In the first nine days of November, three parts of the UK gave three different answers to the same question: when an AI agent does something on someone’s behalf, who is answerable for it? In a 3 November factsheet, ministers set out how they would investigate agents that slip out of control, but only inside essential and digital services. Five of Britain’s biggest banks moved to block agents from customer accounts, citing the absence of clear rules on who would be responsible if one went rogue. And Meta prepared to bring Muse, an agent that can buy things and pay bills, to UK users within weeks. Our news reports cover each announcement. This analysis looks at what the three answers add up to, and where a UK customer’s agent falls between them.
Three answers in nine days
| Who | What they did | Their answer to “who is accountable?” |
|---|---|---|
| Government, through the cyber resilience bill | A clause allowing future regulations to hand the Secretary of State powers to investigate and enforce where an AI agent may have slipped out of an operator’s control | The regulated operator, with the state able to investigate |
| Barclays, HSBC, Lloyds, Nationwide and NatWest | Moves to block AI agents from customer accounts, in some cases banning transactions made for a customer without their direct involvement | Unresolved, so the banks are keeping agents out |
| Meta | Lining up retail partners for a UK launch of Muse, which will earn fees on transactions it carries out | Not addressed in the launch reporting |
Strategic Reality: None of the three moves settles who pays when an agent acting for a consumer gets it wrong. The cyber clause is built to find out what happened in essential services, the banks will not take the risk while the rules are unclear, and the reporting on Muse’s UK launch does not address it.
What the cyber clause actually covers
The government amendment, tabled by Baroness Lloyd of Effra and agreed at Lords report stage on 26 October, adds a new clause to the Cyber Security and Resilience (Network and Information Systems) Bill. It allows regulations under the Bill to give the Secretary of State functions in cases where a compromise of a relevant system “is or may be attributable to loss of oversight or control of an AI agent”. The Register described the clause as introduced at third reading; the parliamentary record places it at report stage, with third reading following on 2 November. Our news report sets out the mechanics.
Three features matter for the accountability question.
It defers almost everything. Both “AI agent” and loss of “oversight or control” have “the meaning given by regulations made by the Secretary of State”. The government’s factsheet on the measures, updated on 3 November, says those definitions will be developed with industry and oversight authorities, and that each measure needs consultation first, then Parliament’s approval under the affirmative procedure.
The powers it allows are heavy. Regulations could let the Secretary of State appoint inspectors with power “to enter, inspect and search premises of a regulated person”, seize documents, run tests and interviews, and impose financial penalties for non-compliance. Stuart Davey, a partner at Pinsent Masons, told The Register the clause was “quite novel”.
It is deliberately narrow. The factsheet says the measures “are not intended to establish a comprehensive framework for AI governance or to tackle general AI harms”. They are meant to cover “incidents where operators are unable to adequately monitor or control AI agents”. The Register reports that builders of foundation models would not automatically come into scope merely for making the underlying technology.
Critical Context: The clause reaches “regulated persons” under the NIS regime. The government’s own summary of the Bill says the NIS Regulations “do not cover the whole economy”: they apply to essential services such as energy, transport, health and drinking water, plus some digital services.
Who carries the duty under it
The answer this clause gives is the operator. The factsheet’s four planned measures are security and resilience requirements, duties to notify organisations an agent has affected, duties to preserve evidence such as “actions taken by agents, or operator attempts to control them”, and a ministerial power to have government experts review incidents. The first three place duties on the regulated organisation; the fourth lets government experts request information from it and run tests.
Evin McMullen, chief executive of AmanTrue, put the logic plainly to The Register: “The deployer of an AI agent chooses its permissions, connects it to systems, and gives it access to data.” In McMullen’s view, “Accountability stays with the organization that put the agent into the system, and ultimately with executives and the board.”
That fits an operator running agents inside its own industrial control systems, which is the scenario the factsheet’s hypothetical example describes. It is a less obvious fit for an agent a consumer switches on.
The banks’ answer: not in our accounts yet
According to the Telegraph, Barclays, HSBC, Lloyds, Nationwide and NatWest have each taken steps to keep AI agents out. The reason the paper gives goes straight to the accountability question: banks fear bots could mismanage people’s money, “with no clear rules as to who would be responsible in that scenario”. The paper understands the bans to be precautionary. Lloyds had seen no sign of agents getting into accounts, according to its chief financial officer, Will Chalmers.
The plainest statement of the problem came from the US. Rick Wurster, chief executive of Charles Schwab, which the Telegraph says stops 10 to 20 clients each week from using agents, named Muse directly: “We don’t want someone just giving their password to Muse, and letting Muse come in and take action on that client’s behalf”. His reason: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”
Strategic Insight: Wurster’s question is not one the cyber clause sets out to answer. The functions it lists cover investigating incidents, preserving information, assessing causes, testing remedies and enforcing compliance. Nothing in its text deals with compensating anyone.
The Telegraph also draws a line between reading and acting. Personal finance products recently launched by Anthropic and OpenAI “only read financial information, rather than taking action on users’ behalf”. UK rules already put a human step in the way of the second kind: most payments need the customer’s approval in their bank’s app, often by fingerprint or face, according to the paper.
The Telegraph reports the Financial Conduct Authority to be drawing up rules for AI agents in finance alongside the City and fellow regulators, though people close to the FCA told the paper that access decisions rest with the banks.
Meta’s answer: launch first
Muse is built to act. Retail Gazette reports that it can research products, complete purchases, book transport, pay bills and manage emails, that it has over 11 million users, and that shopping is the function people use most. Meta plans to keep it free for most users and to earn fees on transactions the platform carries out.
That revenue model is the commercial stake. An agent that earns a fee each time it completes a purchase has an interest in completing purchases. Retail Gazette’s report does not say how Meta will allocate responsibility in the UK when a purchase or bill payment goes wrong, and Meta has yet to confirm an official launch date.
Competitive Reality: Amazon stopped Muse buying on its site in September, pointing to unauthorised access and the security of its customers, according to Retail Gazette. In our view, the UK banks’ blocks make the same call on the payment side, and UK retailers now face the choice Amazon made ahead of Muse’s arrival.
Who is affected
| Group | Where they stand now |
|---|---|
| Energy suppliers and cloud or managed IT providers running agents | Within the cyber clause’s potential reach once regulations are made; The Register names cloud and managed IT providers that run agents for customers among those potentially affected |
| Online marketplaces, search engines and cloud services | Already NIS digital services; the Bill summary says “some AI services may meet these definitions” |
| Bank customers | Five named banks are blocking agents as a precaution; most UK payments already need approval in a banking app |
| UK retailers | Deciding whether to partner with Muse, tolerate it, or block it as Amazon did |
| Consumers using agents | Their personal data is the ICO’s concern, and it says an agent’s autonomy is no excuse for poor compliance by organisations; the cyber clause reaches only NIS-regulated persons |
Where a customer’s agent falls between the answers
Put the three answers side by side and a gap appears. The cyber clause holds operators to account, but only regulated ones. The banks have declined to take the risk at all while there are no clear rules on who would be responsible. Meta’s model takes fees on transactions, and nothing in the launch reporting says what it takes on when a transaction fails.
On McMullen’s test, the deployer is whoever “chooses its permissions, connects it to systems, and gives it access to data”. On our reading, when a consumer switches on a shopping agent and connects it to a card or an account, that description fits the consumer at least as well as it fits the platform. In our view, that is the uncomfortable implication of a deployer-first rule applied outside essential services: it can leave the least equipped party in the chain holding the risk. Wurster’s “giving their password to Muse” is exactly that case.
The Information Commissioner’s Office (ICO) is already asking its own questions of agents. Launching its call for evidence on agentic AI on 8 October, the ICO said it had put questions to Meta, OpenAI, Anthropic and the AI Security Institute about how agents had recently been tested and deployed. Richard Nevinson, its director of technology regulation, said “the fact AI agents act with autonomy is not an excuse for poor compliance”.
Reality Check: The ICO’s call asks about data security, transparency, accountability, automated decisions, fairness and the lawful basis for processing. Who refunds a customer when an agent buys the wrong thing or pays the wrong bill is a separate question that the call does not list.
Open challenges
Definitions that do not exist yet
Until the Secretary of State makes regulations, the law does not say which systems count as AI agents for the clause, or what counts as losing control of one. In our view, firms cannot yet map their exposure against a term left to be defined later.
A consumer agent inside a regulated service
The Bill summary notes that online marketplaces are already NIS digital services and that certain AI services could fall within those definitions. Whether a consumer shopping agent, or the marketplace it shops on, would count for the clause depends on regulations not yet written.
Separate regulators, separate questions
The cyber regime asks operators to preserve evidence and report incidents. The ICO asks whether personal data was handled lawfully. The FCA is developing rules for agents in finance. The government’s agentic AI factsheet mentions neither the ICO nor the FCA, so how those answers will fit together is not yet set out.
What to watch
- 20 November 2026: the ICO call for evidence closes. The responses will feed into ICO guidance and the statutory code covering AI and automated decision-making that it is preparing. If that guidance says who is the controller when a consumer’s agent acts, it will give the consumer case an official answer, at least for personal data.
- The Commons consideration of Lords amendments. The parliamentary record shows no sitting scheduled yet. If MPs accept the clause unchanged, the investigatory model is set and the detail moves to consultation.
- The consultation on the four agentic measures. Watch whether the proposed definition of “AI agent” reaches consumer-facing agents on NIS-regulated marketplaces, or stops at operators’ own systems.
- Muse’s UK launch terms. If Meta’s UK terms say who carries losses from a failed purchase or payment, that will be a commercial answer to the question. Whether any of the five banks opens a route for it to act on accounts will show how far it can go.
- The FCA’s rules on agents in finance. Whether they say who bears a loss when an agent acts on a customer’s account will show whether the banks’ stated concern has been met.
The three moves look like a policy taking shape, but they answer three different questions: what happened, whether to let agents in at all, and how to make money from them. The question a UK customer will ask first, who puts it right when the agent gets it wrong, has no answer yet from any of them.
Sources: UK ministers seek powers to investigate when AI agents are let off the leash by Lindsay Clark (The Register, 6 November 2026); Banks ban AI from accounts over fears of rogue agents by Tom Saunders (The Telegraph, 8 November 2026); Meta to launch AI shopping assistant Muse in UK within weeks (Retail Gazette, 9 November 2026); the Bill’s parliamentary record, government factsheets and ICO publications. Legal readings are our own and are not legal advice.
This strategic analysis was written by Resultsense, a UK-focused AI news and analysis publication. We will be watching whether the definition of an AI agent, when it comes, reaches the agents consumers actually use. Read more analysis at Insights, or get in touch.