What happened
On 30 October 2026 the Digital Regulation Cooperation Forum (DRCF) published a joint statement in which its four member regulators — the CMA, FCA, ICO and Ofcom — set out their shared position on personal AI agents. The statement is explicit that 'existing legal and regulatory frameworks apply to personal AI agents' across consumer, competition, data protection, payments, financial-services, cybersecurity and online-safety law, and that an agent's autonomy does not lessen the deployer's responsibility. It sets a design checklist (disclosure that an agent is acting for a user, how authority is given, which commercial interests shape recommendations, who is accountable, and how redress is obtained), states the regulators 'will not hesitate to use our powers' where conduct is reasonably suspected of breaching the law, and strongly encourages firms to test products early via sandboxes and direct engagement.
Why it matters
This is an authoritative, coordinated position from the four main UK digital regulators that closes off the argument that AI agents fall into a legal gap until Parliament acts. Any UK firm deploying an agent that buys, books or advises on a customer's behalf is now on notice that it is responsible for the agent's conduct, faces fines up to 10% of worldwide turnover for breaching consumer law, and should document answers to the accountability questions before launch. It also signals imminent enforcement activity in the agentic-AI space.
Action needed
For UK deployers of personal/consumer-facing AI agents: map agent use cases, document how authority is granted and who is accountable, ensure agent disclosure and non-misleading output, train and monitor agents for consumer-law compliance (incl. DMCC Act 2024), and consider using the regulators' sandbox/early engagement routes.