agentic ai for government is attracting fresh regulatory attention in the United Kingdom, as the Competition and Markets Authority (CMA) and the Information Commissioner's Office (ICO) publish guidance that pushes public-sector purchasers to look beyond glossy vendor material.
Regulators flag consumer-protection obligations
The CMA released a research paper on 9 March 2026 that examines how agentic AI may affect consumers and traders. The paper states that existing UK consumer-protection law applies to AI agents and that breaches can attract fines of up to 10 % of global annual turnover, as set out in the 2026 CMA research paper (source: reedsmith.com).
By treating autonomous systems as "traders" under the Consumer Rights Act, the regulator extends the same liability framework that covers traditional goods and services. This means that a public-sector body that deploys an AI agent which misleads users or delivers sub-standard outcomes could face the same financial penalties as a commercial company.
In an interview with the CMA, the director of competition policy said the agency is "concerned that marketing language may obscure the real risks that autonomous agents pose to everyday users". The paper urges buyers to request evidence of how the system complies with fairness, transparency and redress mechanisms.
Data-privacy guidance from the ICO
The ICO's Tech Futures report, published later in 2026, adds a data-protection dimension to the regulatory picture. It outlines that AI agents process personal data at scale and therefore fall squarely within the scope of the UK General Data Protection Regulation (UK GDPR). The report calls on organisations to understand the capabilities and risks of agentic AI before deployment, warning that non-compliance could trigger enforcement action.
According to the ICO, a key step is to map the data-flows generated by an autonomous system and to conduct a Data Protection Impact Assessment (DPIA) that specifically addresses the agent's decision-making logic. The report also highlights the need for clear documentation of the model's training data, as well as mechanisms for individuals to exercise their rights, such as access and erasure.
"We are seeing a shift from treating AI as a black-box service to demanding granular insight into how it works", an ICO spokesperson told reporters. The guidance therefore complements the CMA's consumer-protection focus by adding a privacy-centric compliance checklist.
Public-sector potential and operational implications
Elsewhen's analysis, also released in 2026, argues that AI agents operating behind the scenes can transform public-service workflows, freeing civil-servants for higher-value work. The report describes scenarios where agents handle routine enquiries, schedule appointments or triage claims, thereby reducing manual processing time.
While the analysis does not provide a specific percentage improvement, it stresses that the speed and consistency of autonomous agents can reshape service delivery. The authors caution, however, that the operational gains will only materialise if procurement processes embed rigorous testing of the agent's methods and outcomes.
For ministries responsible for health, transport or social security, the report suggests that a structured evaluation framework, covering algorithmic fairness, robustness and explainability, should become a contractual requirement.
Implications for procurement and compliance
Taken together, the CMA paper, the ICO report and the Elsewhen analysis signal a shift in how public-sector buyers must approach agentic AI. Rather than relying on vendor brochures, procurement teams are now expected to:
- Request detailed documentation of the AI agent's decision-making process and data-training provenance.
- Commission independent audits that verify compliance with consumer-protection law and UK GDPR.
- Include contractual clauses that impose liability for breaches, referencing the potential fine of up to 10 % of global turnover.
- Plan for ongoing monitoring, with periodic reviews of outcomes against agreed-upon performance metrics.
These steps echo the guidance in the CMA's research paper, which recommends that buyers "evaluate methods and outcomes rather than marketing claims". The ICO's emphasis on DPIAs adds a concrete procedural tool that agencies can embed in their procurement templates.
For officials who have previously relied on standard IT procurement playbooks, the new guidance represents a more demanding evidential burden. As one senior civil-servant source, who asked to remain anonymous, explained, "We now have to ask vendors for the same level of detail we would expect from a financial services provider, algorithmic audit trails, risk registers and clear remediation pathways".
Failure to meet these expectations could expose a department to significant financial penalties and reputational damage, especially if an autonomous system makes a decision that harms a consumer or breaches data-privacy rules.
What buyers should watch next
The CMA and ICO have not announced a timetable for further sector-specific guidance, but both agencies indicated that they will monitor the market closely. Public-sector bodies are therefore advised to stay abreast of any updates and to incorporate the current guidance into their next round of AI procurement.
For a broader view of how AI regulation is evolving across Europe, see our analysis of AI regulation in Europe. Readers interested in the digital transformation agenda of governments can also explore our coverage of government digital transformation.
| Source | Focus | Key requirement |
|---|---|---|
| CMA research paper (9 Mar 2026) | Consumer-protection law | Fines up to 10 % of global turnover for breaches; demand evidence of fairness and redress |
| ICO Tech Futures report (2026) | Data-privacy compliance | Conduct DPIAs, map data-flows, document training data, enable data-subject rights |
| Elsewhen analysis (2026) | Operational potential | Assess methods and outcomes; embed audit clauses; monitor performance |
By aligning procurement practice with these three strands of guidance, UK public-sector buyers can mitigate legal risk while still harnessing the efficiency gains promised by agentic AI.
Sources: Reedsmith, Regulators turn their attention to agentic AI; ICO, Tech Futures: Agentic AI.