Your AI agent’s mistakes are yours. Four UK regulators have put it in writing.
The CMA, FCA, ICO and Ofcom say existing law already covers AI agents, and letting software act on its own doesn’t move the responsibility. Here’s what that means before you switch one on.
Four UK regulators have put it in writing: if your business uses AI agents, your business is responsible for what they do. The joint statement, published at the end of October by the CMA, FCA, ICO and Ofcom, says existing law already applies and that an agent acting on its own doesn’t move the responsibility anywhere else.
It matters because agents have left the lab. They’re turning up as options inside tools many businesses already pay for, offering to answer customers, book appointments, chase invoices and tidy inboxes without anyone pressing send.
What the regulators said
The four work together as the Digital Regulation Cooperation Forum (DRCF). Their statement is about what they call personal AI agents: software that takes actions on someone’s behalf, such as making purchases and communicating with businesses. They welcome what that could do for people, and then they say this:
“An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation.”
They list the rules that already apply: competition, consumer and data protection law, online safety, financial services, payments and cyber security requirements. The risks they name are fraud and scams, personal information being shared in ways people didn’t expect, and misleading recommendations or decisions. Where they suspect the law has been broken, they say they “will not hesitate to use our powers”.
Three things people assume
“The supplier built it, so it’s the supplier’s problem.”
The statement points at the organisations that deploy an agent. If you switch one on and point it at your customers, it speaks for your business in the same way a new member of staff or an outsourced call handler does. Your contract with the supplier might help you recover costs later. It doesn’t change who answers to your customers.
“There’s no AI law in the UK yet, so nothing applies.”
The UK has no single AI act, and that’s why the regulators say they want to “be explicit that existing legal and regulatory frameworks apply”. If an agent emails a customer’s details to the wrong person, that’s a data protection matter exactly as it would be if a person had done it. If it tells a customer something untrue about a price or a refund, consumer law doesn’t care who typed it.
“It only reads things, so it can’t do any harm.”
An agent that can read your inbox reads everything in it, including messages written by strangers. Text tucked into an email or a web page can be worded as instructions, and agents can be fooled into following them. The more an agent can do on its own, such as sending, paying, deleting or sharing, the more that matters.
Before you switch one on
Agents can take a lot of dull work off people’s desks, and the regulators say as much. The sensible way in is to treat one like a new starter: limited access on day one, someone checking its work and more freedom as it earns it. Five questions cover most of it.
| Ask | What good looks like |
|---|---|
| What can it see? | Only the mailbox, folder or system the job needs. Your data map shows what’s in each one. |
| What can it do without a person? | Drafting is low risk. Sending, paying, refunding and deleting wait for a human yes until you trust it. |
| Will people know? | The DRCF asks firms to think about how people can understand when an agent is acting for them, how it was given that authority and how their personal data is used. |
| Is there a record? | A log of what it did and why, kept somewhere you can read it when a customer asks. |
| Who owns it? | One named person who reviews it, hears about mistakes and can switch it off. |
One date if you want a say
The ICO is separately asking how data protection law should apply to agentic AI. Its call for evidence opened on 8 October and closes on 20 November 2026, and the answers will shape its future guidance. If your business builds or uses agents, you can respond.
Sources
- DRCF: Joint statement on protecting people and businesses in an agentic economy
- Burges Salmon: AI agents and responsibility, a message from regulators (30 October 2026)
- InfoWorld: Enterprises must take blame for their AI agents’ mistakes, say regulators (6 November 2026)
- TLT: The ICO’s agentic AI call for evidence, what you need to know
More on this. See every guide and story on these topics, or follow Ashley on LinkedIn for a short post most days.
Ashley Adkins
Ashley runs fromIT, helping businesses across the UK respond to cyber incidents and get certified to Cyber Essentials and ISO 27001. More about Ashley.