UK telecoms compliance spans two regulators' rulebooks. The communications regulator's conditions govern contracts, price rises, switching and vulnerable customers; handset credit brings FCA rules and the Consumer Duty; and the ICO polices marketing and data. AI agents can test notifications, credit files and consent across every account. People decide findings and remediation.
What do UK telecoms compliance teams spend their time on?
Contract notifications take steady effort. Customers must be told when their minimum term is ending and what they would pay if they stayed, and told each year about the best tariffs available to them. Price rises written into contracts must be clear. Each rule has a trigger, a content requirement and a deadline, and millions of accounts make manual checking impossible.
Handset credit is the second strand. Many providers sell devices on credit agreements that are regulated consumer credit, supervised by the FCA. That brings affordability checks, the Consumer Duty and complaints handling under FCA rules into a business more used to communications regulation.
Vulnerable customers, switching requests, marketing consent under the UK's electronic marketing rules, data subject requests and security duties fill the rest. Policies must keep pace with all of it.
Where can AI agents help?
- Notification testing (depth 1). The agent samples accounts reaching the end of their term, checks whether the notice was sent within the window, and compares its content with the required elements and the customer's actual tariff. It flags each failure with the account record.
- Handset credit file review (depth 1). For a sample of device credit agreements, the agent checks that the affordability assessment was done, that its inputs were verified where the policy requires, and that pre-contract information was given before signature.
- Marketing consent checks (depth 1). Before a campaign, the agent compares the audience with consent records and objections, by channel, and reports who cannot be contacted. After sending, it samples to confirm suppression held.
- Policy drafting (depth 2). When a rule changes, the agent drafts the updated policy and the procedure changes it implies, citing the rule text it relied on. Our answer on whether an AI agent can write compliance policies explains why a person must own the final text.
Handset credit shows why scope matters. The agent testing credit files is working within FCA-regulated activity; the one testing tariff notifications is not. Keep them as separate capabilities with separate certificates, so that evidence for the FCA is clean. The guide to AI compliance agents explains the principle.
What stays with people?
Deciding whether a pattern of missed notifications is a breach of the regulator's conditions, and what to tell affected customers, stays with named compliance staff.
For handset credit, the Senior Managers and Certification Regime makes named individuals accountable. Remediation decisions, reports to the FCA and Consumer Duty conclusions belong to them. An agent that drafts the evidence does not share the accountability.
Vulnerability judgements stay human. The agent can find signs in notes, such as a customer mentioning a disability or a bereavement; deciding what support the customer needed is for a trained person. ICO breach notifications and responses to the regulator are human decisions too.
Which rules apply in the United Kingdom?
The communications regulator sets general conditions for providers, covering contract information, end-of-contract and annual best-tariff notifications, switching, complaints, and fair treatment of vulnerable customers. Separate security legislation places duties on providers to protect their networks and services.
Where a provider offers consumer credit, the FCA supervises that activity. The Consumer Duty requires good outcomes for retail customers in the credit business, and the Senior Managers and Certification Regime assigns named accountability.
UK GDPR and the Data Protection Act 2018, enforced by the ICO, govern personal data, with Article 22 protections for significant automated decisions such as a declined credit agreement. The UK's rules on electronic marketing and cookies, also enforced by the ICO, govern marketing calls, texts and emails.
There is no single AI law; regulators apply their existing rules. Our guide to how AI agents are regulated in the United Kingdom covers the full set.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
First 30 days: pick end-of-contract notification testing. Rules are precise, data is internal and failures affect many customers at once. Name the owner of findings and set the sample size.
Days 31 to 60: replay the agent on a quarter already tested by your team. Measure agreement, read every disagreement and adjust the brief.
Days 61 to 90: certify at depth 1, then start handset credit file review with the FCA-accountable senior manager involved from the start. US operators face a different structure again; see our brief on compliance agents in US telecoms.
Questions people ask
Does the Consumer Duty apply to a telecoms provider?
It applies to FCA-regulated activity, such as consumer credit for handsets. The communications side has its own rules on fair treatment, which overlap in spirit but come from a different regulator.
Can an agent send end-of-contract notifications?
That is an operational task. An operations agent could draft or send them within bounds; the compliance agent's job is to test that they went out correctly.
What records should the agent keep?
Every test it ran, the accounts sampled, the records it read and each flag it raised, alongside the person's decision on that flag. That trail is your evidence for both regulators.