What the four regulators announced

On October 30, 2026, the Digital Regulation Cooperation Forum (DRCF) published a joint statement from its four members: the Competition and Markets Authority (CMA), Financial Conduct Authority (FCA), Information Commissioner’s Office (ICO) and Ofcom. They are preparing for wider use of personal AI agents that can make purchases, communicate with companies and act for a person. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [2 · DRCF · publication of the joint statement · October 30, 2026]

The regulators list legal regimes that already apply: consumer and competition law, data protection, online safety, financial services, payments and cybersecurity. The statement expressly says an agent’s autonomy does not reduce the deploying organisation’s duty to comply. DRCF members say they will use their powers where they reasonably suspect a breach and risk of harm. [1 · DRCF · joint statement on the agentic economy · October 30, 2026]

For shopping services, the document highlights understandable limits on delegated authority, personal-data use, disclosure of commercial interests that may shape recommendations, identifiable accountability and access to redress. It points to fraud, data sharing beyond user expectations and misleading recommendations, decisions or information as risks. [1 · DRCF · joint statement on the agentic economy · October 30, 2026]

The CMA updated its practical business guidance on the same day. It says a company is responsible for an AI agent as it is for an employee, including when a third party supplied the system. The CMA calls for disclosure, checks against consumer rights, pre-launch testing, continuous monitoring and quick remediation. A breach of consumer law can lead to a fine of up to 10% of worldwide turnover. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

What changes in store and service design

For an online merchant, the legal requirement becomes an architecture problem. The system needs to preserve who authorised the agent, when authority was granted, which data it could use, which constraints governed selection and payment, and how the shopper can reverse an action. A consent and decision log is operational evidence: without it, disputes and responsibility across merchant, agent developer and payment provider are difficult to resolve. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

A recommendation agent should disclose the limits of its search and ranking. The CMA uses a comparison service as an example: shoppers should know how much of the market and which data were searched, what limits affect results and whether the service has links to suppliers. In ecommerce, sponsored placement, marketplace-owned inventory or an incomplete catalogue should not be presented as a neutral best choice. [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

Post-purchase service sits in the same control loop. A refund agent must account for statutory and contractual rights, different deadlines and amounts, while a suitably qualified person reviews decisions. A pilot can track wrongful rejections, complaints, manual interventions, remediation time and recommendations that fall outside user constraints. [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026] [4 · CMA · agentic AI and consumers · updated October 30, 2026]

The statement does not establish a single approval route for agentic commerce. The DRCF promises coordination, intelligence sharing and regulatory sandboxes, but publishes no API, test suite, risk thresholds or mandatory timetable. A business still has to map each use case to several regulators and demonstrate that its safeguards work before scaling. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

Expert commentary

The practical message is that liability is not waiting for a bespoke AI-shopping law. UK regulators consider existing rules broad enough to cover recommendations, payments, data and customer service. For a merchant, that changes launch sequencing: consumer-rights analysis and decision controls belong before a public pilot, not after the first complaint. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

A sound agent interface must expose the limits of the mandate, not only the final answer. Shoppers need to know which sellers were checked, who paid for priority, whether the agent may complete payment and which action requires confirmation. That disclosure needs a technical record of authority and events; otherwise transparency cannot be tested when a dispute arises. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

A contract with a model provider does not automatically move responsibility. The CMA places it on the business using the agent in front of customers. Procurement therefore needs access to logs, a shutdown process, remediation deadlines, update testing and allocation of refund or compensation costs. Without those terms, a cheap pilot can become an expensive operational dependency. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [4 · CMA · agentic AI and consumers · updated October 30, 2026]

Refunds and recommendations are the most measurable areas. Refund controls can track wrongful denials, deadline compliance and disagreement with specialist reviewers. Recommendation controls can track mismatched products, catalogue coverage, the influence of paid placement and manual reversals. These metrics do not prove legal compliance, but they can reveal systematic harm before it spreads. [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

Competition is another risk. If an agent can see only a closed catalogue or stores preferences in a non-portable format, it may deepen dependence on one platform while claiming to find the best option. The CMA highlights closed ecosystems, hidden incentives and weaker choice. Quality testing should compare results with the service’s stated market coverage, not only with its accessible inventory. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [4 · CMA · agentic AI and consumers · updated October 30, 2026]

The limitation is the joint statement’s brevity. It provides no technical profile, certification scheme or validated threshold for safe autonomy. Useful next signals will be regulator-specific guidance, sandbox results, shared logging requirements and early enforcement cases. Until then, a narrow reversible pilot with manual takeover and predefined redress is the defensible route. [1 · DRCF · joint statement on the agentic economy · October 30, 2026] [2 · DRCF · publication of the joint statement · October 30, 2026] [3 · CMA · complying with consumer law when using AI agents · updated October 30, 2026]

Sources

  1. DRCF · joint statement on the agentic economy · October 30, 2026 — Primary document from four regulators covering applicable law, organisational responsibility, core risks, coordination and early testing.
  2. DRCF · publication of the joint statement · October 30, 2026 — Official event page confirming the date, participants and purpose of the statement.
  3. CMA · complying with consumer law when using AI agents · updated October 30, 2026 — Official business guidance on disclosure, training, testing, monitoring, refunds, recommendations, responsibility and potential penalties.
  4. CMA · agentic AI and consumers · updated October 30, 2026 — Official analysis of delegated purchases, commercial influence, reliability, closed ecosystems, competition, data and redress.