Customer service agent

• Customers get an answer to 'where is my order?' in seconds, on chat, email or phone, taken from the OMS, the WMS and the carrier, not from a script.
• Delivery problems are handled properly: a parcel lost before delivery is the retailer's responsibility, so the agent arranges a replacement or refund within limits instead of sending the customer to the courier.
• Returns are booked, labels issued and refunds released when the returned item is scanned in, within value and frequency limits enforced by the refund service.
• Card details never reach the agent. Refunds go back to the original payment through the payment service provider, and phone payments are masked.
• Anything outside the rules, any complaint, and any sign that a customer may be vulnerable goes to a person with a summary, so the customer never repeats themselves.
• The agent never refuses anyone. Declining a refund, a return or a claim is always a person's decision, and every step is logged.

• CMADigital Markets, Competition and Consumers Act 2024: unfair commercial practices and direct enforcement
  →

  Since 6 April 2025 the CMA can decide breaches itself and fine up to 10% of global turnover. The agent must not mislead by what it says or leaves out, about prices, delivery or rights. Its answers come only from approved, versioned policies, and legal signs off the consumer-law test set.

• CMAComplying with consumer law when using AI agents (9 March 2026)
  →

  The retailer is responsible for its agent as for an employee, including where a supplier built it. Tell customers they are talking to an AI, test before go-live, monitor regularly, keep a human in the loop, and make sure refund decisions reflect the right time limits and any extended returns policy.

• Consumer lawConsumer Rights Act 2015
  →

  Goods must be of satisfactory quality, fit for purpose and as described. A customer can reject faulty goods within 30 days for a full refund, and refunds are due within 14 days of agreeing them. Goods stay at the retailer's risk until delivered, so a lost parcel is never the customer's problem to chase.

• Consumer lawConsumer Contracts Regulations 2013
  →

  Online, phone and marketplace orders carry a 14-day cancellation period from delivery. The refund, including standard delivery, is due within 14 days of getting the goods back or proof of return. Exceptions, such as personalised or unsealed hygiene items, are a person's call, never the agent's.

• PCI SSCPCI DSS v4.0.1
  →

  The agent never sees, hears or stores a card number. Refunds use the payment service provider's token for the original transaction. Phone payments use keypad (DTMF) masking, and transcripts and logs are scanned and redacted. This keeps the AI out of PCI scope rather than adding to it.

• ICOUK GDPR, the Data (Use and Access) Act 2025 and PECR
  →

  Chats, emails and call recordings are personal data, so a DPIA, a clear retention period and a contract that stops providers training on your data. A refused refund is a significant decision, so a person makes it. The agent sends service messages only, never marketing, and PECR fines now match UK GDPR levels.

• EHRCEquality Act 2010
  →

  Reasonable adjustments apply to service channels. Chat meets WCAG 2.2 AA, the voice agent can be interrupted and slowed down, and every channel offers a person, including a phone number, without the customer having to argue for one.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A named owner for the returns policy, delivery content and statutory rights wording, with legal sign-off on every change.
• Refund limits set by finance, reviewed monthly against fraud and error, and changed only through the refund service.
• An exception queue for handovers, staffed for peak, with a target time to a person.
• Advisers trained before go-live on what the agent can and can't do, and on how to feed back wrong answers.
• A weekly review of a sample of conversations, including every complaint about the agent and every vulnerable-customer handover.
• A change freeze from early November to January. New features go live before peak or after it, never during.

1. 3 weeks

   Discovery

   Measure contact reasons and handling times, map the OMS, WMS, EPOS and payment APIs, and agree refund limits and the consumer-law test set.

2. Gate · must be true to passBaseline agreed, API access confirmed, DPIA and PCI scoping done, legal involved.

3. 8–10 weeks

   Pilot

   Order status on web chat first, in shadow mode and then live for a share of customers. Returns and refunds follow once the test set passes.

4. Gate · must be true to passRights test set passing, refund audit clean, time to a person within target, legal and customer service sign-off.

5. 4–6 weeks

   Production

   All chat traffic, then email, with monitoring, peak load testing and a rollback switch per channel. Live by the end of September.

6. Gate · must be true to passPeak load tested, rollback rehearsed, advisers trained, monitoring in place.

7. Ongoing

   Scale

   Phone, then marketplace messages, then other contact reasons one at a time.

8. Gate · must be true to passEach new channel and contact reason passes the same pilot gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The agent tells a customer to chase the courier, or says they're out of time when they aren't.

   How the design avoids it

   Answers come only from approved policy content, and a consumer-law test set signed off by legal runs before every release.

2. 2

   Goes wrong

   Customers can't reach a person, and complaints move from the queue to social media.

   How the design avoids it

   A person is offered up front and on request, time to a person is measured, and the agent hands over after two failed attempts.

3. 3

   Goes wrong

   Refund limits are written in the prompt, so a determined customer talks the agent past them.

   How the design avoids it

   Limits are enforced by the refund service, and the agent can only ask it to pay.

4. 4

   Goes wrong

   Card numbers turn up in chat transcripts and call recordings.

   How the design avoids it

   DTMF masking on the phone, redaction on every channel, and the AI kept out of PCI scope.

5. 5

   Goes wrong

   It goes live in November and meets peak on day one.

   How the design avoids it

   Live by the end of September, load tested at peak volumes, with a change freeze through to January.

1. 1 January 2027
   The DMCC Act subscription contracts regime starts

   It covers subscriptions taken out from that date, with new rules on pre-contract information, reminders and cancellation. If you sell a delivery pass or a subscribe-and-save option, the agent must handle cancellation simply and without obstruction. Draft regulations and guidance were published in October 2026.

2. 2026–2027
   The ICO's code of practice on AI and automated decision-making

   Regulations in force since May 2026 require the ICO to produce a statutory code. Keep refund decisions, explanations and human review records in a form you could show the ICO.

3. 2026 onwards
   Regulators' joint work on agentic AI

   The CMA, FCA, ICO and Ofcom published a joint statement on agentic AI through the DRCF in October 2026. Customers' own AI agents will start contacting your service. Decide now how they are verified, and apply the same limits as to a person.

4. Late 2026–2028
   The Cyber Security and Resilience Bill

   Medium and large managed service providers come into regulation, with faster incident reporting. Expect your contact-centre, cloud and AI suppliers to face new duties, and your contracts and supplier assurance to need updating.