The Competition and Markets Authority (CMA) has published guidance and research on how businesses can use agent AI while complying with consumer protection laws. It is extremely important that companies heed this guidance. Failure to do so will result in the CMA exercising new enforcement powers and imposing fines of up to 10% of global annual turnover.
What is agent AI?
Agentic AI tools can plan, coordinate, and take actions across multiple services to achieve your goals autonomously. Unlike traditional AI tools that simply assist in decision-making, AI agents sense the environment, make decisions, and act. It does more than just generate responses to queries. AI agents evaluate goals, break them down into subtasks, plan workflows, capture real-time data, autonomously perform actions (such as payments), and store memories of past interactions to improve over time.
Companies are already deploying AI agents for customer operations and service, commerce and sales workflows, software operations, and internal business process automation.
The CMA stressed that consumer law requires businesses to treat customers fairly, and it does not matter whether the customer interacts with a human or an AI agent. Companies are responsible for the actions of their AI agents, just as they are for the actions of their employees, even if the AI agent is designed or provided by a third party.
The CMA’s guidance sets out four practical steps for businesses implementing agent AI.
Tell customers if you use an AI agent
Companies need to be transparent about how they use AI agents as a means of building trust, especially when the use of AI may surprise customers. Under consumer law, consumers must have the information they need to make informed decisions and must not be misled. If the fact that a customer is dealing with an AI rather than a human could influence their decision-making, companies should communicate that to their customers. Companies should not overstate the role of AI and what their systems can and cannot do.
Train AI agents to comply with consumer law
Businesses need to consider what their AI agents will be configured to do and how that may impact their customers. AI agents should be encouraged to respect customers’ legal rights and contractual terms, avoid misleading customers, and properly obtain necessary consents. Testing is an important part of training, including evaluating performance.
Monitor AI agent performance
Businesses should regularly check whether their AI agents are delivering the correct results, working as intended, and complying with consumer law. Regular human monitoring is essential to detect mistakes and ensure legal compliance.
Improving your AI agent quickly when there are issues
If an AI agent is not behaving as expected, leading to non-compliance outcomes, companies should act quickly to address the issue, including by improving prompts and workflows. This is especially important when AI agents interact with large numbers of people or vulnerable customers.
Example use case
The CMA provides specific guidance across several common use cases.
- For marketing campaigns, AI agents should provide accurate pricing information, including all unavoidable fees, properly label paid recommendations, and verify that offers and discounts are genuine, it said. People with the right experience should regularly review AI-generated marketing materials.
- To process refund requests, AI agents must be designed with consumers’ legal rights under the Consumer Rights Act 2015 and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 in mind, as well as contractual terms such as extended return periods. You should regularly review your interactions with consumers to ensure that your decisions appropriately reflect the nature of the refund request.
- For customer service inquiries, AI agents should accurately respond to inquiries about prices, products, and rights, provide consumers with all the information they need to make informed decisions, and avoid making it difficult for consumers to exercise their rights. Complaints and customer feedback should be reviewed regularly.
- For comparison services, results must be accurate and important information such as market coverage, search data, limitations, how results are ranked, supplier relationships, etc. must be clearly disclosed.
Key risks identified in the study
The CMA research highlights some significant risks that businesses need to be aware of. These include the potential for AI agents to deploy “dark patterns” (design strategies that manipulate consumers into making decisions on the platform), reliability concerns, and the risk of biased or discriminatory outcomes. The CMA also emphasizes that such systems require clearly defined boundaries, clear prompts, and effective override mechanisms. Additionally, they must be built to support interoperability and data mobility to avoid consumers being locked into a particular service.
Separately, the CMA further warned of the risk of collusion by agents, where multiple companies use autonomous systems to independently optimize pricing and commercial decisions. Interactions between these systems can unintentionally reduce competitive pressure.
The UK consumer protection system prohibits businesses from misleading, manipulating or putting undue pressure on consumers, regardless of whether the outcome is due to human action, algorithmic processes or the design of digital interfaces. The CMA has made clear that if an AI agent induces, coerces or misleads a consumer in a way that is detrimental to the consumer’s economic interests, this is likely to be a breach of the law. The principles published by the CMA on foundational models in 2023 remain highly relevant to agent AI, particularly those on transparency and accountability.
If you would like advice on using AI in your customer-facing role, please contact a member of our team.
