Governance

Who's responsible when an AI agent gets it wrong with your customers?

By Chris Morton, Director · 2 Nov 2026 · 7-minute read

If an AI agent dealing with your customers gets something wrong, your business answers for it. The CMA's guidance says you are responsible for what an AI agent does in the same way you are responsible for what an employee does, even if someone else designed or provides it.

On 30 October 2026 the CMA, FCA, ICO and Ofcom added a joint statement: existing law already applies to AI agents, and an agent's autonomy doesn't reduce the responsibility of the organisation that deploys it. What you need in place is good management: a named owner, a person approving the risky steps, a record of what the agent did, a way to stop it, clear supplier terms and honesty with customers that they're dealing with AI.

What the regulators said on 30 October.

The Digital Regulation Cooperation Forum brings together four UK regulators: the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO) and Ofcom. On 30 October 2026 they published a joint statement on AI agents.

Its focus is personal AI agents, the kind that act for people by making purchases and communicating with businesses. Its central point applies to any business putting an agent in front of customers. "We want to be explicit that existing legal and regulatory frameworks apply to personal AI agents," the regulators say, listing competition, consumer and data protection law, online safety, financial services, payments and cyber security. Then the line that matters most: "An AI agent's autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation." Where they suspect a breach that risks harm, they say they "will not hesitate" to use their powers.

The statement also lists the questions firms deploying agents should think about, including who is accountable for the agent's decisions and how people get redress when something goes wrong.

The same day, the CMA updated its guidance for businesses, Complying with consumer law when using AI agents, first published in March 2026, to point to the joint statement. The ICO has a separate call for evidence open on agentic AI, which closes at the end of 20 November 2026 and will inform its future guidance.

Sources: Protecting people and businesses in an agentic economy, DRCF, 30 October 2026; Complying with consumer law when using AI agents, CMA, updated 30 October 2026; Agentic AI call for evidence, ICO.

Who's responsible? You are.

The CMA's guidance is plain about it: "you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf."

That settles the question most firms ask first. If an agent tells a customer the wrong thing about their cancellation rights, refuses a refund they're entitled to or quotes a price that leaves out a charge, the agent hasn't made a mistake on its own. Your business has. Buying the agent from a supplier doesn't move that responsibility. The guidance says that if a supplier provides the AI and you don't check they've trained it properly, you may break the law.

The stakes are real. The CMA says a business that breaks consumer protection law "could be fined up to 10% of your worldwide turnover, and possibly forced to compensate affected consumers."

The ICO makes the same point about personal data. Its Director of Technology Regulation, Richard Nevinson, said when it opened the call for evidence: "the fact AI agents act with autonomy is not an excuse for poor compliance."

Where it goes wrong with customers.

The CMA's guidance uses four examples, and they are the jobs firms are most keen to hand over: answering customer service queries, processing refund requests, running marketing campaigns and recommending deals.

In each one the risk is the same. The agent works at volume, so one wrong rule repeats in every conversation until someone notices. The guidance asks businesses to act quickly when an agent isn't performing as expected, especially where it reaches large numbers of people or vulnerable customers.

That's why we'd start with one bottleneck, not a whole customer operation. Take the single process that ties up most of your team, such as refund requests, and work out where a mistake would land on a customer. Put the controls there first.

An agent nobody owns, or one you can answer for.

The difference isn't the technology. It's whether anyone can explain what the agent did, and why.

An agent nobody owns

Set up, switched on, left to run

No named owner Nobody answers for what it says.
Risky steps run on their own Refunds and exceptions go through unchecked.
No record You can't show what it did, or why.
No clear way to stop it Problems run until a customer complains.

An agent you can answer for

Run like a member of staff, with a manager

A named owner One person responsible for how it behaves.
Approval where it counts A person signs off the risky steps.
Every action recorded In your own systems, where you can find it.
A stop switch Someone can pause it in minutes, and knows when to.

The right-hand column is what the regulators are describing when they talk about oversight and accountability. It's also how you'd manage a new member of staff.

What to have in place before it talks to customers.

None of this needs a new department. It needs six things, written down, before the agent goes live.

A named owner. One person, not a team, who answers for the agent, checks how it's performing and decides what changes.
Approval for the risky steps. Decide which actions a person signs off before they happen: refunds above a limit, exceptions to your terms, complaints and anything that changes what a customer pays. Our guide to what to hand to AI agents sets out where that line usually sits.
A log of what it did. Every conversation and action recorded, with who approved what and when. If a customer or a regulator asks, you can show them.
A stop button. A way to pause the agent quickly, and a plan for who picks up its work when you do.
Supplier terms that match the risk. If someone else builds or runs it, agree in writing how it's tested, monitored and corrected, how fast problems are fixed and what data it can reach. Check what's already connected, too: ghost AI is the tool nobody owns any more.
Honesty with customers. Tell people when they're dealing with AI if it could affect their decisions, don't overstate what the agent can do, and make it easy to reach a person.

Then test it on real examples before launch, and keep checking a sample of conversations and every complaint afterwards.

This article is general information, not legal advice. For your own position, speak to a solicitor.

How we build agents you can answer for.

We build bespoke AI systems for UK firms that want to own them outright, with no licences and no vendor lock-in. So far that has meant 100+ processes automated, thousands of hours saved and more than £250k saved in operational costs.

It starts with a conversation. Talk it through: 30 minutes on the one thing slowing you down. If it's worth fixing, you get a priced proposal, for the build or for an AI Review if that one bottleneck needs mapping first.
Approval points you set. The agent prepares the work, then pauses where you choose. The right person approves, edits or rejects it, and the limits follow your rules.
A record and a stop switch. Everything the agent reads, says and does is logged in your own systems, and a named person can pause it.
Owned, so you can explain it. The system is handed over with the code and documentation, so you know what your agent does and can show it.
Care & Evolve afterwards. Ongoing support in monthly hours, with a three-month minimum, so prompts and rules are put right quickly when something isn't working, which is what the CMA's guidance asks for.

See how we approach bespoke AI development.

Know who answers for your agent.

Tell us the one customer process you'd hand to an agent, or the one already running that worries you. In 30 minutes we'll show you where a person should approve and tell you straight what we'd do. If it's worth fixing, you get a priced proposal: for the build, or for an AI Review if it needs mapping first.

Talk it through →

FAQs

Frequently asked questions.

Who is liable if our AI agent gives a customer the wrong answer?

Under consumer law, your business is responsible. The CMA's guidance on consumer law says you are responsible for what an AI agent does in the same way you are responsible for what an employee does. If consumer law is broken, enforcement authorities can take action, and the CMA says fines can be up to 10% of worldwide turnover, possibly with compensation for affected consumers. How costs are shared with a supplier depends on your contract. This is general information, not legal advice.

Does it matter if a supplier built or runs the agent?

Not for your responsibility to customers. The CMA says you are responsible even if someone else designed or provides the AI agent on your behalf, and that if you don't check a supplier has trained it to comply, you may break the law. Ask your supplier how the agent is tested, monitored and corrected, and put that in writing.

Do we have to tell customers they're dealing with an AI agent?

The CMA says you should consider labelling it, so customers aren't misled into thinking a real person is providing the service. If knowing it's AI might affect their decisions, tell them. You also shouldn't overstate what the agent can do.

Is there a new law on AI agents in the UK?

No. The joint statement from the CMA, FCA, ICO and Ofcom says existing frameworks already apply, including competition, consumer and data protection law, online safety, financial services, payments and cyber security requirements. The ICO is gathering evidence for future guidance on agentic AI through a call for evidence that closes at the end of 20 November 2026.

What does a human in the loop mean for a customer-facing agent?

The CMA's guidance asks for a person actively checking that the agent is making correct decisions. In practice, the agent handles routine requests on its own, a named person approves the risky steps, such as refunds above a limit, exceptions and complaints, and someone reviews a sample of conversations and every complaint.