On 30 October 2026, the UK Digital Regulation Cooperation Forum (DRCF) published a joint statement. Its members are the Competition and Markets Authority, the Financial Conduct Authority, the Information Commissioner's Office and Ofcom. It concerns personal AI agents that place orders, contact businesses, and handle email and expenses on a user's behalf: existing law applies to them too, and however autonomous an agent is, the organisation that deploys it cannot excuse itself by saying "the AI did it". The statement creates no new law, yet it states the enforcement position in one go; organisations that provide or deploy such agents in the UK fall within its scope.
What the statement actually covers: existing law applies directly
The scope it names is broad: existing requirements covering competition, consumer protection, data protection, online safety, financial services, payments and cyber security; laws such as product safety that sit outside the Forum members' remits may also apply. The risks it lists are specific too: fraud and scams, personal information shared beyond what users expect, and misleading recommendations, decisions or information. The four regulators say they are already tracking the market, engaging directly with firms, publishing guidance, sharing intelligence and supporting testing in regulatory sandboxes, and will work with the UK Government to identify compliance gaps. Four enforcement lenses may be trained on the same product at once.
Five questions to answer before deployment
The statement asks firms to think carefully, before developing or deploying, about five things: whether users can understand when and how an agent acts on their behalf; how authority to act is given and whether it can be withdrawn; how personal data is used; how commercial interests that may influence recommendations are explained to users; and who is accountable when something goes wrong and how users obtain redress. Measured against those five, firms can start in four places: grade permissions, with human confirmation first for high-risk actions such as payments and signing; put the scope of authority, data uses and commercial relationships where users can see them; keep traceable records of what the agent did, so problems can be checked and corrected afterwards; and engage regulators early, before launch, testing questions in a sandbox. The approach of clearing the authorisation hurdle before personal agents enter the enterprise can serve as a reference for sorting out permission boundaries.
Where the risk lies: no new law, but the constraint already bites
The biggest risk is reading the statement as something to deal with later. It states in terms that where regulators identify conduct they reasonably suspect breaches the law and risks harm to consumers or businesses, they "will not hesitate to use our powers". A single agent may trigger data protection, consumer protection, competition and financial rules at the same time and face parallel scrutiny. The boundaries matter too: the statement confirms only that existing UK law applies; it is not a global rule, and other jurisdictions must be judged separately. It sets out no new penalties or technical checklist, and any gaps will depend on follow-up by the four regulators and the Government. On 31 March 2026 the Forum published a discussion-style foresight paper on agentic AI; the 30 October document is a joint statement, and its signal is more direct: check yourself against existing law now, rather than waiting for new legislation.
