Enterprises must take blame for their AI agents’ mistakes, say regulators

The Digital Regulation Cooperation Forum, comprising the UK's Competition and Markets Authority, Financial Conduct Authority, Information Commissioner's Office and Ofcom, stated in a joint statement that existing legal and regulatory frameworks — including competition, consumer and data protection law, online safety, financial services, payments and cyber security requirements — apply to personal AI agents, and that "an AI agent's autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation." The Forum told firms developing or deploying personal agents to think carefully about how consumers understand when and how an agent acts on their behalf, how authority to act is given and how personal data is used. The statement follows the four regulators' Call for Input on their 2027-27 work plan, issued a few weeks earlier to reduce overlap and uncertainty between their regimes.

The UK’s digital watchdogs have warned enterprises that they can’t evade their legal responsibilities by blaming errors on AI agents that they have deployed. “By taking action on behalf of users, such as making purchases and communicating with businesses, these agents could transform how people use digital services, engage with markets and unlock wider innovation,” said the Digital Regulation Cooperation Forum, a body comprising the UK’s Competition and Markets Authority CMA , Financial Conduct Authority FCA , Information Commissioner’s Office ICO , and communications regulator Ofcom, in a joint statement https://www.drcf.org.uk/siteassets/drcf/pdf-files/drcf-joint-statement-protecting-people-and-businesses-in-and-agentic-economy.pdf . While the Forum welcomed such uses it advised, “firms developing or deploying personal agents should think carefully about how consumers can understand when and how an agent acts on their behalf, how authority to act is given and how their personal data is used.” The Forum didn’t pull its punches. “We want to be explicit that existing legal and regulatory frameworks apply to personal AI agents, including competition, consumer and data protection law, online safety, financial services, payments and cyber security requirements,” it said, adding, “An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation.” There is certainly a degree of uncertainty over the legal position of autonomous AI agents. Gartner has warned that companies are increasingly facing legal challenges https://www.networkworld.com/article/4076560/ais-dark-side-shows-in-gartners-top-predictions-for-it-orgs.html over “AI-induced” decisions, while attorneys have weighed in over gray areas in AI governance https://www.cio.com/article/4201343/why-ai-governance-is-failing-and-what-actually-works.html . The four UK regulators aren’t immune to that doubt: Only a few weeks earlier, they issued a Call for Input https://www.drcf.org.uk/news-and-events/news/call-for-input-drcf-workplan-202728 on their 2027-27 work plan to help them avoid overlap and uncertainty about the interplay between their respective regulatory regimes.