On 9 March 2026, the Competition and Markets Authority published practical guidance on how the consumer protection provisions of the Digital Markets, Competition and Consumers Act 2024 apply to the deployment of agentic AI systems. The publication comprised two closely linked documents and represents the CMA's first direct statement on the obligations that arise when AI agents autonomously set goals, retrieve personal data, coordinate with other agents, and take end-to-end actions on behalf of consumers. The consumer protection chapters of the DMCCA 2024 entered into force on 6 April 2025.
The Digital Markets, Competition and Consumers Act 2024 (Chapter 4, unfair commercial practices) replaced the Consumer Protection from Unfair Trading Regulations 2008 as the primary consumer-facing instrument and grants the CMA direct enforcement authority under Part 3 of the Act without requiring prior court action. The CMA guidance applies the DMCCA's prohibition on misleading commercial practices to agentic AI contexts: businesses must not misrepresent whether consumers are dealing with an AI agent, nor conceal the limits of what that agent is authorised to do. The Act's enumerated list of practices that are automatically unfair regardless of context is addressed in the guidance alongside the general misleading-practices prohibition.
Online retailers, financial services providers, travel platforms, subscription businesses, and any entity deploying AI agents that interact with or take binding actions on behalf of consumers must map their agentic deployments against the CMA's guidance. AI agents that autonomously make purchase decisions, enter subscriptions, retrieve and act on consumer personal data, or coordinate across multiple services without step-by-step human approval represent the highest-risk deployment category under the DMCCA. The CMA may impose fines of up to 10 per cent of global annual turnover for infringements of the consumer protection provisions, enforceable directly without court order.
The CMA guidance does not extend to AI Act obligations under EU Regulation 2024/1689, which apply independently to firms with EU consumer-facing operations under the transparency requirements of Articles 50 and 52. Businesses with dual UK-EU exposure must manage the interaction between DMCCA non-deception requirements and the EU AI Act's disclosure rules for AI systems interacting with natural persons. The CMA has not yet published sector-specific guidance for financial services, healthcare, or insurance; the general guidance applies across all sectors pending any specialised supplementary material.
Licentium advises technology companies and regulated businesses on AI consumer protection compliance in the UK and EU. If your organisation is deploying or procuring agentic AI systems that interact with consumers and needs to assess its position under the DMCCA and the CMA's guidance, we can assist directly or through our partner network. Work we undertake includes AI consumer law compliance, DMCCA advisory, CMA enforcement strategy, EU AI Act alignment, and agentic AI governance design.