AI at volume, on free tools, with customer data.
Retailers use AI in service, marketing and operations at high volume, and more than half of adopters rely on free-to-use tools, with customer data, card data and brand risk riding along.
of retail AI adopters rely on free-to-use tools
ONS via WatchPro, 2026, secondary sourceof retail adopters report operational improvement; 25% report personalisation
ONS via WatchPro, 2026, secondary sourceof AI-adopting UK firms use it in marketing, the most common use
DSIT, 2026Consumer law applies to AI exactly as it applies to people.
On 9 March 2026 the Competition and Markets Authority (CMA) published guidance, 'Complying with consumer law when using AI agents'. Its message is that a business is responsible for what its AI agents say and do to customers, including agents built by a supplier. The guidance is not legally binding but shows how the CMA reads the Digital Markets, Competition and Consumers Act 2024, under which it can fine up to 10% of global turnover. Since April 2025 fake or hidden reviews are banned practices, and the CMA opened five review investigations on 27 March 2026. The ICO's automated-decision rules apply to AI that ranks, prices or refuses a customer.
Summarised from CMA publications as reported by law firms and the ICO. Not legal advice.
Six problems that keep coming back.
Drawn from regulator guidance and surveys of retail adopters.
A service bot that offers a refund, a delivery date or a discount your policy does not allow still binds you in the eyes of the customer and the CMA.
Staff paste order histories, complaints and addresses into free assistants. There is no agreement, no record and no way to delete.
AI-written descriptions and adverts can overclaim or break advertising rules. At catalogue scale, nobody reads every line.
Fake, incentivised or selectively shown reviews are banned practices. AI tools that write or filter reviews put you in scope.
Contact volumes spike at Christmas and in sales. AI can help, but only if it hands difficult and vulnerable customers to a person.
Chat, search and personalisation each run on metered models. Without metering by channel, you cannot tell which ones earn their cost.
A wrong promise at scale becomes a pattern.
One bot error can repeat thousands of times before anyone notices. Each instance is a consumer law question, a refund and a complaint. Add a data breach from a free tool or a finding on reviews, and the brand damage lands in the same week as peak trading, when the team has least time to respond.
The rules belong in the system, not in a policy document.
A bot cannot read your returns policy the way a trained agent can. What works is a rule set that defines what it may offer, a hold for anything outside it, and a record of every conversation. The same approach applies to copy: checks before release, and a named approver for claims.
- Customer service chat and contact centre
- Product content, campaigns and personalisation
- Returns, refunds and complaints handling
- Demand forecasting and stock
- Customer and card data in free tools
- Unreviewed AI copy in market
- Service bots that promise what policy does not allow
GenWA applies rules that define what a service bot may offer and holds anything else for a person. Growth checks product and campaign copy against brand and claims rules before release. Cost Meter shows cost by channel, and managed accounts replace free tools. Comms and Growth are in early access; Contact is available.
Four agents, trained for this sector.
The rules, as controls.
- Consumer Rights Act 2015
- Digital Markets, Competition and Consumers Act 2024
- Advertising Standards Authority CAP Code and PECR (marketing consent)
- Payment card security standard (PCI DSS)
- UK GDPR and the Data (Use and Access) Act 2025
- Online Safety Act (where chatbots are consumer-facing)
Built around retail structures: brands, channels and peak seasons.
Retailers run several channels and franchises, often with seasonal staff. We shape each route to that.
An independent audit by channel and brand, with first findings in 48 hours and a plan ahead of your peak season.
Start the health checkAdvice: policy and trainingA short AI policy, claims rules and training for service, marketing and store teams.
See advisoryProduct: control toolkitRules, log and Evidence Packs, hosted in your AWS or Azure account, or GenWA AWS as agreed.
Find the right productProduct: agents at workAdviser assist, returns communications, growth operations and complaints triage with named owners.
Meet the teamIncubator: one channel functionWe define, build and run one controlled function, such as returns handling, in twelve weeks. You own the intellectual property.
See the incubatorAccelerator: for consumer brand foundersBy application only, ten places a year. Senior AI leadership time, advisory and platform access, paid for by equity, project, retainer or licence.
See the acceleratorWhat Guard and Evidence typically hold for this sector.
Control-mapped, not certified. We prepare the evidence; regulators and accredited bodies decide.
Goods, services and digital content rights, mapped to what bots may offer.
Unfair practices and reviews rules, mapped to copy checks and review controls.
Advertising and electronic marketing rules, mapped to the Growth veto and consent checks.
The card payment data security standard, mapped to redaction of card details.
Data protection, consent and automated-decision safeguards.
AI management and baseline cyber standards. Readiness evidence only.
Three role holders, three different problems.
Runs the bots and the contact centre. GenWA sets what the bot may promise, holds exceptions for a person and records every conversation.
Produces content at scale. GenWA applies brand and claims checks before release, with a named approver, and shows cost per channel.
Answers for consumer law and data protection. GenWA gives a register, rules and evidence pack, and replaces free tools with managed accounts.
From this sector.
Can a customer service bot be stopped from making promises?
Yes. Rules define what the bot may offer and anything outside is held for a person. Every conversation is recorded in the log. People decide refunds and exceptions beyond your rules.
How do we keep AI product copy within consumer law and brand rules?
Growth applies claims and brand rules with a compliance check on each piece before release, and a named person approves consequential content. The CMA published guidance on AI agents and consumer law on 9 March 2026.
Will managed accounts cost more than free tools?
Pricing for managed accounts is not published. The audit gives a comparison from your own usage. Indicative audit fees exclude VAT and are confirmed in writing.
How common is AI use in marketing?
DSIT's 2026 research found 72% of AI-adopting UK firms use it in marketing. ONS data reported by WatchPro in 2026, a secondary source, found 54% of retail adopters rely on free-to-use tools. Claims in copy therefore need checking before release.
Where does customer data go when AI answers customers?
Hosting is your AWS or Azure account, or GenWA AWS as agreed. Personal data is redacted before approved external model calls. Data terms are confirmed in the security review.
Which Contact and Comms features are live?
Contact (Amazon Connect adviser assist, voice and call monitoring) is available. Comms and Growth are in early access. We confirm release status in writing before you buy.
How does a retailer start?
The AI health check shows which free and unmanaged tools staff use. First findings arrive within 48 hours and the audit with a 90-day plan within ten working days. The audit fee is credited in full against year one of a platform plan.
What could your service bot promise today?
First findings within 48 hours of the health check. Audit fee credited in full against year one of a platform plan.