UK's 4 Digital Regulators: Firms Answer for Their AI Agents' Errors── Responsibility stays with the firm that deploys an agent, even one built by another company, so testing, human checking and correction must be on record before launch

On October 30, 2026, four UK regulators issued a joint statement saying that an AI agent's autonomy does not reduce the responsibility of the organisation that deploys it. If a firm answers for the errors of an AI agent that another company built, what should it check before putting that agent to work? Three things. The Competition and Markets Authority's guidance names them: testing before launch, a person who watches the agent's decisions, and quick correction once an error turns up. The firm needs a record of each, in a form it can produce later.

01Four UK regulators place an AI agent's errors on the firm that deploys it

Four UK regulators have settled the question of who answers when an AI agent gets something wrong. If an agent acting for a customer makes a mistake, the responsibility sits with the organisation that put the agent in front of that customer. Computerworld, the US trade publication, reported the statement on November 6 under the headline that enterprises must take the blame for their AI agents' mistakes.

The four bodies are the Competition and Markets Authority (CMA), which covers competition and consumer law; the Financial Conduct Authority (FCA), which covers financial services; the Information Commissioner's Office (ICO), which covers personal data; and Ofcom, which covers communications and online safety. They coordinate through the Digital Regulation Cooperation Forum (DRCF), and the statement came out of that forum.

My reading is that the statement gives firms that use agents one more job. Checks they used to leave to the agent's maker now have to be carried out and recorded on their own side. The CMA's guidance, published in March 2026, lists what those checks are: testing before launch, a person watching the agent's decisions, and fast correction when an error is found. A company that buys an agent from outside and uses it to serve customers should have all three settled at the contract and rollout stage.

02The statement adds no new rules and applies seven existing bodies of law

The regulators base the deploying firm's responsibility on law that already exists. The statement creates no new rules at all. It confirms that rules in seven areas apply to personal AI agents as they stand: competition, consumer protection, data protection, online safety, financial services, payments and cyber security.

A personal AI agent, in the statement's sense, is software that shops or completes tasks on a consumer's behalf. The user states the conditions, and the agent compares products, picks one and carries the purchase through to payment. Work that a person once did by clicking through screen after screen is handed to the AI.

The regulators chose plain words. According to Resultsense, a UK business news site, the statement says: "We want to be explicit that existing legal and regulatory frameworks apply to personal AI agents." The same report notes that the statement announced no particular case. It is not a notice of penalties after something has gone wrong. It tells firms in advance where responsibility will land.

The point to take from the figure is that responsibility does not travel back to the maker, even when the maker is a different company. The firm that decided to put the agent in front of its customers is the one that holds the blame when the agent errs.

03The statement covers agents acting for consumers; UK medicines advertising sits with the MHRA

Once it is clear that the seven existing bodies of law apply, the next step is to see where they reach. The statement has in mind situations where an agent acts for a consumer: buying things, moving money, handing over personal data. It names three risks that arise there.

Which of these applies to a given firm depends on what its agent does. An agent that recommends products or plans to customers carries the third risk. An agent that passes customer data to outside services carries the second. Even an agent that does neither can be drawn into the first, because fraudsters target whatever channel customers trust.

Some ground lies outside the statement. In the UK, medicines advertising is handled by a body outside the four: the Medicines and Healthcare products Regulatory Agency (MHRA). The MHRA has a legal obligation to investigate complaints about medicines advertising. I have not checked whether the MHRA has said anything specific about AI agents. Anyone using AI to prepare pharmaceutical promotional material in the UK needs to look at the MHRA's rules separately from this statement.

04In law an agent is not a person; it is treated as part of the firm's own front desk

When an agent acting for a consumer gets something wrong, the blame does not go to the company that built it, because the law does not treat the agent as an independent party. Whatever the agent says or does is treated as something the deploying firm said or did.

The CMA guidance states that a firm's duties under consumer law are the same whether a person or an AI deals with the customer. It then adds that this holds even if someone else designed or provides the AI agent on the firm's behalf. The maker's name may appear somewhere, but the party facing the customer is the firm that deployed the agent.

The ICO takes the same line. According to a commentary by the UK law firm Knights, an ICO report says that organisations remain responsible for data protection compliance of the agentic AI they develop, deploy or integrate. Agentic AI here means AI that, given a goal, plans its own steps and carries them out.

A ruling outside the UK rests on the same reasoning. In 2024, the Civil Resolution Tribunal of British Columbia in Canada heard a case in which an Air Canada chatbot gave a customer wrong information about the terms of a discounted fare. The airline argued that it was not responsible for what the chatbot said. The tribunal rejected that, holding that while a chatbot has an interactive component, it is still just a part of Air Canada's website.

The three grounds come from different countries and different fields of law. They agree on one point: the agent is not cut loose from the firm. The fact that another company built the agent gives the deploying firm no way out.

05The CMA guidance asks for testing, a human in the loop and quick fixes, with fines up to 10% of turnover

If the agent is part of the firm's front desk, the firm has to equip that desk properly. The CMA's March 2026 guidance spells out the equipment. It explains, for businesses that use AI agents, how to stay within consumer law.

The first requirement is testing before launch. The firm tries the agent out before customers see it, checks whether it behaves as intended, and uses the results to improve it. The second is keeping a person watching the agent's decisions. The third is correcting instructions or procedures quickly once an error is found. On top of these, the guidance asks firms to check performance at regular intervals.

The two documents divide the work between them. The statement says, across all seven areas, where responsibility lies; the guidance lists, within consumer law, what a firm has to do about it. The guidance is also more concrete about the cost of getting it wrong.

All three requirements in the guidance run inside the deploying firm. The maker can help only so far: it can hand over test material and logs of the agent's behaviour. Putting a person in place to watch decisions, and changing procedures after an error, are things only the firm facing the customer can do.

06Third-party build, autonomy and the absence of new law each leave the burden unchanged

Testing, human checking and correction change a deploying firm's thinking on three points: the agent was built by someone else, the agent acts on its own, and there is no new law. Until now, each of these could have looked like a reason to take responsibility lightly.

The first point is the outside maker. The CMA guidance says in so many words that the deploying firm is responsible even when another company designed or provides the agent. That means the firm has to get test results from the maker. Unless that is made a condition in the contract, the firm will not be able to assemble its own testing record.

The second point is autonomy. The statement says outright that an agent's autonomy does not reduce the deploying organisation's responsibility. A firm therefore has to decide, before launch, where a person will look at the agent's decisions. No one can review every decision, so the firm must pick the moments that matter, such as a payment or a recommendation with money attached.

The third point is whether to wait for legislation. The statement created no new rules, but it warned that regulators will use their powers where the law appears to be broken. Rules in seven areas already apply, so there is nothing to wait for.

The three points come together in a single habit: keeping records. The record at the end of the chain is the only thing a firm can put on the table when its responsibility is questioned. The statement also lists what firms should make visible to users.

These three are the parts a user can see. Testing and human checking are the parts that stay inside the firm. A firm can claim to have met its responsibility only when both halves are in place.

07No case has been brought yet, and regulators are mapping gaps with government

All three points already bite under existing law. Even so, nobody yet knows which records will weigh most when responsibility is judged. At the time of the statement, the four regulators had not announced a single enforcement case.

What the regulators are doing now is working with government to find the places existing rules do not reach. According to Resultsense, they also encouraged firms to use regulatory sandboxes. A sandbox lets a firm try a new service under limited conditions while the regulator watches.

My expectation is that the first enforcement case will turn on what the firm checked before launch. Since the CMA guidance names testing, human checking and correction, whether records of these exist could become evidence. That is my inference, though, and it cannot be confirmed until a case appears.

Other things remain unknown as well. The statement does not say where the gaps in the rules lie, or when the work with government will conclude. The one certain thing for firms is that existing law already applies. That alone is reason enough to start keeping records today.

Responsibility for an agent stays with the firm that deploys it, whoever built it. What the firm must check before launch is the test results, the person who watches decisions and the steps for fixing errors. Keeping those three as a record it can show is how a firm that uses agents meets its responsibility.