AI Agents Already Covered by UK Law, Regulators Say

Four UK regulators say AI agents that shop, book and act for people are already covered by existing law. The statement sets out no new rules. The Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO) and Ofcom made the point in a joint statement published on 30 October through the Digital Regulation Cooperation Forum (DRCF).

“We want to be explicit that existing legal and regulatory frameworks apply to personal AI agents,” the regulators said, listing competition, consumer and data protection law, online safety, financial services, payments and cyber security rules.

In brief

No new law or rulebook: the statement says current rules already apply.
Firms that deploy an agent stay responsible for what it does, however autonomous it is.
The regulators say they “will not hesitate” to use their powers where they suspect a breach.

What the regulators say about AI agents

The statement (PDF) opens by welcoming the technology. The regulators say they “are preparing for the growing availability and adoption of capable new personal AI agents in the UK” and that the agents have “the potential to benefit consumers across the country” by making purchases and dealing with businesses on a user’s behalf.

They also warn that agents “may amplify and accelerate risks and introduce new ones”. They name fraud and scams, personal information being shared in ways users would not expect, and misleading recommendations or decisions.

The central line is about responsibility. “An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation,” the statement says. “Where we identify conduct that we reasonably suspect breaches the law and risks harm to consumers or businesses, we will not hesitate to use our powers.”

Firms building or deploying personal agents are asked to think about six questions: how users can tell when and how an agent acts for them, how authority to act is given, how personal data is used, how commercial interests behind recommendations are disclosed, who is accountable for the agent’s decisions, and how people get redress when something goes wrong.

Guidance that already exists

The CMA updated its GOV.UK page of consumer law guidance for businesses that use agents on 30 October to point to the joint statement. That guidance, first published in March, tells businesses: “you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf.” It warns: “You could be fined up to 10% of your worldwide turnover, and possibly forced to compensate affected consumers.”

The CMA advises firms to tell people when they are dealing with an agent, to train, test and monitor it, and to keep “a human in the loop”. The ICO, meanwhile, has an open call for evidence on agentic AI that closes on 20 November, a step TSN noted when it covered the ICO’s turn to AI agents.

The regulators say they are tracking the market, talking directly to firms, sharing evidence and running sandboxes, and are working “with Government to identify potential gaps in compliance and further regulatory challenges”. They urge firms to come to them early to test products.

Why no new rules still means more risk for firms

The headline is that nothing new has been added, and that is the point. Rather than waiting for a dedicated law, the four regulators are telling firms that the tools they already have, from consumer protection fines to data protection orders, can be used against agent-driven harm now. Law firm Burges Salmon says the statement “is not highly prescriptive” and is “likely to be a starting point, not the final word”.

For businesses, the practical shift is about who carries the blame. The CMA’s employee comparison means a retailer cannot point to a third-party model provider if its shopping agent misleads a customer. That matters as large retailers set out their own controls, such as Walmart’s profiles and rules for agents that shop for customers, and as security firms treat agents as a new risk, with Microsoft calling them potential insider threats.

It also fits a pattern in UK oversight. The FCA has already said firms remain accountable for AI failures, and the CMA this week opened a competition case over the terms Meta sets for news outlets. The next test is whether any regulator brings a case built on an agent’s conduct. TSN’s AI regulation hub tracks those moves.