Direct answer: before a UK tour operator, OTA, airline retail desk, hotel group or travel ops team lets an **AI agent** handle customer queries, process refunds, recommend packages or run marketing, the product must already treat the agent like a staff member under **UK consumer law**. The Competition and Markets Authority (CMA) published Complying with consumer law when using AI agents on **9 March 2026**. The core rule is blunt: you are responsible for what the AI agent does in the same way you are responsible for what an employee does — including when a third party designed or hosts the agent.
That is the operator question Kaize is answering here. We are a UK AI product studio for travel and hospitality. This is not a prompt-engineering tip sheet. It is a **control-stack** article: what must already be true in rights data, disclosure, training/testing, human monitoring and rapid remediation **before** an agent is allowed to act toward customers. It sits beside — and does not replace — our ATOL AST-14 disclosure, DMCC drip-pricing quote, PECR soft-opt-in and UK261 notification pieces.
Primary evidence is first-party CMA/GOV.UK guidance (9 March 2026). Secondary context is the Digital Markets, Competition and Consumers Act 2024 (DMCC) enforcement regime the CMA cites, plus CAA concurrent consumer-enforcement powers for aviation. We do not invent client results, fine outcomes, GSC lifts or GEO ranks.
What the CMA actually said (and what it did not)
The CMA guidance is about **agentic AI that engages customers**: handling queries, processing refunds, recommending products, managing marketing campaigns. Same consumer-law duties apply whether a human or an AI agent produces the information. Enforcement risk includes action by authorities (including the CMA), fines of **up to 10% of worldwide turnover**, and possible compensation for affected consumers — as stated on the GOV.UK page.
It is **not** a new travel-only statute, not ATOL Scheme of Arrangement wording, and not a licence to claim "CMA certified AI". Treat it as operational design criteria for products that talk to, decide for, or market to consumers.
Why travel operators should care more than most
Travel products mix statutory rights, package and flight rules, refund and cancellation paths, price transparency and marketing claims in the same customer journey. An AI agent that "helpfully" summarises options can still misstate cancellation windows, omit unavoidable charges, overstate what the agent can do, or refuse a refund the contract or statute already allows. In aviation, the CAA also enforces consumer law (including under the DMCC regime from April 2025) with concurrent CMA powers — so flight-inclusive retail is not a soft edge case.
Kaize POV: if your booking, CRM and rights systems cannot answer a human agent correctly, giving an AI agent the same tools without gates simply scales the error.
Gate 1 — Trader responsibility is already assigned
Before go-live, product and legal must agree that the **travel trader** (not the model vendor) owns consumer-law outcomes. The CMA is explicit that third-party design or provision does not shift responsibility. Procurement checklists should include this guidance as a discussion pack with vendors.
- Named owner for agent behaviour (ops + compliance), not "the LLM provider".
- Contractual right to inspect prompts, tools, evaluation logs and remediation SLAs.
- Clear map of which journeys the agent may enter: query-only vs refund-decide vs marketing-publish.
Gate 2 — Disclosure when AI vs human would change the decision
The CMA says: tell customers if you use an AI agent when that fact might affect their decisions; do not mislead them into thinking a person is providing the service; do not overstate what the AI can or cannot do. For travel, that usually means labelling chat, voice and refund assistants when customers would otherwise assume a human ATOL/ops specialist is deciding.
- UI/voice label when the channel is agent-driven.
- Capability limits in plain language (e.g. cannot waive UK261, cannot invent ATOL cover).
- Escalation path to a human that is actually reachable — not a dead-end loop.
Gate 3 — Train and test against consumer-law outcomes
The CMA expects agents to be set up so they respect statutory and contractual rights, avoid misleading by what they say **and** omit, and obtain necessary consents. Testing (including A/B or unit-style evaluation) should happen **before** deployment, with results used to improve behaviour.
For UK travel stacks, that means grounding the agent in machine-readable rights — not free-text "be fair" prompts alone:
- **Refund / cancellation paths** — Consumer Rights Act 2015 and Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 where they apply, plus your T&Cs (extended windows, package rules, flight-inclusive exceptions).
- **Price and offer honesty** — DMCC-era total-price and genuine-discount expectations (see also our drip-pricing article).
- **Marketing** — accurate prices including unavoidable charges; paid endorsements labelled; genuine reductions.
- **Deal / package recommendation** — disclose search coverage, ranking logic and supplier links when recommending "best" options (CMA comparison-service example).
Gate 4 — Human in the loop is a control, not a slogan
The CMA warns that models can misinterpret data and hallucinate. It expects **regular human oversight**: someone with appropriate experience actively checking that the agent makes correct decisions and produces expected results, with processes to monitor performance.
Operationalise that as sampling and hard stops:
- Daily/weekly review of refund decisions, complaint threads and marketing drafts the agent produced.
- Hard stop when confidence, rights-id or journey-type is unknown — prepare draft, do not send.
- Separate reviewers for high-volume or vulnerable-customer journeys (the CMA flags both).
Gate 5 — Rapid refine when behaviour drifts
If the agent is non-compliant or potentially non-compliant, act quickly — refine prompts or workflows — especially when it reaches many people or vulnerable customers. Delay itself can become the breach pathway the CMA describes.
Travel-shaped examples mapped to the CMA’s own scenarios
Refunds after a package or flight change
Map CRA 2015 / CCRs 2013 / package terms into the refund decision service the agent calls. Reviewers check time limits and amounts. If the agent ignores an extended returns or package refund rule, refine immediately — the CMA’s refund example is almost word-for-word this failure mode.
Customer-service answers about price, rights and options
Agents must answer accurately and must not make rights hard to exercise. Wrong UK261 framing, wrong cooling-off answers, or "you must accept a voucher" patterns are product bugs, not tone issues.
Marketing campaigns
Total price with unavoidable charges, labelled paid endorsements, genuine discounts. Same stack we already treat for green claims and drip pricing — the agent is another publisher on that stack.
Recommendation / comparison journeys
If an agent asks preferences then recommends "cheapest matching" holidays, disclose market coverage, data searched, ranking and supplier relationships. Mismatched criteria = refine-and-retest, not more temperature.
What this article is not
- Not legal advice for a specific ATOL, package or refund case.
- Not a claim that Kaize or any vendor transfers trader responsibility.
- Not overlapping rewrite of ATOL AST-14 (pre-choice ATOL disclosure), PECR soft opt-in, DMCC drip pricing, UK261 notification gates, or general "how to control AI agents" access design.
Operator checklist before production
FAQ
Does labelling the chat "AI" alone satisfy the CMA?
No. Labelling addresses misleading-identity risk. You still need training, monitoring and fast remediation for rights, prices and marketing behaviour.
If we buy an off-the-shelf travel chatbot, are we safe?
No. The CMA says responsibility stays with you even when someone else designed or provides the agent. Use the guidance in procurement.
Is this the same as ATOL AST-14 assistant disclosure?
Related but narrower/different. AST-14 is about ATOL-protected choice disclosure. This article is CMA consumer-law responsibility for agentic behaviour across queries, refunds, recommendations and marketing.
Can we invent "CMA-compliant" as a marketing claim?
Do not. Cite the guidance, show your controls, and avoid unsupported certification language.
Kaize takeaway
For UK travel companies, CMA March 2026 AI-agent guidance is another **confirmation stack**: disclosure, rights services, tests, human review and rapid pause/refine must exist **before** the agent is trusted with customers. Models draft; controlled systems decide what is allowed to reach the passenger or guest.
Related Kaize reading: How Travel Companies Should Control AI Agents That Access Booking and Customer Systems, What AI Booking Assistants Must Show Before a UK Consumer Chooses an ATOL-Protected Package, What AI Travel Quotes Must Show as the Total Price Under UK DMCC Drip-Pricing Rules, and What Must Be True Before AI Notifies Passengers of UK261 Disruption Rights.