Agentic AI and consumers: CMA guidance

The Competition and Markets Authority (CMA) recently published two closely linked documents addressing the rise of so‑called agentic AI in consumer markets:

• Agentic AI and consumers, a research and analysis paper exploring how increasingly autonomous AI systems could affect consumers, markets and trust.
• Complying with consumer law when using AI agents, practical guidance for businesses highlighting that existing UK consumer protection law applies in the same way to consumer-facing AI agents as it does to humans.

Together, these publications send a clear signal that the CMA views agentic AI as both a major area of opportunity and one of heightened regulatory and enforcement focus.

What is agentic AI and why does it matter?

The CMA uses the term agentic AI to describe AI systems that go beyond assisting human decision‑making. These systems can pursue goals, plan steps, retrieve information from multiple sources and take actions with limited or no human intervention, such as making purchases, managing subscriptions or handling customer complaints.

Existing AI tools typically respond to prompts whilst agentic systems can proactively shape consumer journeys and act on consumers’ behalf. As autonomy increases, the CMA suggests that the scale and impact of potential consumer harm may also increase.

Potential benefits for consumers

The CMA is clear that agentic AI could deliver significant benefits. These include saving time, reducing friction in transactions, improving accessibility and helping consumers navigate complex decisions, such as understanding tariffs or considering the advantages and disadvantages of changing providers. As such, the CMA does not discourage innovation and explicitly recognises the pro‑consumer potential of agentic systems, including the ability to drive consumer engagement. However, this is reliant on such systems being well designed and responsibly deployed.

Key consumer risks identified by the CMA

Alongside these benefits, the CMA identifies a number of risks that are heightened by autonomous, personalised systems. Key concerns include:

• Loss of consumer agency, as highly personalised AI agents may steer or nudge consumers in ways they do not fully understand;
• Misleading conduct at scale, as errors, hallucinations or misleading claims made by an AI agent can be replicated across thousands of interactions in a very short period;
• Bias and discrimination, particularly where training data or optimisation processes lead to systematically unfair outcomes;
• Risks for vulnerable consumers, including those with low digital literacy, financial vulnerability or cognitive impairments.

These risks may be more likely to materialise where agentic AI systems are hyper-personalised or optimised for commercial objectives.

The legal position: no change in principle

Existing UK consumer law already applies fully to agentic AI. This includes the Consumer Rights Act 2015 and the Consumer Protection from Unfair Trading Regulations 2008). If an AI agent breaches consumer protection law, the business deploying it is responsible in the same way as it would be responsible for the actions of a human employee. This remains the case even where the AI system is supplied, trained or hosted by a third party, necessitating the need for robust testing during the procurement process and contractual protections.

The CMA’s expectations for businesses

The CMA guidance paper outlines what businesses should be doing in practice. There are four core themes.

1. Transparency: businesses should be clear when consumers are interacting with an AI agent rather than a human, where that fact could influence a consumer’s decision.
2. Compliance by design: AI agents should be trained and constrained to respect consumer rights, contractual terms and requirements around consent and fairness. Consumer law should be built into system design, rather than addressed retrospectively.
3. Ongoing human oversight: businesses are expected to monitor performance, test outputs and intervene where systems behave incorrectly or unlawfully.
4. Swift remediation: businesses must act promptly when issues are identified to prevent harm spreading further.

Enforcement

Though the guidance is not on a statutory footing, it provides a clear indication of the CMA’s enforcement position. The CMA has confirmed that agentic AI will be a regulatory priority area and the message is that autonomy and technical complexity will not be accepted as mitigating factors.

What businesses should take away

For businesses developing or deploying agentic AI, these CMA publications point to the need for early legal and compliance involvement as well as clear internal ownership of AI behaviour in practice and robust monitoring arrangements.

Though the CMA’s publications do not signal new law, they do signal a more assertive application of existing consumer protection principles to a rapidly evolving technology.