Disclaimer: This article is intended for informational purposes only and does not constitute legal advice. It summarises regulatory guidance at the date of publication; the guidance and the law may change, and their application depends on the facts.