Who is responsible when an AI agent makes a payment?

An AI agent that can search, select and pay on your behalf raises a question UK law has not fully answered: if it buys the wrong thing, signs you up to something you didn't want, or runs up a bill you can't afford, who has to put it right?

There is no single rule that settles this. The answer depends on what you authorised, who deployed the agent, and which existing legal framework applies — consumer contract law, payment regulation, consumer credit law, or the Financial Conduct Authority's (FCA) rules for regulated firms. Each answers part of the question; none answers all of it.

This matters now because agentic AI — software that plans a task and carries it out, rather than just answering questions — is moving from demos into products that can place orders and initiate payments. The Competition and Markets Authority (CMA) reported on 9 March 2026 that most consumer-facing agents were still narrow, with a human confirming the final step, and fully autonomous high-stakes use remained limited.

The responsibility map

Four things need establishing before liability can be assessed: what you authorised the agent to do; who supplied it — a regulated firm, or a general-purpose tool you chose yourself; whether the merchant met its consumer-law obligations; and whether a regulated firm's credit or payment duties were engaged anywhere in the chain.

The CMA is explicit on one part of this: a business that deploys an AI agent to deal with customers remains responsible if that agent breaks consumer law, because swapping a human interface for an AI one does not remove the business's duties. That does not resolve what happens when the agent is the consumer's own general-purpose tool, chosen and instructed by the customer rather than supplied by the trader.

The FCA does not currently plan separate AI-specific rules, relying instead on existing frameworks: the Consumer Duty, the Senior Managers and Certification Regime, and firms' governance obligations. Its July 2026 Mills Review nonetheless recommends building foundations for "agentic finance" and monitoring the shift to more autonomous models, treating today's sufficiency and tomorrow's readiness as separate questions.

When the agent buys the wrong item

UK consumer law treats two problems differently. If the item simply isn't what you wanted — the agent's judgement call, not a trader error — the relevant protection is the ordinary distance-contract cancellation right. Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, in force since 13 June 2014, a consumer buying goods at a distance generally has 14 days from taking possession to cancel, subject to exceptions and possible deductions for use or diminished value.

If instead the trader sends a different size or specification from the one ordered, or goods not of satisfactory quality, that's a Consumer Rights Act 2015 problem, not a cancellation problem. The Act, whose main provisions took effect on 1 October 2015, generally gives a 30-day short-term right to reject non-conforming goods, subject to detailed conditions.

When the agent enters an unwanted contract

For an online order that creates a payment obligation, the Consumer Contracts Regulations require the trader to display specified information clearly immediately before the order and obtain an explicit acknowledgement that the order involves paying. If the checkout fails the acknowledgement and button-labelling requirements, regulation 14 says the consumer isn't bound by the contract at all.

What the regulations don't address is what happens when an AI agent, not the consumer, clicks through that checkout. Whether an agent acting on your behalf can validly give that acknowledgement has not been settled by UK authority, which makes the record of what the agent did — what it was told to buy, what confirmation screens it saw, what it reported back — central to any dispute.

When the payment itself is in question

Payment liability runs on a separate track. Under regulation 67 of the Payment Services Regulations 2017, in force since 13 January 2018, a payment is authorised only if you consented to it, or to a series including it, in the form and procedure agreed with your provider. An unauthorised payment must generally be refunded and the account restored by the end of the next business day after the provider becomes aware of it, subject to exceptions (regulation 76). Authentication alone is not conclusive proof you consented, or acted fraudulently or with gross negligence (regulation 75). A payer's liability for losses from a lost, stolen or misappropriated payment instrument is generally capped at £35 unless an exception applies.

None of this was written with AI agents in mind. If you gave an agent your login details or a broad spending mandate, whether a particular payment counts as something you "consented to" is not answered expressly by the regulations — it depends on the mandate's scope, the agreed authentication procedure, and how regulators or courts eventually interpret broad delegation. HM Treasury's 14 July 2026 consultation on modernising payment-services regulation asks how the framework should adapt for agentic payments, confirming this remains open policy work rather than settled law.

When the agent creates debt

If an AI agent applies for credit or triggers a credit increase on your behalf, the lender's regulatory duties remain. Under the FCA's responsible-lending rules (CONC 5), an authorised lender must still carry out a proportionate creditworthiness assessment, including affordability risk, before entering a regulated credit agreement or significantly increasing credit.

Section 75 of the Consumer Credit Act 1974 can also apply, making the creditor jointly liable with the supplier for misrepresentation or breach of contract in a qualifying debtor-creditor-supplier transaction where a single item's cash price is more than £100 and not more than £30,000 — but only where there is an actual supplier breach, not merely an agent choosing a contract-compliant item you didn't want. A lender's affordability failure does not automatically erase the debt; outcomes depend on the facts and, where applicable, a complaint and redress process.

What regulated firms can't outsource

Where a bank, lender or payment firm deploys its own AI tool, it remains accountable under the Consumer Duty (in force for open products since 31 July 2023 and closed products since 31 July 2024), which requires a firm to deliver good outcomes for retail customers, act in good faith, avoid foreseeable harm, and support their financial objectives — within the firm's in-scope activities, not every AI tool a customer uses elsewhere. The FCA has also said its existing framework, including outsourcing and operational-resilience rules, covers firms' use of technology generally: a firm cannot avoid its obligations by pointing to a technology supplier.

Where protection can fall away

The gap opens widest around general-purpose AI tools that a consumer chooses and instructs independently, outside any regulated firm's own service. An FCA-commissioned survey of 5,026 UK retail financial-services consumers (April 2026) found that only 40% correctly identified that neither a formal complaint to the provider nor referral to the Financial Ombudsman Service (FOS) was available in a scenario involving investment information from a general-purpose AI tool; 16% said they had used AI for at least one personal-finance task.

That does not mean AI use strips away all redress: where a regulated firm supplies or deploys the tool, its Consumer Duty obligations and complaints process still apply. The gap is specifically around unregulated general-purpose tools operating outside any regulated firm's remit. Financial Services Compensation Scheme (FSCS) protection is similarly not a backstop against AI mistakes; it depends on an authorised firm's failure and the specific protected activity, not on whether AI was involved.

What to do, and what remains unresolved

If a payment or contract made through an AI agent goes wrong, start with a complaint to the responsible party — the merchant for a consumer-law issue, or the regulated bank, lender or payment firm for a payment or credit issue. Keep a record of your instructions to the agent, any spending limits you set, and any confirmation screens it showed you, since this may matter if the dispute turns on what you authorised. An eligible complaint against an FCA-regulated firm can go to the Financial Ombudsman Service; no equivalent universal route exists simply because a general-purpose AI tool was involved.

The broader framework is still developing: the FCA's Mills Review (6 July 2026) recommends laying foundations for agentic finance and tracking the shift to autonomous models, while HM Treasury's payment-services consultation (14 July 2026) asks how agentic payments should be regulated. Until that work concludes, anyone using AI agents for shopping, payments or credit is relying on contract, consumer and payment law not written with autonomous software in mind, and the line between a broad instruction and a payment actually consented to remains undrawn.

This article is general information, not personalised financial or legal advice. Anyone with a live dispute over an AI-initiated payment or contract should check the official FCA, HM Treasury and CMA publications referenced here, or seek advice specific to their situation.