techUK responds to the DRCF’s report on Consumer Interest and AI
techUK welcomes the publication of the Digital Regulation Cooperation Forum’s (DRCF) report on Consumer Interest and AI, published on 12 November 2026. The report analyses the 30 responses to Phase 1 of the DRCF’s Call for Input, launched on 3 June 2026, alongside a targeted review of the evidence on how consumers see the benefits and risks of generative and agentic AI.
techUK responded to both phases of the Call for Input, drawing on the experience of members who design, deploy and govern AI systems that consumers use every day. Our central message was that the UK’s existing laws give AI deployment a strong foundation. The priority is operational clarity and proportionate safeguards, not new AI-specific regimes. We are pleased that the report reflects many of our points. We also welcome its recognition that AI provides real consumer benefits, from 24/7 multilingual support to cheaper products and easier comparisons.
Where our input has landed
In Phase 1 we stated that consumers, even relatively tech-literate ones, should not be expected to fully understand and manage the risks of complex AI systems. The report finds broad agreement on exactly this point. It also confirms that even the most tech-literate users can be vulnerable in certain circumstances. It adds that offering user controls should not imply that consumers are responsible for reducing risk.
We told the DRCF that oversight should be meaningful rather than constant, and that a tick-box safeguard is unlikely to build confidence. Real oversight needs the authority to intervene, clear escalation routes and enough information to exercise judgement. The report agrees that oversight must be genuine and able to change the outcome for the consumer. It also accepts that approving every step may be impractical for agentic systems. Its list of essential controls closely matches the evidence our members gave in Phase 2: approval before action, confirmation before purchase, spending limits and clear “off” switches.
On transparency, we cautioned against assuming that more disclosure automatically leads to better outcomes. We said lengthy terms and conditions rarely communicate complex information well, and that layered, contextual approaches work better. The report favours layered, just-in-time and contextual disclosure, with more detail for higher-risk uses. It also agrees that transparency should not replace safe design, governance and redress, which echoes our point that disclosure alone is not enough for agentic AI.
We recognised that some groups, such as children and people using AI in high-stakes settings, may need particular consideration. But we suggested that vulnerability is best understood in context rather than through fixed lists. The report moves away from fixed categories towards a dynamic, situational approach. Its framework of factors shaping risk tolerance gives real weight to reversibility and severity of harm, both central to how our members judge tolerable risk.
On accountability, we said obligations differ depending on where an organisation sits in the value chain, and that existing frameworks should be adapted and clarified rather than replaced. The report records a general consensus that responsibility should be shared proportionately across the value chain. It notes that some respondents argued the consumer-facing firm should not automatically carry ultimate responsibility. We also stressed that observability and transaction logging must work in practice and be demonstrable to consumers, not just exist on paper. Audit trails and decision logs are now a headline finding, and the report suggests a persistent, consumer-accessible record of AI actions and permissions.
The report also reflects our view that AI quality should be judged by whether systems improve real outcomes for consumers, not by documentation alone. It says continued use of AI should not be read as informed trust. It names complaint rates, resolution times and reversal or override rates as useful measures, which are the outcome measures our members already use. It also sees value in telling consumers how existing regulation applies. This supports our Phase 2 argument that low awareness of existing safeguards is a communications gap rather than a gap in the law.
On AI literacy, the report treats literacy as necessary but not sufficient. It sees literacy as a complement to safe design and regulation, targeted at the groups where the gaps are largest. We agree. We also continue to make the case for joining up the many initiatives already underway rather than creating new ones; this was not reflected on in the report.
What we told the DRCF in Phase 2
Our Phase 2 response focused on tools for regulators, policymakers, industry and consumers, and reinforced several of the key points channeled in our Phase 1 response. We told the DRCF:
The UK’s existing laws already provide a strong foundation for AI, including agentic systems. The priority is clarity and coherence across the four DRCF regulators, not new AI-specific regimes.
Consumer harms usually surface after launch, so regulators should devote more weight to monitoring and fixing problems quickly than to pre-launch paperwork.
In-product controls such as spending caps and confirm-before-action work better than disclosures. Human review and clear redress routes do more to build consumer confidence than consent.
Responsibility should sit with whoever controls a risk and can reduce it, and consumers’ share should fall as AI autonomy rises.
Tolerable risk should be judged against the process AI replaces, since no process that is run at scale is error-free.
Smaller firms need worked examples, reusable tools and a single clear entry point, such as a permanent DRCF AI and Digital Hub.
Looking ahead
The report notes that turning shared accountability into legal obligations raises difficult questions, which the DRCF is now considering in the next phase of its work. It also records disagreement among respondents on strict liability and on whether existing regulation is enough for agentic AI. These are the areas where industry evidence will matter most. techUK will continue to make the point that existing frameworks should be adapted and clarified rather than replaced, and to press for coherence across the four DRCF regulators.
We would welcome further clarity on how the DRCF will work with the Cabinet Office’s AI Taskforce.
