Businesses are giving AI agents the ability to answer customers, process requests and take action. Recent developments in the UK, US and EU reveal why organizations must distinguish their existing legal obligations from new rules and proposals aimed at particular AI providers and developers.
A customer contacts an online retailer to request a refund.
Instead of waiting for an employee, the customer interacts with an AI agent. The agent retrieves the order, checks the retailer’s refund policy and decides whether the request should be approved.
The retailer operates the service using an agent platform supplied by another company. An AI model developed by a third provider helps the agent interpret the request.
Now consider a hypothetical mistake.
The agent rejects a refund that the customer is legally entitled to receive.
Who is responsible for putting things right?
The answer cannot be established simply by identifying who developed the model or supplied the software. It depends on the activity, the applicable law, the roles of the organizations involved and what each party has agreed or is legally required to do.
Recent regulatory developments make these distinctions increasingly important.
On October 30, 2026, the UK’s Competition and Markets Authority updated guidance explaining that businesses remain responsible for complying with consumer law when using AI agents.
Elsewhere, New York lawmakers proposed further oversight of frontier AI developers, while European regulators continued exercising powers under the EU AI Act.
These developments concern different actors and have different legal effects.
For organizations deploying AI agents, the practical question is which obligations already apply to the activity being automated, which additional rules concern their particular role, and how they can investigate or correct consequential decisions.
Existing consumer-law duties do not disappear when a business uses AI
The UK Competition and Markets Authority (CMA) provides a direct example of how existing responsibilities apply to business-operated AI agents.
Its guidance, Complying with consumer law when using AI agents, explains that businesses must continue to comply with consumer law when agents interact with customers on their behalf.
That remains true where another company designed or supplies the agent.
The guidance includes examples involving customer enquiries, product recommendations, marketing and refunds.
Return to the hypothetical retailer.
The retailer has decided to automate part of its customer service. It chooses the refund process, determines how the agent fits into that process and provides the resulting service to customers.
If the agent gives misleading information about a customer’s rights, the retailer cannot assume that purchasing the software from a supplier removes its own consumer-law duties.
The CMA advises businesses to consider what their agents are configured to do, how customers are informed, how performance is monitored and how problems are corrected.
This does not mean every inaccurate AI response automatically breaches consumer law. A violation depends on the applicable requirements and the circumstances.
Nor does the guidance establish that the retailer alone bears every possible legal consequence. Suppliers may have separate contractual or legal obligations.
The central point is narrower.
Automating a customer interaction does not, by itself, remove the existing obligations associated with that interaction.
Responsibility, liability and accountability mean different things
It is easy to describe an AI incident by asking who is responsible. But the word can conceal several separate questions.
A legal obligation is a duty imposed by applicable law. Consumer-protection requirements may govern the retailer’s dealings with customers.
Legal liability concerns the consequences that may arise when the relevant legal conditions are satisfied. Whether a particular party is liable depends on the law and facts of the case.
Contractual responsibility concerns duties agreed between organizations. The retailer’s contract with an agent-platform supplier may address service quality, security, support and remedies. Such agreements do not necessarily remove statutory duties owed to customers or regulators.
Operational accountability concerns the practical ability to understand, supervise, investigate and correct a system’s actions.
These distinctions also help clarify the roles in the retailer’s application.
The retailer deploys the service and determines how it is used in customer interactions.
The agent-platform supplier may provide workflow software, connections to business systems and tools for executing actions.
The underlying model developer supplies AI capabilities that the platform uses.
Each participant may have relevant obligations. Their allocation cannot be inferred from the mere fact that all three contribute to one automated service.
This is why organizations need to examine both their legal role and the operational arrangements supporting the agent.
Business-operated agents and personal agents are not the same
The refund example involves a business-operated agent.
The retailer deploys the agent to serve its customers. The agent acts within a service controlled by the retailer.
A different arrangement arises when the customer uses a personal AI agent.
Imagine that the customer has an assistant authorized to communicate with retailers, compare purchases and request refunds on the customer’s behalf.
The personal agent may contact the same retailer, but it is acting for the individual rather than operating as part of the retailer’s customer-service system.
The distinction changes the questions that must be examined.
For the retailer’s agent, the immediate issue is how the business fulfills its existing duties when it automates customer interactions.
For a customer’s personal agent, additional questions arise about the authority the person has granted, how the agent accesses services, how it uses personal information and how the people or businesses involved can resolve disputes.
These systems may interact. The personal agent might submit a refund request, and the retailer’s agent might process it.
They should not be treated as one legal category merely because both are AI agents.
What the UK regulators said about personal AI agents
On October 30, the Digital Regulation Cooperation Forum (DRCF) published a joint statement concerning personal AI agents and the developing agentic economy.
Its members are the CMA, Financial Conduct Authority, Information Commissioner’s Office and Ofcom.
The statement describes work underway across these regulators and how existing legal and regulatory frameworks may apply as personal AI agents become more widely used.
This is relevant to a customer delegating shopping or other tasks to an assistant. It is not a direct substitute for the CMA’s separate guidance to businesses using their own agents.
The DRCF’s work raises questions about authorization, information use, commercial interests, accountability and redress.
Different rules may be relevant depending on what a personal agent does and which organizations are involved.
For example, a personal agent purchasing a product may raise consumer-protection questions. An agent processing personal information may engage data-protection requirements. An agent interacting with regulated financial services may raise additional issues.
Not every rule applies automatically to every agent.
The DRCF statement is a joint regulatory position. It does not itself enact one comprehensive liability law for personal or business-operated AI agents.
The distinction is important because the phrase AI-agent regulation can obscure whose activities a regulator is actually discussing.
Deploying an agent is different from developing its underlying model
The retailer depends on technology supplied by other organizations, but using a model is not the same activity as developing it.
A company deploying an AI agent decides how the system is integrated into its services, what it may do and how its actions affect customers.
An agent-platform provider may control software that connects a model to external tools, business data and automated workflows.
A frontier-model developer may be responsible for developing, evaluating and releasing a highly capable underlying model.
Some laws concern the activity performed by a deployed system. Others impose obligations on defined classes of AI providers or developers.
The roles can overlap. One company may develop a model, supply an agent platform and operate a customer-facing service.
That does not make all requirements interchangeable.
For the retailer, compliance by an underlying model provider does not automatically establish that the refund service complies with consumer law.
Similarly, the retailer’s consumer-law compliance does not establish whether the model developer has met separate requirements applying to its own activities.
Business deployer
The retailer deploys the service and determines how it is used in customer interactions. Automating a customer interaction does not, by itself, remove the existing obligations associated with that interaction.
The CMA guidance explains that businesses must continue to comply with consumer law when agents interact with customers on their behalf, even where another company designed or supplies the agent.
For a retailer operating in the EU, the relevant analysis begins with the role it performs, the specific application, its intended use and the dates on which applicable provisions take effect. If the retailer uses an external AI model, that fact alone does not make it subject to every proposed requirement directed at frontier-model developers.
Personal agent
A personal agent is acting for the individual rather than operating as part of the retailer’s customer-service system.
Additional questions arise about the authority the person has granted, how the agent accesses services, how it uses personal information and how the people or businesses involved can resolve disputes.
The DRCF statement is a joint regulatory position. It does not itself enact one comprehensive liability law for personal or business-operated AI agents. Not every rule applies automatically to every agent.
Model developer
The underlying model developer supplies AI capabilities that the platform uses. A frontier-model developer may be responsible for developing, evaluating and releasing a highly capable underlying model.
The EU AI Act is enacted legislation with role-specific requirements. A model provider may have separate duties that do not automatically transfer to the retailer. New York S10731 is a proposal to amend the RAISE Act framework. It concerns oversight of large frontier AI models and does not make its proposed changes immediately operative.
The House committee letters were requests by lawmakers to five identified companies. They did not establish a new general statutory reporting requirement.
Compliance by an underlying model provider does not automatically establish that the refund service complies with consumer law.
The difference becomes clearer when examining recent legislative proposals.
New York’s RAISE proposal concerns frontier-model oversight
On October 28, 2026, New York Senate Bill S10731 was referred to the Senate Rules Committee.
The bill proposes amendments to the state’s existing Responsible AI Safety and Education (RAISE) Act framework.
An existing statutory framework and a proposed amendment have different legal status.
The introduction of S10731 does not make its proposed changes immediately operative.
The proposal addresses oversight of large frontier AI models, including matters involving independent examination, automated AI research, safety and security.
Its requirements depend on the definitions, covered activities and thresholds specified in the legislation.
These subjects are different from determining whether an ordinary online retailer handles refund requests in compliance with consumer law.
If the hypothetical retailer uses an external AI model, that fact alone does not make it subject to every proposed requirement directed at frontier-model developers.
The retailer must assess the obligations associated with its own activities. The model developer must assess those associated with its role.
There may be areas of interaction, but the duties cannot be treated as identical.
As of November 3, 2026, S10731 remained under legislative consideration.
Source: New York State Senate, Bill S10731, 2025 to 2026 legislative session
The EU AI Act is in force, but its obligations are role-specific
The European Union provides another example of why a legal framework must be examined at the level of a particular organization and activity.
The EU AI Act is enacted legislation. Its requirements become applicable according to a phased timetable.
The framework distinguishes several roles, including providers of general-purpose AI models and organizations deploying AI systems.
It also establishes requirements for particular categories of AI systems and practices.
Not every AI application is automatically a high-risk system. An ordinary retailer’s refund agent should not be described as high-risk solely because it uses a general-purpose AI model.
Its classification would depend on the actual intended use and applicable provisions.
Some requirements relate to prohibited practices. Others concern defined high-risk systems, general-purpose model providers or additional obligations associated with particular activities.
The European Commission’s AI Office has enforcement responsibilities for general-purpose AI models and certain AI systems. National competent authorities oversee other AI systems, while the European Data Protection Supervisor has responsibilities concerning AI systems used by EU institutions.
For a retailer operating in the EU, the relevant analysis therefore begins with the role it performs, the specific application, its intended use and the dates on which applicable provisions take effect.
A model provider may have separate duties that do not automatically transfer to the retailer.
The European Commission also discussed information requests sent to more than 30 AI companies in October 2026, concerning safety, security and copyright matters.
The Commission reported receiving responses for deadlines that had expired, with some extensions granted.
Such requests demonstrate regulatory information gathering. They do not, by themselves, establish that the recipients violated the AI Act.
Sources: European Commission, The enforcement framework of the AI Act and European Commission briefing, October 28, 2026
A request from lawmakers is not automatically a legal deadline
Government announcements can look similar while having different legal effects.
On October 28, Democratic ranking members of three US House committees requested AI safety incident information from five frontier AI companies.
The letters included requests to disclose certain newly discovered incidents within 48 hours, or within 24 hours where critical infrastructure appeared to be involved.
Those periods were requests by lawmakers to the identified companies.
They did not establish a new general statutory reporting requirement for every organization using AI agents.
For the hypothetical retailer, the existence of those letters would not itself create a federal duty to report every incorrect refund decision to Congress within 48 hours.
The distinction is between an enacted legal requirement, a legislative proposal, regulatory guidance, an oversight request and an enforcement action. Each must be evaluated according to its actual status and applicability.
Source: US House Committee on Science, Space, and Technology Democrats, October 28, 2026
| Source | What it is | Who it concerns | What it does not do |
|---|---|---|---|
| UK CMA guidance (updated October 30, 2026) | Regulator guidance explaining that businesses must comply with consumer law when AI agents interact with customers on their behalf, including agents another company designed or supplies. | Businesses that use AI agents, such as the retailer in the example. | It does not mean every inaccurate AI response automatically breaches consumer law, and it does not establish that the retailer alone bears every possible legal consequence. |
| DRCF joint statement (October 30) | A joint statement by the CMA, Financial Conduct Authority, Information Commissioner’s Office and Ofcom on personal AI agents and the developing agentic economy. | Personal AI agents acting for people, not the business-operated agents of the CMA guidance. | It is a joint regulatory position. It does not itself enact one comprehensive liability law for personal or business-operated AI agents. |
| New York Senate bill S10731 (introduced October 28) | A proposed amendment to the RAISE Act framework, referred to the Senate Rules Committee and still under consideration as of November 3, 2026. | Frontier AI developers: it addresses oversight of large frontier AI models. | Its proposed changes are not immediately operative. The introduction of the bill does not make them law. |
| EU AI Act | Enacted legislation whose requirements become applicable according to a phased timetable. | Roles such as providers of general-purpose AI models and organizations deploying AI systems, depending on the application and its intended use. | Not every AI application is automatically a high-risk system. An ordinary retailer’s refund agent should not be described as high-risk solely because it uses a general-purpose AI model. |
| European Commission information requests (briefing October 28) | Requests sent to more than 30 AI companies on safety, security and copyright. The Commission reported receiving responses for expired deadlines, with some extensions granted. | The companies that received the requests. | Regulatory information gathering. It does not establish that the recipients violated the AI Act. |
| US House committee letters (October 28) | A request by Democratic ranking members of three House committees to five frontier AI companies: report certain newly discovered incidents within 48 hours, or 24 hours where critical infrastructure appeared to be involved. | The five identified companies. | These periods were requests by lawmakers. They did not establish a new general statutory reporting requirement for every organization using AI agents. |
How should a business investigate an agent’s decision?
For the retailer, the immediate operational problem has not changed.
The refund agent has rejected a customer’s request.
The business needs to understand what the agent did, which information was available, what policy or instructions governed the decision and whether the outcome was correct.
It may need to determine whether the problem arose from inaccurate order records, an outdated refund policy, an incorrectly configured workflow or an unsuitable model response.
The retailer also needs a workable way to address the customer’s complaint and correct the service where necessary.
What the agent did
The refund agent has rejected a customer’s request. The business needs to understand what the agent did.
What it could see
The business needs to understand which information was available to the agent.
What governed it
The business needs to understand what policy or instructions governed the decision.
Was it correct
The business needs to understand whether the outcome was correct.
Where it went wrong
It may need to determine whether the problem arose from inaccurate order records, an outdated refund policy, an incorrectly configured workflow or an unsuitable model response.
The customer
The retailer also needs a workable way to address the customer’s complaint and correct the service where necessary. These are practical questions of operational accountability. They are not presented as a universal legal checklist.
These are practical questions of operational accountability.
They are not presented as a universal legal checklist.
The specific controls required by law depend on the jurisdiction, the business activity and the applicable legal framework.
Nevertheless, a business unable to reconstruct consequential automated actions may struggle to investigate errors or establish how its service operates.
A model supplier’s safety documentation can help explain the underlying technology. It cannot, by itself, prove that the retailer’s entire refund process meets every applicable obligation.
Existing law matters, but difficult questions remain
The CMA guidance does not establish that every legal problem involving autonomous AI has been resolved.
Systems that combine models, business data and external tools can complicate questions about authorization, causation, oversight and remedies.
Multiple providers may contribute to one automated decision, while the organization deploying the system may control how that decision affects the customer.
Existing law may govern an activity without making every dispute straightforward.
But the absence of a universal AI-agent liability statute does not mean that organizations have no responsibilities until new legislation arrives.
The relevant question is which duties already apply and where additional rules may create different obligations for particular actors.
Three questions before deploying an AI agent
Technology leaders can begin with three distinctions.
1. What activity will the agent perform?
An agent answering general enquiries differs from one processing refunds, changing account settings or executing financial transactions.
The organization needs to identify what it is delegating and which laws govern that activity.
2. Whose agent is it, and what role does each organization perform?
A business-operated agent serving customers differs from a personal agent acting on an individual’s instructions.
The deploying business, agent-platform supplier and underlying model developer may also have different obligations.
A supplier contract helps allocate operational duties but does not automatically settle all statutory obligations or legal liability.
3. Which requirements are actually applicable and in force?
An enacted law, regulatory guidance, proposed amendment, information request and enforcement decision have different legal effects.
Organizations should examine the relevant jurisdiction, covered activity, legal definitions and commencement dates before treating a public announcement as a compliance requirement.
These questions establish a useful basis for legal, compliance and engineering teams to assess controls, monitoring and remedies.
Accountability begins with the activity, not the technology label
The developments in the UK, US and EU do not form one universal liability framework for every AI agent.
They show that existing rules can continue to govern automated business activities, while other laws and proposals address particular AI providers, developers and systems.
The hypothetical retailer illustrates the distinction.
Its decision to automate refunds changes how the service operates. It does not automatically eliminate the consumer-law duties associated with that service.
A personal agent acting for the customer creates a different relationship. A frontier-model developer may face separate oversight obligations.
For organizations adopting AI agents, the important decision is to determine what the agent is authorized to do, whose interests it serves and which rules actually govern the activity.
Delegating work to AI does not, by itself, settle or remove the responsibilities attached to that work.
References and further reading
- UK Competition and Markets Authority, Complying with consumer law when using AI agents. Updated October 30, 2026.
- Digital Regulation Cooperation Forum, Protecting people and businesses in an agentic economy. October 30, 2026.
- New York State Senate, Bill S10731. Introduced October 28, 2026.
- European Commission, The enforcement framework of the AI Act.
- European Commission, October 28, 2026 briefing on AI Act information requests.
- US House Committee on Science, Space, and Technology Democrats, Frontier AI incident-reporting requests. October 28, 2026.
Source and legislative-status cutoff: November 3, 2026. This article explains general regulatory distinctions and is not jurisdiction-specific legal advice. Legislative stages, regulator guidance and enforcement developments require rechecking before publication.