The Competition and Markets Authority Says a Business Is Responsible for What an AI Agent Does in the Same Way It Is Responsible for What an Employee Does, Even if Someone Else Provides the Agent

The UK's Competition and Markets Authority, the CMA, has guidance on GOV.UK for businesses that use AI agents to engage with their customers, for example to handle customer queries, process refunds, recommend products or manage marketing campaigns. Complying with consumer law when using AI agents was first published on March 9, 2026, according to its publication page. That page was last updated on October 30, 2026; its note for that day reads "DRCF joint statement on agentic AI published," a statement by the members of the Digital Regulation Cooperation Forum. Parts of the guidance follow, not the whole.

Responsible as for an Employee

Consumer law, the guidance says, requires a business to treat its customers fairly, and it does not matter whether they deal with a person or an AI agent. The guidance tells a business that "you are responsible for what an AI agent does in the same way you are responsible for what an employee does."

That is true, the guidance says, "even if someone else designed or provides the AI agent on your behalf," so a business procuring an agent from a third party should think about compliance with consumer law and may use the guidance to discuss it with them. A business that breaks consumer protection law could face action by enforcement authorities, the CMA among them, and the guidance says it could be fined up to 10% of its worldwide turnover, and possibly forced to compensate affected consumers.

A business can buy an agent from someone else. By the CMA's account, it cannot hand off the responsibility with it.

Training, Monitoring and Refining

The guidance asks a business to think about how its agent will be prompted to respect customers' statutory rights and the terms of contracts, avoid misleading customers, and properly obtain any necessary consents required by consumer law. Testing, it says, "is a crucial part of training AI agents," for example through A/B testing or unit testing, and the results should be used to check and, if necessary, improve the agent's performance before it is deployed. A business that does not take appropriate steps to train an agent, or does not check that a third party providing the agent has done so, may break the law.

Once an agent is running, the guidance asks for regular checks that it is delivering the right results, behaving as intended and complying with consumer law. Some AI models, it says, can misinterpret data and produce results that are nonsensical or inaccurate. "Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results." If a business realizes that an agent is not performing as expected, and that this is leading to non-compliant or potentially non-compliant outcomes, it should act quickly, for example by refining prompts or workflows.

Actively checking.

An Example: Refund Requests

In one of the guidance's examples, an agent processes refund requests. In designing and training it, the guidance says, a business should think about the contractual and legal requirements that apply to refunds, for example consumers' statutory rights under the Consumer Rights Act 2015 and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, and any terms and conditions in its contracts with customers. Someone with appropriate experience, it says, "should regularly review exchanges with consumers to make sure that the AI agent is behaving as intended," and check that the agent's decisions properly reflect the nature of each request and any differences in time limits or amounts due. The problem it imagines is an agent that is not always taking into account a business's extended returns policy when deciding whether a customer is entitled to return goods and claim a refund.

Then, the guidance says, the business should quickly refine the relevant prompts and workflows.

The guidance puts a person in the loop and asks that person to check actively. When a regulator later asks whether that happened, what will the business be able to show?