Who is accountable when an AI voice agent harms a customer?

Share this article:

Why the regulated firm stays accountable when it uses an AI voice agent, what its senior managers and the vendor each answer for, and what the vendor contract should cover.

The short answer

The regulated firm is accountable for meeting its regulatory obligations, including when the AI voice agent comes from a vendor. CONC 1.2.2R makes the firm answerable for those acting on its behalf, the Consumer Duty applies to outcomes delivered through AI, and the FCA describes clear senior management ownership of AI risk as good practice. The vendor answers to the firm under the contract, and directly for its own legal duties, such as those of a data processor.

Why does responsibility stay with the firm?

CONC 1.2.2R. The firm must ensure its employees and agents comply with CONC, and take reasonable steps to ensure that other persons acting on its behalf comply.
The FCA's October 2026 AI publication. Firms remain responsible for consumer outcomes, including those delivered through communications and support, and firms can outsource AI services but remain responsible for them. We cover the publication in what the FCA's October 2026 AI publication means for collections.
Outsourcing rules. SYSC 8 sets outsourcing requirements, but how it applies depends on the type of firm (SYSC 1 Annex 1). Either way, outsourcing does not remove the firm's regulatory obligations.

The practical consequence: regulatory obligations cannot be contracted away. The contract decides what the vendor owes the firm, not what the firm owes its customers and the FCA.

What is the senior manager accountable for?

The FCA does not expect senior managers to be technical specialists. Its examples describe senior managers taking reasonable steps to understand AI risks in their area, getting the expertise they need, providing oversight and challenge, and keeping controls and escalation proportionate to the risk.

Good practice the FCA describes:

Clear SMF ownership mapped across AI use cases, with one senior person accountable for overall oversight.
Accountability assigned from the design stage, not after deployment.
Documented, auditable oversight, including decisions, challenge and escalation.
Escalation routes triggered by defined thresholds.
Targeted training for senior managers on AI risks.

Areas for improvement the FCA describes:

Poor documentation, so senior managers cannot show the steps they took.
Delegating AI to technical teams without adequate understanding or challenge, especially for consumer-facing uses.
No clear link between identified risks and SMF accountability.

How this maps depends on the firm's structure and SM&CR regime. In one FCA case study, the senior manager for the business area held overall accountability while a separate model owner oversaw the technology. That is an example, not a rule.

What is the AI vendor accountable for?

The vendor is accountable to the firm under the contract: delivering the service as specified, meeting service levels and security commitments, and carrying the liability the parties agreed. It also has duties of its own. As a data processor, it can face ICO enforcement, and individuals can claim compensation from it where it breaches its processor obligations under UK GDPR or acts outside the firm's lawful instructions (Article 82).

Just as important is what the vendor must give the firm so the firm can evidence control:

complete and accurate call records, with agreed access, retention and export;
advance notice of significant changes to the models and systems the agent relies on;
the ability to test the agent before changes go live;
independent assurance, such as certifications and audit reports, with scope and dates;
prompt notification of incidents;
data return and transition support on exit.

A vendor's certificate or audit report is evidence the firm can use. It is not compliance on the firm's behalf.

Where does a customer complain?

To the firm responsible for the collection, which may be the lender or a debt collector acting for it. The firm handles the complaint under the FCA's complaint handling rules (DISP). If it is not resolved, an eligible complainant can refer it to the Financial Ombudsman Service within the time limits. The software supplier is not normally the respondent, but the firm will need the supplier's call records to investigate. Data protection complaints to the ICO, and court claims, are separate routes.

How should accountability be split between the firm and the vendor?

A suggested split, not a mandatory allocation. Each firm should map it to its own structure and SM&CR regime.

Deciding what the agent does and when it hands over. The firm owns it, the senior manager sets the risk appetite, and the vendor advises and implements.
Approving the wording customers hear. The firm owns it, the senior manager signs off, and the vendor builds to the approved text.
Testing outcomes, including for vulnerable customers. The firm owns it, the senior manager reviews the results, and the vendor provides test access and data.
Monitoring live calls and outcomes. The firm owns it, the senior manager receives reporting and can intervene, and the vendor provides records and reporting.
Applying holds when collection must pause. The firm applies them in its own systems under the senior manager's oversight; the vendor's agent flags the trigger and passes the call.
Changes to models or systems. The vendor gives advance notice, the firm tests before go-live, and the senior manager approves material changes.
Incidents and complaints. The firm handles them and puts things right, the senior manager is accountable, and the vendor investigates and supplies records.
Personal data. The firm is the controller (or a processor, if it collects for another firm), the senior manager oversees, and the vendor is a processor or sub-processor under the data processing agreement.
Operational resilience. The firm includes the agent in its scenarios, the senior manager is accountable, and the vendor meets its continuity commitments.

What should the vendor contract cover?

Records. What is logged, how long it is kept, and export on request.
Change control. Notice of significant model changes and the right to test before release.
Testing and audit. Access for testing, the audit and inspection rights a UK GDPR Article 28 processor contract requires, and supporting certifications.
Incidents. Notification timelines and cooperation duties.
Exit. Return of data and transition support.
Sub-processors and hosting locations.
Liability and insurance.

For the questions to ask before you sign, see how to choose a voice AI platform for a regulated UK enterprise.

How is accountability set up with MEGA.AI?

The client decides. The client designs the journey and approves every response; MEGA.AI builds it, and the agent speaks only that approved wording.
Records. Every call has a recording, transcript, step-by-step phase log and flags, and each customer has a downloadable contact report. See what a full audit trail should contain.
Data protection. Every client contracts under a signed agreement and data processing agreement. MEGA.AI acts as processor, or as sub-processor where the client itself collects on behalf of a creditor.
Independent assurance. ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certifications, a SOC 2 Type II report and Cyber Essentials Plus, with PCI DSS validation in progress. Details are on the MEGA.AI Trust Center.
Regulatory status. MEGA.AI is not authorised by the FCA. The client remains accountable for its own regulatory obligations to its customers.

Frequently asked questions

Is the AI vendor liable if its agent harms a customer?

To the firm, under the contract. Directly, under data protection law, where it breaches its own duties as a processor. For the firm's conduct obligations under FCA rules, the firm is answerable to the customer and the FCA.

Can a firm transfer regulatory responsibility to the vendor by contract?

No. The FCA says firms can outsource AI services but remain responsible for them.

Does a human in the loop make the firm safe?

Not on its own. The FCA warns that over-reliance on human review can hide model weaknesses and become box-ticking. Oversight works when reviewers have the authority, information and criteria to intervene.

Which senior manager should own an AI voice agent?

The FCA describes clear SMF ownership as good practice. Which SMF depends on the firm's structure and SM&CR regime. In one FCA example, the senior manager for the business area held overall accountability, with a separate owner for the technology.

Who is responsible if the vendor's model provider changes the model?

The firm still is, for its own obligations. The FCA describes contractual notice of significant model changes and tested contingency plans as good practice, so changes can be tested before they reach customers.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to walk through how responsibilities would be split for one of your own journeys.

Sources

This article is general information on UK regulatory accountability, not legal advice. Last reviewed: November 2026.