UK regulators say firms are liable for AI agent mistakes

The end of the 'AI excuse'

The UK’s digital watchdogs have issued a clear warning to the corporate world regarding the deployment of personal AI agents. These agents are designed to act on behalf of users, performing tasks such as making purchases or communicating with other businesses. While these tools offer significant potential for innovation, they also introduce new risks for the companies that build and deploy them.

The Digital Regulation Cooperation Forum (DRCF) recently released a joint statement to address these risks. The forum is a collective body made up of four major UK regulators: the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO), and Ofcom. Their primary goal is to ensure that new technology does not create a loophole for avoiding legal accountability.

The regulators emphasized that an AI agent’s autonomy does not diminish the responsibility of the organizations that deploy it. This means that if an AI agent makes a mistake, the company behind the software is the one that must answer to the law. They are explicitly stating that firms cannot evade their legal responsibilities by blaming the errors on the technology itself.

Which laws still apply?

The DRCF clarified that several existing legal and regulatory frameworks will continue to apply to personal AI agents. This includes critical areas such as competition law, consumer protection, and data protection law. Because these agents interact with the public and handle sensitive information, they fall under the same scrutiny as traditional digital services.

The statement also highlights that AI agents must comply with requirements surrounding online safety, financial services, payments, and cyber security. These are the standard rules that govern how businesses operate in the modern digital economy. By including these specific categories, the regulators are signaling that they do not see AI agents as a separate category of law that requires a total rewrite of current rules.

The regulators want to make it clear that the rules are already in place to handle these scenarios. Instead of waiting for new legislation to be written, they are instructing firms to ensure their current systems meet these standards. This approach ensures that the transition to more autonomous digital tools happens within a known and established legal framework.

Transparency for the user

While the regulators are firm on liability, they also acknowledge the massive potential for innovation that these agents provide. They noted that these tools could transform how people engage with markets and use digital services. However, they cautioned that this progress must be balanced with clear communication and user understanding.

Firms developing or deploying these agents are advised to think carefully about how consumers can understand the agent's actions. It is important for a user to know exactly when and how an agent is acting on their behalf. This transparency is a key requirement for maintaining trust as these tools become more integrated into daily life.

Additionally, the DRCF highlighted the need for clarity on how authority to act is granted to the agent. Users need to know what permissions they are giving the software and how their personal data is being utilized during those interactions. Companies must be proactive in designing interfaces that make these permissions and data uses easy for the average person to grasp.

Navigating legal uncertainty

Despite the clarity provided by the UK regulators, there is still a degree of uncertainty regarding the legal position of autonomous AI agents. Industry analysts have noted that companies are increasingly facing legal challenges over decisions induced by AI. This creates a complex environment for attorneys who are currently trying to navigate the gray areas of AI governance.

The UK regulators themselves have acknowledged some of this complexity. Only a few weeks before this statement, they issued a Call for Input on their 2027-27 work plan. This initiative was designed to help the four bodies avoid overlap and reduce uncertainty about how their respective regulatory regimes interact with one another.

The ongoing dialogue suggests that while the basic rules are set, the specific details of enforcement may still be evolving. Companies will need to stay informed as these regulators work to harmonize their approaches. The goal is to create a cohesive environment where innovation can happen without sacrificing consumer safety or legal integrity.

What comes next for firms

For businesses, the message from the DRCF is a call to action to audit their current and future AI deployments. They cannot simply