Key takeaways
- AI agents introduce new consumer protection risks. The UK’s Competition and Markets Authority (CMA) warns that autonomous AI systems may make purchases, change services or influence decisions in ways customers do not fully understand or authorise.
- Existing legal responsibilities do not disappear when AI makes decisions. Businesses remain accountable for fair treatment, transparency and appropriate customer outcomes, regardless of whether interactions are handled by people or AI.
- New Zealand professional services firms should establish clear boundaries for AI autonomy. Controls should address customer authorisation, commercial incentives, human approval, audit records and the ability to challenge or reverse AI-driven decisions.
The UK’s Competition and Markets Authority updated its Agentic AI and consumers analysis on 30 October 2026, examining how increasingly autonomous AI systems could change the relationship between businesses and their customers. Unlike conventional AI assistants that provide information or recommendations, AI agents can potentially compare services, negotiate terms, make purchases and complete transactions on a customer’s behalf. The CMA recognises the potential benefits, including reduced administration, better access to services and more efficient decisions. However, it also identifies significant risks involving transparency, commercial incentives, consumer choice and accountability.
For New Zealand professional services firms, the development raises an important question: what happens when AI moves from supporting a customer’s decision to making and implementing that decision?
From providing advice to taking action
Most organisations currently use generative AI to draft documents, analyse information, answer questions or support employees making decisions. Agentic AI extends these capabilities by allowing systems to pursue objectives and complete multiple activities with varying degrees of independence. For example, an AI agent could monitor insurance policies, compare financial products, negotiate supplier arrangements or manage subscriptions. Depending on its permissions, it might also initiate transactions or make changes without requiring approval at every step.
The CMA describes this as a potential shift from using AI tools towards delegating outcomes. While fully autonomous consumer agents remain at an early stage, more limited systems are already being introduced into customer service, commerce and business operations.
The governance challenge is that increased autonomy can also increase the consequences of errors, unexpected behaviour and poorly understood decisions.
Whose interests is the AI agent serving?
One of the CMA’s most important concerns is whether AI agents will consistently act in the interests of the people relying on them. An agent recommending financial products, professional services or insurance arrangements may be influenced by the commercial relationships of its provider. It could favour particular suppliers, prioritise higher-margin products or recommend options from a limited selection without making those restrictions clear.
These risks are not entirely new. Businesses have long been required to manage conflicts of interest, misleading representations and inappropriate recommendations.
However, AI agents may make commercial influences harder to identify because recommendations can be personalised and decisions may occur across several automated steps.
For New Zealand professional services firms, this reinforces the importance of understanding how AI recommendations are generated, whether commercial incentives influence outcomes and what information customers receive before relying on those recommendations.
Customer authorisation needs clear boundaries
Another significant issue is the authority customers give AI systems to act on their behalf. A customer might authorise an agent to identify cheaper services or review contractual arrangements. That does not necessarily mean the customer has agreed to cancel an existing contract, disclose personal information or enter a new financial commitment.
The CMA highlights the importance of clear boundaries around delegated authority, particularly where actions could have significant financial or contractual consequences.
For professional services organisations, this means distinguishing between permission to analyse information, recommend an action and actually perform it. An AI system preparing a recommendation may require relatively limited oversight. An agent authorised to send instructions, change records, transfer information or commit a customer to an agreement requires substantially stronger controls. Human approval should occur before consequential or difficult-to-reverse actions, rather than simply reviewing a report after the activity has been completed.
Transparency must extend beyond identifying AI
Many organisations are introducing notices explaining that customers are interacting with AI. While useful, the CMA’s analysis suggests transparency needs to go further. Customers may need to understand what an agent can do, which providers it considers, whether recommendations are commercially influenced and what limitations affect its decisions. For example, an AI agent describing a product as the best available option could mislead customers if it only searched a small group of suppliers. Similarly, an agent negotiating a service agreement should operate within clearly defined parameters and disclose relevant limitations.
Effective transparency therefore concerns the capabilities, authority and commercial arrangements behind an AI system, not simply whether the customer knows AI is involved.
Existing New Zealand obligations remain relevant
The CMA’s publication concerns the United Kingdom and does not introduce new legal obligations for New Zealand businesses. However, the underlying principles have direct relevance to existing New Zealand law.
The Fair Trading Act 1986 prohibits misleading and deceptive conduct in trade. The Consumer Guarantees Act 1993 establishes protections for consumers receiving qualifying goods and services, while the Privacy Act 2020 governs the handling of personal information.
Depending on the service, professional and sector-specific requirements may also apply. Financial advisers, lawyers, accountants and other professionals need to consider their existing duties when using AI to support or deliver client services.
New Zealand’s Ministry of Business, Innovation and Employment also encourages organisations to establish appropriate governance, accountability and risk management when adopting AI.
These frameworks do not provide a complete set of agent-specific operating rules. Nevertheless, they reinforce that introducing AI does not automatically remove responsibilities relating to professional judgement, customer protection and information handling.
The risk of decisions that cannot be explained
AI agents may perform several actions before presenting a final result, making it difficult to understand how a particular outcome was reached. A customer might receive a new service arrangement without knowing which alternatives were considered, what information influenced the selection or why certain options were rejected. This creates challenges when something goes wrong.
Organisations may need to reconstruct the agent’s instructions, permissions, information sources, recommendations, approvals and completed actions. Without adequate records, resolving complaints or determining responsibility can become difficult. The CMA identifies monitoring, audit logs, human oversight and clear processes for correcting problems as important safeguards.
For professional services firms, these controls also support defensible decision-making and professional accountability.
What this means for your organisation
1. Identify AI systems that can take action. Distinguish ordinary AI assistants from agents capable of making changes, communicating externally, accessing client systems or initiating transactions. Maintain an inventory of their purposes, permissions and accountable owners.
2. Define customer authorisation. Establish what an AI agent may do independently and which activities require explicit customer or employee approval. Apply stronger controls to financial commitments, contractual changes and other consequential actions.
3. Review commercial incentives. Assess whether AI recommendations could be influenced by supplier relationships, commissions, preferred providers or other commercial arrangements. Ensure relevant limitations are understood and disclosed appropriately.
4. Test customer outcomes. Evaluate whether agents produce accurate, fair and suitable results under realistic conditions. Include unusual requests, incomplete information, conflicting preferences and potentially vulnerable customers.
5. Maintain meaningful audit records. Retain appropriate evidence of instructions, information accessed, actions taken, approvals and exceptions. Records should support investigation and accountability while respecting privacy and confidentiality requirements.
6. Provide effective human intervention. Ensure customers and employees can question decisions, escalate concerns and stop inappropriate activity. Where practical, establish processes to reverse incorrect actions and remedy resulting problems.
7. Review existing legal and professional obligations. Assess how consumer protection, privacy, contractual and sector-specific requirements apply before allowing AI to perform client-facing activities.
The next stage of AI governance
The CMA’s analysis highlights an important development in how organisations should think about artificial intelligence. Governance can no longer focus exclusively on whether AI produces accurate information. Increasingly, organisations must also consider whether AI systems act within authorised boundaries, serve the interests of the people relying on them and produce appropriate outcomes.
For New Zealand professional services firms, the immediate priority is not to anticipate every future capability of autonomous AI. It is to establish clear rules before introducing systems that can make consequential decisions or take actions on behalf of customers.
As AI moves from providing advice towards completing tasks, effective governance will depend on maintaining transparency, customer control and organisational accountability.
