On 30 October, the U.K. Competition and Markets Authority (the “CMA”) published a research paper on “Agentic AI and consumers”, alongside revised guidance for businesses on “Complying with consumer law when using AI agents”. The same day, the members of the Digital Regulation Cooperation Forum (“DRCF”) – the CMA, the Financial Conduct Authority, the Information Commissioner’s Office and Ofcom – issued a joint statement, “Protecting people and businesses in an agentic economy”. The message is clear: “An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation”, including consumer protection and competition law.
From Assistance to Agency: The Next Phase of Consumer AI
- To date, most consumers have experienced AI as a reactive technology that responds to individual queries but with outcomes remaining dependent on action by the user. Agentic AI creates the potential to go further with systems that can operate continuously and adaptively and make context-dependent judgements about when to act, when to seek confirmation, and how to balance competing objectives. Consumers could move from using AI as a tool for single tasks, to delegating outcomes that constitute goal-oriented assistance such as documenting spending patterns to identify unnecessary discretionary expenditure, monitoring subscriptions and flagging unused services, and automatically searching for better deals on utilities, insurance and broadband.
- Anticipated deployments of agentic AI include monitoring prices and availability over time and executing transactions on a consumer’s behalf according to pre-set preferences. Looking further into the future, fully autonomous personal agents could manage longer-term consumer objectives, such as optimising household services or managing finances. As such, agentic AI has the potential to save consumers significant time, to reduce cognitive load and to identify better deals (e.g., cheaper prices, more personalised products or products with a lower environmental impact).
- These changes also represent a significant shift in how consumers could engage with businesses, with AI agents increasingly acting as intermediaries.
Key Messages from the CMA and the DRCF
- You are legally responsible for your agent. Existing legal and regulatory frameworks apply whether consumers deal with a person or an AI agent. Businesses answer for their agents as they do for their employees, even where a third party builds or supplies the AI agent. The DRCF confirms that all existing regimes apply, from competition, consumer and data protection law to financial services, payments, online safety and cyber security rules. In the United States, the FTC Chairman said in September 2026 that he would resist treating AI agents as independent actors. State attorneys general are taking the same approach, with Connecticut’s Attorney General advising in February 2026 that the AI industry is “no different” from any other regarding compliance with existing consumer protection and antitrust laws.
- Under U.K. competition and consumer law, fines of up to 10% of worldwide turnover can apply. The DRCF regulators say they “will not hesitate” to use their powers. Infringing companies can also be liable for compensation to affected consumers. The U.K. is considering the introduction of a consumer class actions regime, with the Law Commission currently working on a consultation proposal.
- The “faithful servant” test. The CMA’s principal concern is that AI agents may be optimised for commercial priorities such as audience engagement or sales conversion, with the result that consumers are steered or manipulated in ways that lead to worse personal outcomes. Building on its work on harmful Online Choice Architecture, the CMA anticipates that using these techniques in an AI agent’s choice architecture could make any steering less visible to consumers, weakening informed choice and increasing the risk of dark patterns being deployed at scale. It also flags other risks including errors and hallucinations, discriminatory outcomes, over-reliance / loss of agency, fraud and the unlawful use of personal data.
- “Agentic collusion” remains on the radar. As previously discussed in our client memo, the CMA has previously highlighted that algorithmic pricing can increase the risk of coordinated market outcomes, even in the absence of explicit communication between businesses, particularly where algorithms learn from and react to each other in concentrated markets. Agentic AI is expected to intensify these risks. If AI agents that are designed to optimise pricing or commercial strategies calculate that collusion is more profitable than competition, then competition may be dampened without any contact between competitors. As with direct consumer interactions, businesses remain responsible for the pricing outcomes that their AI agent produces. Algorithmic pricing remains an active area of enforcement in the United States, as well, with two appellate courts weighing in during 2026, and the DOJ continuing to reach settlements with landlords in its RealPage case, after it settled with RealPage itself in 2025 (discussed in our client memo).
- Closed ecosystems under scrutiny. The CMA sees data mobility, interoperability and open standards as key to competitive agentic markets. It warns that, where AI agents operate within closed ecosystems, this may lock consumers, their data, preferences or agent “memory” into incumbents. Indeed, on 9 June 2026, the European Commission took the unusual step of imposing interim measures on Meta to restore free access to the WhatsApp for Business API for rival general-purpose AI agents. The Commission concluded that “Meta’s policy change risks harming competition at a key moment in time for the development of that market, where smaller player and new entrants can challenge large incumbents”.
- Light touch, close watch. The CMA has said it rejects heavy-handed regulation due to the fast-paced and highly innovative nature of the market. All DRCF regulators are, however, tracking the market, working with the U.K. government to identify gaps in compliance and further regulatory challenges arising from the use of AI agents.
Practical Takeaways for Clients
For businesses using AI agents to interact with consumers (for example, to handle customer service queries, process refunds, recommend products or manage marketing campaigns):
- Disclose the use of AI. Tell customers they are dealing with an AI agent where this could affect their decisions. Do not overstate what an agent can do. Disclose its limitations and relevant information such as its methodology for ranking results and any commercial incentives behind its recommendations.
- Build compliance in from day one. Train and prompt AI agents to respect statutory rights (for example, to make sure cancellation rights are not being breached) and the terms of contracts, to avoid misleading consumers and to properly obtain any necessary consents required by consumer law. Test before launch.
- Cap the agent’s authority. Define what the AI agent may do and require customer confirmation before high-risk or irreversible actions (such as switching providers).
- Retain human oversight. Have experienced staff review decisions, complaints and feedback. Keep audit logs and risk assessments, and address problems immediately – especially where an AI agent reaches large numbers of people or vulnerable consumers.
- Push risk up the supply chain. Outcomes from vendor-supplied agents are the responsibility of the deployer. It is therefore essential to question suppliers on how they trained and tested the AI agent for compliance. Secure audit rights and indemnities in the vendor contract as well as comprehensive disclosures against the warranties.
- Allocate accountability. Contractually assign responsibility for each AI agent’s decisions, including liability if it acts outside customer instructions, between vendor and deployer, and give consumers a clear route to redress.
- Engage early. The DRCF invites firms to test products and raise questions with it early, which can offer a route to faster product launches with fewer regulatory surprises. The DRCF’s year-long pilot of a cross-disciplinary AI and digital sandbox has now closed but queries can still be addressed to the member regulators of the DRCF.
This post is based on a Paul, Weiss, Rifkind, Wharton & Garrison LLP memorandum, “Your Agent, Your Responsibility: UK Regulators’ Views on Competition and Consumer Law Liability for AI Agents,” dated November 3, 2026, and available here.