Four UK Regulators Are Now Using Generative AI in Enforcement — What Businesses Need to Know

Generative AI is no longer in the pilot phase for UK regulators. A new report from the Digital Regulation Cooperation Forum reveals how four major UK authorities — the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO), and Ofcom — are using large language models in active regulatory work.

The findings offer the clearest public account yet of how public oversight bodies are deploying AI in day-to-day operations, and they carry direct implications for any business operating in UK digital markets.

Where AI Is Being Used in Enforcement

Each regulator has moved from testing toward regular use, with tangible outputs:

• CMA: Developed agentic AI that can navigate online services and record the consumer journey at scale, mimicking how users encounter prices, prompts, and design patterns. This has already led to investigations into eight businesses and advisory letters to 100 others.
• FCA: Piloted large language models for "sludge audits" — simulating consumer personas to check whether websites make it unreasonably difficult for customers to cancel subscriptions or navigate terms and conditions.
• Ofcom: Running behavioral audits under the Online Safety Act, examining sign-up processes, sentiment-influencing features, and reporting mechanisms.
• ICO: Monitoring compliance on non-essential cookie use at scale, in collaboration with the CMA.

How Regulators Are Managing AI Risk

The forum identified governance as the central challenge. Regulators are using retrieval-augmented generation (RAG) to ground AI outputs in approved documents, structured prompt engineering to improve consistency, and minimum viable evaluation frameworks to test tools before deployment. Human review remains mandatory across all use cases.

For businesses, the message is clear: regulators now have AI-assisted tools capable of monitoring compliance at a scale and speed that was previously impractical.

Read the full article on IT Brief UK