Are UK brands ready for customer AI agents?

How the audit was done

100 UK-facing brands across 17 sectors, weighted toward those with the highest consumer contact volume, each assessed three ways: a policy audit (what the brand has published about AI in customer service), a surface audit (what its AI-facing infrastructure actually exposes) and a field test (what happens when an AI agent acting for a real, consenting customer attempts a real task such as a return, complaint, tariff query or benefits enquiry).

• Sectors: retail, finance and banking, insurance, telecoms, utilities, public sector, health and pharma, travel and hospitality, housing, charities, automotive, legal services, higher education, media and entertainment, logistics, government agencies, and SaaS and tech.

Four findings that held across every sector

• None declared scope: no brand had a public statement defining what an AI agent may or may not do on its service.
• None declared authority: no brand exposed the authority its own AI can commit to, or the authority it will accept from an incoming agent.
• 73% had no fallback path: where one existed, it was typically an unadvertised human queue rather than a designed pathway.
• 17 verification flows passed: an AI agent with the customer's details passed them undetected, including multi-step KYC.

What it means

The gap is not a technology gap. The technology to declare, verify and escalate is off the shelf. It is a design and governance gap: brands are shipping AI on their side of the conversation without a shared expectation of what the other side will do. The report's recommendation is to publish declarations before you ship the agent.

Common questions