The customer asks on day 45. Your shop promises 60-day returns. The bot says the window closed at 30.
That is a hypothetical, not a reported incident. It assumes a shop has offered an extended returns policy; eligibility still depends on the applicable policy terms and facts. But the underlying failure is one the Competition and Markets Authority expressly warns businesses to look for: an AI refund agent overlooking an extended returns policy.
What changed on 9 March 2026?
The CMA published guidance explaining how existing consumer law applies when businesses use AI agents. It is not a new UK AI Act. The regulator says businesses remain responsible for what their agents do, including when a third party supplies the AI. Using a bot does not remove duties owed to customers.
This matters to teams using agents for customer service, refunds, product recommendations or marketing. The useful question is not whether the bot sounds polite. It is whether its answers reflect the rights and terms that actually apply.
A 30-day rule is not a universal answer
Keep these questions separate:
- Goods that do not conform to the contract: the Consumer Rights Act 2015 provides remedies under section 19. Section 22 governs the short-term right to reject, generally with a 30-day limit subject to its conditions and exceptions. It is not a blanket deadline after which all remedies disappear.
- Changing your mind: the Consumer Contracts Regulations 2013 provide cancellation rights for qualifying distance and off-premises contracts. Regulations 29 and 30 set the right and normal cancellation period; exclusions include those in regulation 28. This is not an unconditional right to return any purchase for any reason at any time.
- What the shop promised: an extended contractual returns policy must be considered on its own terms alongside statutory rights. Our hypothetical 60-day policy is not a statutory entitlement.
The CMA's refund example tells businesses to account for both statutory rights and contractual terms, check exchanges and time limits, and quickly refine prompts or workflows when the AI overlooks an extended policy.
Tell customers what matters; check what the bot does
The guidance says to tell customers they are dealing with AI if that fact might affect their decisions. It does not state a universal requirement to label every AI use regardless of context.
The Digital Markets, Competition and Consumers Act 2024 prohibits unfair commercial practices. Sections 225 and 226 address misleading actions, including the relevant average-consumer and transactional-decision test. This article does not decide that a particular refund response breaches the Act.
Operationally, the CMA recommends testing before deployment, regular human oversight, monitoring outputs and acting quickly on problems. A disclaimer saying the answer came from AI is not a substitute for that work.
Security guidance is a separate layer
The National Cyber Security Centre's agentic-AI guidance recommends safeguards, sandboxing and active oversight. For higher-risk scenarios it recommends human oversight alongside technically enforced controls. These are security recommendations, not consumer legislation and not a guarantee that a deployment is safe.
What the isolated HaltState test actually showed
We evaluated a synthetic refund.deny proposal using the real policy engine from an immutable source archive. The in-memory policy matched authored test fields: region GB, review_required true, proposed_outcome deny and an allowed support role. It returned APPROVAL_REQUIRED.
The test then created an unsigned hash-only Proof Pack and independently recomputed its content digest. This records an isolated policy evaluation, not a customer transaction. The review flag was supplied by the test author: HaltState did not infer a legal entitlement or decide that the customer qualified for a refund.
No customer message was sent, no refund was issued and no human review was completed. The test did not exercise a production enforcement adapter, persistent storage or signing. A verified digest is not signature authenticity or legal compliance certification.
Before the next automated refusal
Check the policy version the bot uses against the current contract and statutory rights. Identify who reviews disputed decisions, how they get context and how mistakes are corrected. Test the specific workflow before allowing it to affect customers.
Start with one question: which rule is your bot actually using?
Official sources
- CMA publication page, 9 March 2026 and guidance, including the extended-returns-policy example.
- Consumer Rights Act 2015: section 19, remedies for goods that do not conform; section 22, short-term right to reject and its time limits.
- Consumer Contracts Regulations 2013: regulation 28, cancellation exceptions; regulation 29, cancellation right; regulation 30, cancellation period.
- Digital Markets, Competition and Consumers Act 2024: section 225, unfair commercial practices and conditions; section 226, misleading actions.
- NCSC: Managing the cyber risk of agentic AI, defensive security guidance.
General information, not legal advice. Obligations and remedies depend on the facts, contract, applicable law and exceptions. Hypothetical scenario and isolated product test are separately labelled. AI-generated narration and illustrative footage; authoritative text and test results are deterministic.