# AI customer service agents and the law in the United Kingdom > What applies when a UK business puts an AI agent in front of customers: UK GDPR, the 2026 changes to automated decision-making, ICO expectations, PECR for chat widgets, transfers to US vendors and the FCA's Consumer Duty. With links to the official texts. Published: 18 September 2026 · Updated: 18 September 2026 · Prices and figures verified: 18 September 2026 · By the ai-agents.reviews team This page was researched and drafted with AI assistance from the sources listed on it. We have not run hands-on tests of these products. Method: [How we review](https://ai-agents.reviews/en-gb/how-we-review) > **General information, not legal advice.** We link to official sources and state what we verified on the date shown on this page. Check your own obligations with a qualified adviser. **The short version** - **No UK AI Act.** Existing data protection, consumer and sector rules apply. - **Automated decisions are now permitted with safeguards**, not banned by default, since 5 February 2026. - **The ICO expects a DPIA** for almost any use of AI with personal data. - **You need a written contract** with the vendor as your processor, and a lawful route for transfers to the US. - **FCA-regulated firms:** the Consumer Duty covers what your chatbot tells customers. ## No AI-specific statute The UK has no equivalent of the EU AI Act. The May 2026 King's Speech [did not include a standalone AI bill](https://www.twobirds.com/en/insights/2026/ai-in-the-kings-speech-2026-regulating-for-growth-bill-announced); the government announced a Regulating for Growth Bill with regulatory sandbox powers instead. If you also serve customers in the EU, the EU rules apply to those customers, including the duty to tell people they are talking to an AI, which has applied since 2 August 2026. ## Automated decisions: the 2026 change The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with [new Articles 22A to 22D](https://www.legislation.gov.uk/ukpga/2025/18/section/80), fully in force since 5 February 2026. The old general prohibition on solely automated significant decisions has become a permissive regime with safeguards; tighter restrictions remain for special category data. A decision is solely automated if there is no meaningful human involvement. In practice: if your agent can take a significant decision about a customer on its own, such as refusing a claim or closing an account, you must tell the person, let them make representations, provide human intervention on request and let them contest the decision. An agent that only answers questions is unlikely to reach that threshold. The ICO consulted on updated guidance between March and May 2026; we could not confirm that the final version had been published when we checked. ## DPIAs and the processor contract The ICO's [guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/) says that in the vast majority of cases the use of AI will trigger the legal requirement for a data protection impact assessment. The guidance is marked as under review because of the 2025 Act, but the expectation stands. A written controller–processor contract is mandatory whenever a vendor processes personal data on your behalf, including terms on sub-processors. Ask every vendor for its DPA and sub-processor list; several in this category list US-based model providers as sub-processors even where data is stored in Europe. ## Transfers to US vendors UK businesses can send personal data to US organisations certified to the UK Extension to the EU–US Data Privacy Framework under the [UK–US data bridge](https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-factsheet-for-uk-organisations), in force since October 2023. The bridge depends on the EU–US framework, which survived a General Court challenge in September 2025 but is under appeal at the Court of Justice. Keep standard contractual safeguards as a fallback and check the vendor's certification. ## Chat widgets and PECR A chat widget that stores or reads information on a visitor's device needs prior information and consent under [PECR regulation 6](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/), unless the storage is strictly necessary for a service the user has requested. "Helpful" or "convenient" is not the test. The ICO is consulting on revised guidance, so review what your widget sets before the visitor opens it. ## Financial services: the Consumer Duty The FCA has said it [will not introduce AI-specific rules](https://www.fca.org.uk/firms/innovation/ai-approach) and relies on existing frameworks, naming the Consumer Duty and senior manager accountability. For a support chatbot that means the consumer understanding and consumer support outcomes apply: what the agent says must meet customers' information needs, and support must work for vulnerable customers too. A senior manager should be clearly accountable for the use case and for the third-party AI service behind it. ## A pre-launch checklist 1. The agent says it is an AI in its first message. UK law does not spell this out as the EU does, but it is the simplest way to be fair and transparent. 2. A customer can reach a person, and the route is obvious. 3. A DPIA is completed and kept up to date. 4. A processor contract and a transfer mechanism are in place, with the sub-processor list reviewed. 5. Any significant automated decision has the Article 22C safeguards built into the flow. 6. The widget's cookies and storage are covered by your consent mechanism. 7. Conversations are logged so you can audit what the agent said. > **Scored on a public rubric, from sources you can open.** Every score on this site comes from five published criteria: pricing transparency, performance evidence, access, coverage, and control. Each price and percentage comes from one product database and links to its source, so every page agrees with every other page. Rubric v1.0 · We have not run hands-on tests yet, and no page here claims we did. [Read the full method](https://ai-agents.reviews/en-gb/how-we-review) ## Keep reading - [What counts as a resolution?](https://ai-agents.reviews/en-gb/guides/what-counts-as-a-resolution) - [Resolution rate vs deflection rate](https://ai-agents.reviews/en-gb/guides/resolution-rate-vs-deflection-rate) - [Per-resolution vs per-seat pricing](https://ai-agents.reviews/en-gb/guides/per-resolution-vs-per-seat-pricing) - [How to run an AI agent pilot](https://ai-agents.reviews/en-gb/guides/how-to-run-an-ai-agent-pilot) - [The best AI customer service agents in 2026](https://ai-agents.reviews/en-gb/best/ai-customer-service-agents) --- Canonical: https://ai-agents.reviews/en-gb/guides/ai-customer-service-agents-and-the-law