The short version: The DRCF opened a call for input on 3 June 2026, asking regulators, businesses, academics, and the public for evidence on how consumers understand and respond to AI risk. The first phase — covering consumer attitudes — closes tomorrow, 3 July. A second phase, on tools and frameworks for managing those risks, closes on 2 September. The DRCF will use the responses to shape regulatory guidance across all four UK regulators simultaneously.

What the DRCF is asking

Phase one asks sixteen questions grouped around a single central concern: how much risk will consumers tolerate from generative and agentic AI in exchange for convenience and lower cost? The regulators want to understand:

  • What risks consumers believe they face when using AI tools — accuracy, privacy, manipulation, and harm from automated decisions
  • How much they understand about how AI tools work — specifically whether disclosures and consent language actually convey meaningful information
  • Who they hold accountable when AI causes harm — the AI company, the business that deployed it, or neither
  • Whether their tolerance for AI risk differs by context — they may accept AI making low-stakes content recommendations but not medical or financial decisions

Phase two, open until 2 September, asks for evidence on the tools and frameworks available to manage those risks — what works for regulators, industry, and consumers themselves.

Who is the DRCF?

The Digital Regulation Cooperation Forum brings together four UK regulators: the Information Commissioner's Office (ICO), the Competition and Markets Authority (CMA), Ofcom, and the Financial Conduct Authority (FCA). It was created specifically to coordinate digital regulation across sector boundaries. When the DRCF publishes guidance, all four regulators can enforce it within their respective sectors. That is unusual breadth for a single piece of regulatory work.

Why this matters for UK businesses using AI

The DRCF's findings will directly inform the regulatory guidance that shapes what UK businesses must do when they deploy AI tools that interact with their customers. This includes chatbots, AI receptionists, automated quote generation, AI-assisted decisions about credit or service eligibility, and customer-facing data processing. If your business uses any of these, the DRCF's work will affect you.

The specific questions about accountability are particularly important for service businesses. If a customer receives incorrect information from your AI chatbot and acts on it, who is liable? The current regulatory picture is unclear. The DRCF is trying to clarify it — but the direction of travel is likely to increase accountability for businesses that deploy AI customer-facing tools.

ICO automated decision-making guidance

Separately, the ICO published draft guidance on automated decision-making and profiling in May 2026, with the consultation closing on 29 May. Final guidance is expected over summer 2026. If your business uses any form of automated scoring, filtering, or decision-making on customer data — even via a third-party AI tool — this guidance will be relevant. It operates under UK GDPR Article 22, which gives individuals rights around solely automated decisions with significant effects.

What UK service businesses should do now

The consultation closes tomorrow, so there is limited time to respond formally. However, the more important near-term action is to start building an AI register — a simple list of every AI or AI-assisted tool your business uses that touches customer interactions or customer data. This has been recommended by multiple legal advisers and is increasingly expected in regulatory enquiries.

An AI register does not need to be complex. It needs to record: what the tool does, what data it processes, what decisions it influences, who is accountable for reviewing its outputs, and what your process is if the tool causes a customer harm. Businesses that have this in place will handle the incoming regulatory guidance far more easily than those starting from scratch.

Operator actions

Today: Note the 3 July DRCF deadline. If you have a view to contribute (particularly on how your customers respond to AI tools), submit via drcf.org.uk before midnight.
This month: Build a basic AI register for your business. List every AI tool you use that touches customers — chatbot, AI email, automated scheduling, AI webchat. Takes two hours; will save significant compliance effort later.
By September: Read the ICO's final automated decision-making guidance when published. If you use any form of automated customer scoring or filtering (even via a CRM AI feature), you may need a DPIA or documented lawful basis.