AI agents and responsibility – a message from regulators

The Digital Regulation Cooperation Forum (DRCF), which brings together the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO), and Ofcom, has issued a joint statement aimed at aligning regulatory oversight of AI across online safety, data protection, and digital competition, with a specific focus on personal AI agents. Here we summarise the key points.

Opportunities and risks

Personal AI agents are autonomous artificial intelligence systems that use tools to complete full workflows (such as bookings, searches, drafting and sending emails or managing expenses). They act on a user’s behalf, remembering personal preferences and are moving quickly from novelty to everyday reality.

The DRCF recognises that there are opportunities and risks:

By taking action on behalf of users, such as making purchases and communicating with businesses, these agents could transform how people use digital services, engage with markets and unlock wider innovation. 

However, AI agents may amplify and accelerate risks and introduce new ones. These risks may increase as the capabilities of personal agents grow and adoption rises. Questions of consumer protection, competition and data protection – for example the risk of fraud and scams, personal information sharing not in line with user expectations and misleading recommendations, decisions or information provided - must be addressed to ensure innovation develops in ways that earn and maintain public trust.

UK regulators have now sent a clear, collective message about them: the law applies, and those who deploy these tools will be held responsible for what they do.

AI agents are regulated…

The DRCF says that it wants to

…to be explicit that existing legal and regulatory frameworks apply to personal AI agents, including competition, consumer and data protection law, online safety, financial services, payments and cyber security requirements, as well as many areas of law such as product safety which sit outside the DRCF member remits. An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation. Where we identify conduct that we reasonably suspect breaches the law and risks harm to consumers or businesses, we will not hesitate to use our powers. 

… and those regulations are being enforced

Further, the DRCF states that the regulators:

…are already taking action. We are tracking market developments closely, engaging directly with firms developing and deploying AI agents, publishing guidance for firms, sharing intelligence and evidence across regulators, supporting responsible innovation through regulatory sandboxes and maintaining close coordination at leadership level. We are also working together and with Government to identify potential gaps in compliance and further regulatory challenges that arise from personal AI agents. This work is progressing at pace as technology evolves and new products are rolled out. We will continue to coordinate our regulatory approaches where needed. Our aim is to help people in the UK benefit from AI while protecting them from harm and supporting firms to develop innovative, safe and responsible applications.

Our views

Why this matters from an enforcement perspective

One significant feature of this statement is coordination. A single AI agent can touch data protection, consumer, competition, and financial services rules at once. A shared approach among regulators makes it more likely that one problem will be examined through several lenses and potentially lead to parallel investigations, information requests, or enforcement action across more than one regime at the same time.

This statement also continues an established theme where regulators have for some time been testing how existing frameworks apply to AI. The direction of travel is consistent: existing law applies to fit new technology, rather than waiting for new technology-specific legislation.

What you should watch out for

Organisations that build, deploy, or rely on personal AI agents should treat this as an early warning. Now is the time to map which regimes their AI tools engage. Businesses should keep a close eye on relevant regulators’ work with the Government, as any gaps it identifies may shape future guidance or legislation. Ultimately, those regulators have made their position clear; autonomy will not be an excuse, and they are ready to act.

Key takeaways

• A united front: The DRCF members are active enforcers in the UK, each overseeing several recently enacted or emerging regimes, including the Online Safety Act and the Digital Markets, Competition and Consumers Act (DMCCA). A joined-up voice means businesses can expect scrutiny across all lenses.
• Regulations and laws apply now: The statement is not highly prescriptive, but its central signal is that existing frameworks apply now to personal AI agents. 
• Responsibility of the deployer: The regulators put it plainly: “An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation. Where we identify conduct that we reasonably suspect breaches the law and risks harm to consumers or businesses, we will not hesitate to use our powers.” In other words a defence of “the AI did it” is unlikely to be sufficient. 
• We can expect to see more: Regulators are likely to continue to work alongside Government to identify potential compliance gaps and further regulatory challenges posed by personal AI agents. Today’s statement is likely to be a starting point, not the final word.

If you would like to discuss how current or future regulations impact what you do with AI, please contact Tom Whittaker, Marie-Elizabeth Bailey, Brian Wong, Lucy Pegler, Martin Cook, Liz Griffiths or any other member in our Technology team.  For the latest on AI law and regulation, see our blog and newsletter.