The Digital Regulation Cooperation Forum has delivered an unambiguous message: AI agents are not regulatory black holes. Four UK regulators—the ICO, FCA, Ofcom, and CMA—have jointly confirmed that agentic AI systems deploying autonomous decision-making fall squarely within existing regulatory regimes. For financial services and accountancy firms, this means the Consumer Duty obligations, data protection requirements, and competition law principles that govern human decisions apply with equal force to algorithmic ones. The DRCF report identifies seven critical compliance risks, with fragmented accountability and data protection concerns topping the list.

The implications for product governance are profound. When an AI agent makes decisions on insurance pricing, claims settlement, or tax advice, those decisions carry the same regulatory burden as decisions made by qualified humans. The FCA's Consumer Duty guidance—which requires firms to ensure customers receive fair value—now extends explicitly to algorithmic outcomes. This is not a marginal compliance consideration; it is fundamental to how UK financial firms must architect their use of agentic AI. Organisations deploying AI without explicit guardrails, human-in-the-loop checkpoints, and audit trails now face exposure to regulatory action. Tools such as Trovix Watch enable firms to track regulatory guidance as it evolves, ensuring that AI deployment frameworks adapt in real time to DRCF expectations and FCA supervisory statements.

Data governance becomes the pinch point. The DRCF report emphasises data protection concerns as a core compliance risk—particularly given that many AI agents train on or access customer data to improve decision-making. The ICO has made clear that UK GDPR lawfulness requirements apply to data used by AI agents with full force. Firms cannot rely on the premise that algorithmic processing somehow exempts them from consent, transparency, or data subject rights obligations. This is where governance discipline separates compliant operators from those exposed to enforcement. Documentation of what data AI agents access, how they use it, and what safeguards protect it is now a regulatory expectation, not an optional governance enhancement.

The path forward requires architectural change. Firms must treat AI agent deployment as equivalent to hiring staff: establishing clear accountability, defining decision boundaries, embedding human oversight, and maintaining audit trails. The DRCF guidance makes plain that 'set and forget' agentic AI is incompatible with UK regulation. Organisations that build accountability into their AI stacks from the outset—ensuring that every algorithmic decision can be explained, justified, and traced to a responsible human—will navigate this regulatory terrain far more successfully than those attempting remediation after deployment. The regulatory regime is now explicit: agentic AI operates under the same rules as human decision-making, and that framework is not negotiable.

Source: ICAEW