The United Kingdom has no single AI law. Regulators apply the rules they already have. The FCA reaches agents through Consumer Duty and conduct rules, the PRA through model risk and operational resilience, the ICO through UK GDPR and the Data Protection Act 2018, and the PSR through payment system rules. Named senior managers answer for the outcomes.
What does each regulator require, in plain words?
The FCA. Consumer Duty requires firms to deliver good outcomes for retail customers: products that meet their needs, fair value, communications they can understand, and support that does not create unreasonable barriers. The Senior Managers and Certification Regime makes named individuals accountable for areas of the business, including those where agents work. Conduct rules on advice, complaints and financial promotions apply whatever channel is used.
The PRA. PRA SS1/23 sets model risk management principles for banks: a model inventory, risk-based tiering, development standards, independent validation, monitoring and senior management accountability. Operational resilience expectations require firms to identify important business services and stay within impact tolerances.
The ICO. UK GDPR and the Data Protection Act 2018 govern personal data: lawful basis, fairness, transparency, minimisation, accuracy, security and rights. The rules on solely automated decisions have been amended to widen when such decisions are allowed while keeping safeguards, so check which provisions are in force for you.
The PSR. The payment systems regulator sets rules for payment systems and their participants, including on fraud reimbursement for certain payments. An agent that initiates or handles payments works inside those rules.
Who does it apply to?
FCA rules reach authorised firms, and Consumer Duty applies where they serve retail customers. PRA rules apply to banks, building societies, insurers and major investment firms; SS1/23 applies to banks. The ICO's remit covers any organisation processing personal data in the UK. PSR rules apply to payment systems and their participants.
What does this mean when the system is an agent that acts?
The UK's principles-based approach leaves the design to you, then judges the outcomes. Three points follow.
Consumer Duty tests what the agent does to customers. An agent that answers quickly but fails to spot a customer in difficulty, or that makes cancelling hard, produces poor outcomes. The Duty asks firms to monitor outcomes by customer group, so you need data on how customers fare with the agent compared with people.
A senior manager owns the agent's work. Under SM&CR the responsible senior manager must be able to show reasonable steps to prevent failures. For an agent, that means knowing what it may do, how its authority was granted, and what evidence supports it.
An agent is a model for PRA purposes. Under SS1/23 an agent that drives decisions belongs in the model inventory, tiered and validated, including its instructions, data sources and actions.
Regulators overlap on the same case. Take a customer who reports a scam payment to an agent. The FCA cares whether the customer was supported and treated fairly, the PSR whether reimbursement rules were followed, and the ICO whether the data shared was proper. One case record has to answer all three.
The payments view is covered in AI agents for compliance teams in payments in the United Kingdom and AI agents for operations leaders in payments in the United Kingdom.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Consumer Duty: good outcomes | Outcome monitoring for agent-handled cases by customer group | Outcome reports to the board |
| Consumer Duty: consumer support | Agent cannot obstruct complaints, cancellations or claims; escalation to people | Complaint and cancellation tests; escalation logs |
| SM&CR: accountability | Named senior manager per agent area; statement of responsibilities updated | Responsibilities map |
| PRA SS1/23: inventory and validation | Agent capabilities recorded, tiered and validated on real cases | Inventory; validation reports |
| Operational resilience | Agent dependencies mapped to important business services; fall-back tested | Service maps; scenario tests |
| UK GDPR: lawful basis and transparency | Agent purposes recorded and explained in privacy information | Records; notice versions |
| Automated decisions | Significant decisions carry safeguards: information, representation, human intervention, challenge | Decision records; challenge logs |
| Payment rules | Agent payment actions use authenticated instructions; fraud cases follow reimbursement procedures | Authentication records; case files |
What will the FCA, PRA, ICO or PSR ask?
- What outcomes do customers get when an agent handles their case, and how do you know?
- Which senior manager is responsible, and what steps have they taken?
- Is each agent in your model inventory, and when was it last validated?
- Which important business services depend on agents?
- Can the agent make decisions about people without a person, and what safeguards apply?
- How does the agent handle a customer reporting fraud?
What do these rules not cover?
There is no statute licensing AI systems, no registration of agents and no list of prohibited AI practices of the EU kind. UK firms serving EU customers also face the EU AI Act; compare how AI agents are regulated in the European Union. Firms with US operations should read how AI agents are regulated in the United States. For architecture choices that serve all of these, see how to design an AI agent architecture for a regulated business, and for the full control map, AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
A senior manager needs evidence, not assurances. In Pryme, each agent is certified by Attest on real cases from your own operation, and depth is earned: its role sets a ceiling, the evidence sets the depth, and the lower wins. Certificates lapse after 90 days. Every verdict is filed in an append-only record, so the reasonable steps can be shown case by case.
Questions people ask
Does the FCA approve AI agents before use?
No. The FCA does not approve systems. It expects firms to meet its rules whatever tools they use, and it can ask how an agent is governed during supervision or after a problem.
Is a firm liable for what a customer-facing agent says?
Yes. The agent communicates on the firm's behalf. Misleading or unclear statements are the firm's responsibility under conduct rules and Consumer Duty.
Does Consumer Duty apply to agents serving business customers?
Consumer Duty applies to retail customers. Some small businesses fall within the retail definition for certain products. Business-only agents still face conduct rules and data protection law.