Four UK regulators have told companies that deploying an AI agent does not transfer legal responsibility when things go wrong.
The Digital Regulation Cooperation Forum, which brings together the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO) and Ofcom, published the joint statement on 30 October.
It covers personal AI agents: assistants that book things, send emails, manage expenses or make purchases on a user's behalf, rather than simply answering questions, the kind of task OpenAI's Dot agent in ChatGPT already performs.
"An AI agent's autonomy does not diminish the responsibility of organisations that deploy it to comply with applicable law and relevant regulation," the regulators said.
They added they "will not hesitate to use our powers" where conduct risks harm to consumers or businesses.
The warning carries weight because of new powers that took effect on 6 April 2025. They allow the CMA to rule on breaches of consumer law itself, without going to court.
It can fine a company up to 10% of its worldwide turnover or £300,000, whichever is higher.
The regulators flagged fraud and scams, data shared in ways users don't expect, and misleading recommendations as the risks they are watching, and said they are working with government to identify gaps in the rules.
An AI system has no legal personality and cannot itself be sued or fined, so liability sits with the businesses that build, deploy or use it.
The CMA had already issued guidance on agentic AI in March and has now updated that page to point to the joint statement.
Read more about AI Regulation
