The CMA's case for policing AI agents rests on three footnotes, a 1995 textbook, a law firm's blog and an IBM-paid study. Its joint statement with the ICO never mentions the ICO's own enquiry into OpenAI and Anthropic.
Estimated reading time: 7 minutes
.jpg){kind=link}
In short. On 30 October 2026 the Competition and Markets Authority updated its "Agentic AI and consumers" report [1] to link a new joint statement from the CMA, FCA, ICO and Ofcom [2]. The report makes sweeping, unlinked claims about agentic AI's risks and benefits, "some evidence suggests", "industry analysis highlights", "some industry commentary has emphasised" [1], yet its entire footnote apparatus for the whole document is three sources: a 1995 artificial intelligence textbook written decades before large language models existed, a law firm's blog post about the EU's AI Act, and a consumer study commissioned by IBM, a company that sells agentic AI products to businesses [1]. The joint statement says the four regulators are "already taking action" and "engaging directly with firms developing and deploying AI agents" [2], but never names a single firm, case or figure, and does not mention the one concrete, dated action its own co-signatory, the ICO, had already announced three weeks earlier: open enquiries into OpenAI, Anthropic, Meta and the UK AI Security Institute, and a call for evidence that closed within three weeks of this statement [5]. Two documented mistakes: four stars.
Agentic AI, software that does not just answer questions but plans, decides and acts on a user's behalf, is the subject the CMA has chosen to stake a claim on. "Agentic AI could drive a step change in how people use AI and its impact on their lives", the CMA's research report says, and warns in the same breath that "without appropriate safeguards, agentic systems could undermine trust in AI and consumer markets" [1]. That is a large claim about a new technology, and the document built to support it was first published on 9 March 2026 and updated again on 30 October 2026 [1], the day the CMA, FCA, ICO and Ofcom published a joint statement on "protecting people and businesses in an agentic economy" [2]. Read the report and the statement against what each actually cites, and the apparatus behind both is thinner than the claims they carry.
The claims, tested
| The document's own words | What the document itself actually cites | Verdict |
|---|---|---|
| The CMA's report repeatedly asserts risk and momentum without naming a source: "early evidence of efficiency gains" driving investment, "some evidence suggests deployments to date focus more on specific workflows", "some industry commentary has emphasised" that full autonomy is years away, and "industry analysis highlights" limits on current systems' reliability [1] | None of those four phrases carries a footnote. The report's only three footnotes, checked against the page's own markup, attach to a definition of "agent" (Russell and Norvig's 1995 textbook, cited twice), a note on AI memory (a CMS LawNow blog post on the EU AI Act, no link given), and one claim about limited deployment in "high stakes" contexts ("For example, IBM 2026 Consumer Research Study", no link given) [1] | The document's most consequential claims, about the pace of adoption, the state of the evidence and the shape of industry opinion, have no citation anywhere in the text |
| The DRCF joint statement, signed by the CMA, FCA, ICO and Ofcom: "We are already taking action. We are tracking market developments closely, engaging directly with firms developing and deploying AI agents, publishing guidance for firms, sharing intelligence and evidence across regulators... and maintaining close coordination at leadership level" [2] | No firm, case, number or date appears anywhere in the three-page statement. The ICO, one of the four signatories, had already announced on 8 October 2026, 22 days earlier, that it had "enquiries" open into OpenAI, Anthropic, Meta and the UK's AI Security Institute over "recent agentic AI testing and deployment", alongside a six-week call for evidence on agentic AI that closed 20 November 2026, three weeks after this joint statement [5] | The signatory with the one concrete, named, dated agentic AI action on record does not get that action mentioned in the document whose entire subject is coordinated regulatory action on agentic AI |
| The CMA's practical guidance for businesses: "If you break consumer protection law, you could face action by enforcement authorities (including the CMA). You could be fined up to 10% of your worldwide turnover" [3] | The CMA's own enforcement-powers guidance sets out the process behind that figure: a provisional infringement notice, a right to make representations, a final infringement notice, and a right of appeal to the High Court within 60 days, before any penalty, up to 10% of global turnover or £300,000, whichever is greater, is actually imposed [4] | Accurate as a maximum figure, but the guidance strips out the due process that stands between a business and that number |
A textbook, a blog and a vendor's survey
The report's language is the language of a document marshalling evidence: "evidence suggests", "industry analysis highlights", "industry commentary has emphasised". None of those phrases points anywhere. The document's actual footnote list, three entries long for a report covering nine sections on adoption, risk, law and the CMA's own capability, reads as follows in full: Russell and Norvig's "Artificial Intelligence: A Modern Approach", a university textbook first published in 1995, nine years before Facebook and seventeen before the transformer architecture that underpins today's large language models; a CMS LawNow blog post titled "Agentic AI and the EU AI Act", dated April 2025, about a different jurisdiction's legislation; and "IBM 2026 Consumer Research Study, Own the Agentic Commerce Experience", introduced only with "For example" and never linked [1]. IBM sells agentic AI products to the same businesses this report and guidance are aimed at. None of the three footnotes is hyperlinked in the published document, even though the report links out freely elsewhere, to the CMA's own foundation model principles, its 2018 pricing-algorithms paper and its 2021 algorithms report [1]. The claims about dark patterns, bias, loss of consumer agency and "agentic collusion" that make up the report's risk section carry no footnote at all; they stand on the CMA's own authority alone.
What the joint statement leaves out
The joint statement's register is deliberately active: "we are tracking", "engaging directly", "publishing guidance", "sharing intelligence", "maintaining close coordination" [2]. Read on its own, that sounds like an account of ongoing enforcement-adjacent work. Read against what one of its four signatories had already put on the public record three weeks earlier, it reads as a document that omits its own best example. The ICO's 8 October 2026 announcement named four organisations under enquiry, OpenAI, Anthropic, Meta and the UK's AI Security Institute, over "recent agentic AI testing and deployment", and opened a six-week call for evidence on agentic AI, closing 20 November 2026 [5]. That call for evidence closes within three weeks of the joint statement's publication date. None of it, the enquiries, the companies, the closing date, appears in the joint statement, despite the statement's entire subject being coordinated regulatory work on exactly this technology. A reader relying on the joint statement alone would not know that one of its signatories already has a live, dated, named piece of this work in progress.
Two documented mistakes, four stars. (1) The CMA's "Agentic AI and consumers" report makes its central claims about risk, adoption pace and industry opinion in language that asserts evidential backing, "evidence suggests", "industry analysis highlights", "industry commentary has emphasised", while its entire footnote apparatus for the whole document is three unlinked sources: a 1995 pre-LLM textbook, a law firm's blog about EU law, and a study commissioned by IBM, an agentic AI vendor. (2) The DRCF joint statement published the same day claims the CMA, FCA, ICO and Ofcom are "already taking action" but names no firm, case or figure, and omits the one specific, dated action a signatory, the ICO, had already announced three weeks earlier, open enquiries into OpenAI, Anthropic, Meta and the AI Security Institute, and a call for evidence closing within three weeks of the statement.
Credit where due
The practical guidance document is genuinely useful where it is concrete: its worked examples on marketing campaigns, refunds and customer service queries name the specific statutory rights at stake, the Consumer Rights Act 2015, the Consumer Contracts Regulations 2013, the Digital Markets, Competition and Consumers Act 2024, rather than gesturing at "the law" in general [3]. The research report is also candid about risk categories that a less careful document might have smoothed over: it names "dark patterns" and manipulative design as a specific risk of hyper-personalised agents, flags bias and discriminatory outcomes in multi-step reasoning, and links agentic AI explicitly to the CMA's own earlier warnings about algorithmic pricing and coordinated market outcomes [1]. And the CMA's statement that "we don't believe that heavy-handed, sweeping regulation is right for the UK" is a stated position, not a hidden one; a reader knows where the regulator stands even while checking its working [1].
Sources
- Agentic AI and consumers, Competition and Markets Authority, first published 9 March 2026, updated 30 October 2026.
- Protecting people and businesses in an agentic economy: A Joint Statement by DRCF Members (PDF), Digital Regulation Cooperation Forum, 30 October 2026.
- Complying with consumer law when using AI agents, Competition and Markets Authority, first published 9 March 2026, updated 30 October 2026.
- How the CMA uses its direct consumer enforcement powers, Competition and Markets Authority.
- ICO secures changes from leading AI developers as scrutiny extends to AI agents, Information Commissioner's Office, 8 October 2026.