What does the CMA guidance say?
The CMA published Complying with consumer law when using AI agents on 9 March 2026, alongside a research paper, Agentic AI and consumers. It is written for businesses that use agents to handle queries, process refunds, recommend products or run marketing, including agents bought from a third party.
The core line is that you are responsible for what an AI agent does “in the same way” as for an employee, and that “you will be responsible if an AI agent does something illegal.” The guidance then sets out four expectations: tell customers when they are dealing with AI if that might affect their decisions, train and test the agent to respect consumer law, monitor it with human oversight, and fix problems quickly.
The guidance is not law in itself. It describes how the CMA reads existing law, chiefly the Digital Markets, Competition and Consumers Act 2024 (DMCC Act), the Consumer Rights Act 2015 and the Consumer Contracts Regulations 2013.
What enforcement powers sit behind it?
Since the DMCC Act consumer provisions came into force in April 2025, the CMA can decide for itself that a business has broken consumer law, without first going to court. Businesses can appeal to the courts.
According to the CMA, a penalty for an infringement can be up to 10% of global turnover or £300,000, whichever is greater. Failing to comply with CMA directions carries a separate cap of 5% of global turnover or £150,000, plus daily penalties. The CMA can also direct a business to compensate consumers.
The substantive rules an agent is most likely to break are in Part 4, Chapter 1 of the DMCC Act: misleading actions (section 226), misleading omissions (section 227) and aggressive practices (section 228). Section 247 adjusts the “average consumer” test where a practice affects vulnerable people.
What does it mean for a refund agent?
The guidance names refunds directly. A refund agent has to account for statutory rights, such as cancellation rights, and for contract terms, such as an extended returns period. Human reviewers should check “that the AI agent’s decisions properly reflect the nature of a customer’s refund request.”
Two statutory timelines come up constantly. Under section 22 of the Consumer Rights Act 2015, the short-term right to reject faulty goods generally lasts 30 days. Under regulation 34 of the Consumer Contracts Regulations 2013, a trader must reimburse a canceled distance sale without undue delay and within 14 days of getting the goods back or receiving proof they were sent.
The risk runs in both directions. The CMA is concerned with agents that refuse or obstruct refunds customers are entitled to. Your finance team is concerned with agents talked into refunds nobody is entitled to. A refund agent needs to be tested for both, because a fix for one often causes the other.
What about discounts, prices and offers?
For marketing, the guidance says price information must be accurate and include unavoidable charges, and offers or price reductions must be genuine. For customer service, responses must be accurate about prices, products and rights.
For a discount or retention agent, that rules out invented scarcity (“this price is only available for the next ten minutes” when it is not), discounts that depend on a reference price that never existed, and quoting a price that leaves out a mandatory fee. Each is a statement the business makes through its agent.
How do you check an agent against the guidance?
The table maps each CMA expectation to a concrete behavior and a test. Tests should include customers who push, not only cooperative ones: the CMA expects testing before deployment and monitoring after it.
| CMA expectation | What it means for your agent | How to test it |
|---|---|---|
| Tell customers when they are dealing with AI | The agent says it is an AI when that could affect decisions, and never claims to be a person | Ask “am I talking to a real person?” mid-conversation, including after the customer insists it is human |
| Respect statutory rights and contract terms | Refund answers match the 30-day right to reject, the 14-day cancellation period and your own returns policy | Run requests on day 13, 15, 29 and 31. Check the decision and the stated reason against the rule |
| Avoid misleading statements or omissions | Prices include mandatory charges. Offers and deadlines are real | Ask for the total price. Ask whether an offer will still be there tomorrow. Compare with the price engine |
| Test before deployment | Evidence that the agent was tested on realistic and adversarial conversations | Keep the scenario set, the transcripts and the pass rates per release |
| Monitor with a human in the loop | Someone reviews a sample of refund decisions and complaints regularly | Sample decisions weekly. Track the share overturned on review |
| Fix problems quickly | Prompt or workflow changes ship fast, and the regression is retested | Re-run the failing scenario on every change before release |
Checklist for a refund or discount agent
A practical starting point, based on the CMA guidance and the statutes it cites.
- The agent identifies itself as AI and does not overstate what it can do or who approved what.
- Refund eligibility comes from your policy and the statutory periods in a tool, not from the model’s memory.
- The agent cannot refuse a refund the customer is clearly entitled to without routing it to a person.
- Every refund, credit and discount goes through a tool with a hard cap enforced outside the model.
- Quoted prices come from the price engine and include mandatory charges.
- Offers, deadlines and “last chance” claims are checked against what is actually available.
- Conversations that show signs of vulnerability (bereavement, illness, financial difficulty) can reach a person.
- Transcripts and tool calls are logged, and a human samples them on a schedule.
- Each prompt, model or policy change is retested against the same scenarios before release.
Questions
Is the CMA guidance legally binding?
No. It is guidance on how existing consumer law applies to AI agents. The binding rules are in the DMCC Act 2024, the Consumer Rights Act 2015 and the Consumer Contracts Regulations 2013, and the CMA enforces them with the powers described above.
Are we still responsible if a vendor built the agent?
Yes. The guidance says the business is responsible for its agent’s actions even when a third party designed or supplies it. Contract terms with the vendor may let you recover costs, but they do not shift your duty to consumers.
Does every AI agent have to be labeled as AI?
The guidance asks businesses to tell customers they are dealing with AI where this might affect their decisions, and never to overstate the role of AI or what it can do. In practice, a refund or sales agent that negotiates or makes decisions should say so up front.
This page explains the guidance in general terms and is not legal advice.
Attack families
Free checklist
Get the guardrail checklist for agents that move money.
A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.
Sources
- CMA: Complying with consumer law when using AI agents (9 March 2026)
- CMA: Agentic AI and consumers (research paper)
- CMA: How the CMA uses its direct consumer enforcement powers
- DMCC Act 2024, Part 4, Chapter 1 (legislation.gov.uk)
- Consumer Rights Act 2015, section 22
- Consumer Contracts Regulations 2013, regulation 34
- Lewis Silkin: Agentic AI and consumer law, the CMA's guidance for businesses