The CMA Says You Own Your AI Agent Mistakes. Here Is the Checklist

The CMA guidance on AI agents makes one point hard to miss: the same consumer law rules apply whether a task is handled by AI or by a person, and you are answerable for what the agent does. If you sell to UK consumers and use software to answer queries, process refunds or run marketing campaigns, the guidance published on 30 October 2026 is a practical checklist rather than a new law.

TL;DR

• The CMA says the same consumer rules apply to AI and human agents, and you own the agent mistakes.
• Tell customers when an AI agent is involved, especially where that could affect their decisions.
• Train, test and monitor agents, with a person actively checking decisions and results.
• Fix non-compliant behaviour quickly, and treat third-party agents as your responsibility.
• Enforcement can include fines of up to 10% of worldwide turnover and compensation orders.

Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 1 Nov 2026; ZeroRaised has no commercial relationship with the companies named. This is a summary of published guidance, not legal advice.

Agent accountability is the principle that a business is responsible for what an AI agent does in the same way it is responsible for what an employee does, even when a third party designed or supplies the agent.

What does the CMA guidance actually say?#

The page opens with scale: the UK is the third largest AI market in the world, after the US and China, according to the Global AI Index (the CMA guidance).

The guidance covers agents used for handling customer queries, processing refunds, recommending products and managing marketing campaigns. Its central line is that the same rules apply whether using AI or human agents (the CMA guidance).

You are responsible for what an AI agent does in the same way you are responsible for what an employee does, even if someone else designed or provides the agent (the CMA guidance). That matters for anyone wrapping a third-party agent: provider due diligence is part of your compliance work, not a substitute for it.

The consequences are not theoretical. Breaking consumer protection law can mean enforcement action, including by the CMA, fines of up to 10% of worldwide turnover, and possibly being forced to compensate affected consumers (the CMA guidance).

Do you have to tell customers they are talking to an AI?#

The guidance says to tell customers if you use an AI agent. Consider labelling it so customers are not misled into thinking a real person provides the service, where that might affect their decisions, and do not overstate the role of AI or what it can do (the CMA guidance).

The qualifier is the useful part. This is not a demand for a banner on every screen. It is a test: would a reasonable customer decide differently if they knew? If the agent is negotiating a refund or running an offer, probably yes.

What does the guidance expect you to train and test?#

Agents should be trained to respect statutory rights and contract terms, including cancellation rights, to avoid misleading customers by what they say and by what they leave out, and to obtain any consents consumer law requires (the CMA guidance). Testing is described as a crucial part, with A/B testing and unit testing named as examples.

Testing an agent is not the same as testing a form. The guide to evaluating LLM output covers the measurement side, and the sandboxing guide covers containing what the agent can reach while you learn how it behaves.

How should you monitor an agent and fix problems?#

Monitoring means checking that agents deliver the right results and comply with the rules. The guidance notes that AI can hallucinate, and asks you to make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results (the CMA guidance).

Refinement should be quick. If outcomes are or may be non-compliant, the guidance points to refining prompts or workflows, and says urgency rises with large numbers of people or vulnerable customers (the CMA guidance).

Monitoring is a product feature, not a spreadsheet. The guide to AI agent monitoring covers the logs and alerts, and the companion guide to human approval covers where to put the pause.

What are the four worked examples?#

The guidance also walks through four cases, each mapped to a specific duty.

Marketing campaign. It cites the Digital Markets, Competition and Consumers Act 2024. Prices must be accurate and include all unavoidable charges, paid endorsements must be labelled, offers and price reductions must be genuine, and an experienced person should review the campaign regularly (the CMA guidance).

Refunds. It cites the Consumer Rights Act 2015 for faulty goods and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 for change of mind, plus your own terms such as extended returns periods (the CMA guidance).

Customer service. Answers must be accurate on prices, products and rights, and the process must not make it difficult for customers to exercise their rights (the CMA guidance).

Deal comparison. The service should disclose how much of the market was searched, what data was searched, its limitations, how results are ranked and any links with suppliers (the CMA guidance).

Does a third-party agent change who is responsible?#

Not according to the guidance. Responsibility follows the agent even when someone else designed or provides it (the CMA guidance). If you buy an agent platform or resell an agent, that means reading the provider terms, asking what the agent may do and keeping your own record of its behaviour.

Least privilege is the practical version of that advice: give an agent only the access its job needs, and keep its identity separate from a human admin account. The prompt injection guide explains why an agent that reads untrusted content needs that boundary.

What this means for bootstrapped founders#

1. Write down what your agent may do. If it cannot refund above a threshold, say so in the prompt and enforce it in code.
2. Label the agent where it matters. A short line in the interface, not just the terms page.
3. Build a test set of consumer scenarios: cancellations, faulty goods, price questions and complaints.
4. Put a human on irreversible actions: refunds, compensation and contract changes.
5. Log decisions with the inputs that produced them. You cannot review what you cannot see.
6. Check your suppliers. Ask what their agent does, what data it touches and who is liable when it is wrong.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you sell an AI agent to UK consumers, submit your product and state what the agent does and where a human takes over, because that clarity is a selling point. The newsletter carries new analysis like this, and the pricing page explains the listing options. We make no promise of traffic or results.

Sources#

• CMA: Complying with consumer law when using AI agents