Ofcom has not written new rules for AI chatbots in telecoms. Its position, set out in a discussion paper on 25 September 2026, is that the existing General Conditions already apply to AI, with two expectations made explicit: customers should be able to tell clearly when they are talking to AI, and AI must never become a gatekeeper between the customer and the support channels a provider is required to offer.
The existing rules were written for human teams, though, and a chatbot can break them in ways a human team rarely would.
What has Ofcom actually published on AI?
Two documents, both on Ofcom's site.
On 27 January 2026 Ofcom published a call for input on what AI could mean for the experience of telecoms customers, asking how AI is being used in the telecoms customer journey, what the opportunities and risks are, and whether its rules support responsible innovation. Responses closed on 10 March 2026.
On 25 September 2026 it published the result: a discussion paper titled "AI in telecoms markets: the impact on consumers' experiences so far and how it may develop", with supporting research. Its headline conclusion is that there is limited evidence AI has been a systemic cause of harm to telecoms customers, and that the existing rules and framework let Ofcom protect consumers effectively.
So there is no AI code to comply with. What there is, is a regulator that has written down how it reads its existing rules when a chatbot is involved, which tells you what an investigation would look at.
What does Ofcom expect from a telecoms chatbot?
Say it is AI. Ofcom says it should be very clear to telecoms customers when they are interacting with a generative AI application, and that a chatbot should make this transparent from how it describes itself. A human first name and a stock photo is hard to square with that. So is a disclosure buried in the terms.
Never be the gatekeeper. Ofcom says it would be concerned if a provider's AI applications acted as gatekeepers that create barriers to accessing support over the channels providers are required to make available. This is the line every design decision should be tested against.
You own it, whoever built it. If a third party designs an AI application that a provider then deploys, Ofcom says responsibility for how it complies with the rules rests with the provider. Buying the agent in does not move the risk.
Consent still means consent. The paper points out that providers must get a customer's express consent before a contract is made or changed, citing General Condition C1. Any agent that can upgrade, re-contract or add a bolt-on has to get that consent properly, not infer it from a "yeah go on" halfway through a troubleshooting chat.
Which General Conditions apply to AI customer service?
The paper names three areas directly.
Complaints, under General Condition C4. The complaints code requires providers to accept complaints by at least three means: a phone number that is free or charged at a geographic rate, a UK postal address, and either an email address or a web form dedicated to complaints. The code also says complaints procedures must be accessible enough for disabled customers and customers in vulnerable circumstances to make and progress a complaint, and that staff who talk to customers must be trained to identify a complaint. Since 8 April 2026, a customer whose complaint is still unresolved after six weeks (it was eight) can take it to an ADR scheme. There is more on how this plays out in a build in can conversational AI handle complaints.
Vulnerable customers, under General Condition C5. Providers must have, publish and follow policies for the fair treatment of customers whose circumstances may make them vulnerable. Ofcom says plainly that where chatbots handle interactions with vulnerable customers, they must comply with those same policies. Its guide on treating vulnerable customers fairly expects a range of channels, and the paper adds that AI should be only one of them, alongside phone, email, post and video and text relay.
Disabled customers, under C5.6. Providers must take the measures needed to meet the needs of disabled end-users. Ofcom says AI applications must meet those needs just as websites and phone lines do.
Where do chatbots go wrong against these rules?
In our builds, almost never in the places people expect. The model being rude, or making something up about broadband speeds, is a quality problem you catch in testing. The regulatory faults are structural, and they hide in the routing.
The complaint that was never logged. Customers rarely say "I want to make a complaint". They say "this is the third time I've been told an engineer is coming". A trained human hears a complaint. An agent built for deflection hears a status query, answers it politely and closes the conversation. Nothing was logged, and the six weeks to ADR is running on a complaint your records say does not exist.
The loop that never ends. "Speak to a person" gets answered with "I can help with that! What is your query about?" Twice. That is the gatekeeper Ofcom describes, and it is usually not deliberate. It is a fallback route nobody tested.
Vulnerability treated as small talk. A customer mentions their partner has just died and the account is in their name. An agent tuned to stay on task moves straight on to the transfer of ownership form. Ofcom's own research found people particularly value human contact for sensitive issues like bereavement and debt.
The upgrade nobody agreed to. An agent with write access to billing, a vague "sure" from the customer, and a contract changed without a contract summary. This is the newest risk and the one with the clearest rule behind it.
How do you design an agent that keeps you clear?
These are the rules we build to, whether or not a client asks.
- Disclose in the first message. Name it as an AI assistant in plain words, and do not give it a human persona. Customers mostly do not mind, and the ones who do will ask for a person, which brings us to the next rule. We cover the evidence in can customers tell they are talking to AI.
- A person is always one ask away. "Agent", "human", "person", "someone real", a frustrated second repeat of the same question: every one of them routes straight to a handover. Out of hours, the agent says when the team is back and how to reach the other channels, and it never pretends no other route exists.
- Hand over with the context. A handover that makes the customer repeat themselves is a barrier too. The person picking it up should see the conversation, the account and why it was handed over. What should happen when the agent is out of its depth is in what happens when an AI agent does not know the answer.
- Detect complaints by meaning, and log them. If a message reads as dissatisfaction with the service, the agent raises a complaint record, tells the customer what happens next and how long it should take, and hands over. Then test it with the messy phrasing real customers use, not the word "complaint".
- Treat vulnerability signals as a route, not a sentiment. Bereavement, serious illness, money trouble, a carer acting for someone: these follow your C5 policy, which usually means a person, a flag on the account, and no selling.
- No contract changes without the full consent step. The agent can explain options and start the process. Anything that changes the contract goes through the same contract summary and express consent as every other channel, or goes to a person.
- Keep the transcripts. If Ofcom or an ADR scheme asks what the customer was told, you want the conversation, not a summary of it.
None of this makes an agent less useful. In our experience, customers who know they can get out are happier to stay in.
Is more regulation coming?
Possibly, but not yet. Ofcom says it would need evidence of AI's impact before deciding on new rules or guidance, and it names the challenges it expects next: transparency about how firms use AI, accountability and redress, consent to decisions made by AI agents, discriminatory outcomes, and the effect on vulnerable customers. In their responses, Which? and Citizens Advice recommended new measures requiring telecoms companies to be more open about where they use AI.
Usage is still low. Ofcom's research found 8% of adult UK internet users had used an AI service in relation to their telecoms services, and 6% to resolve a telecoms issue. It will not stay that low, and the rules will be written for the market as it is then. An agent built now should already pass them. Our wider take on regulated sectors is in can conversational AI work in a regulated industry.
If you are weighing up an agent and want to see how these rules look in a working one, you can try our agent, or talk to us about how we would design yours around your complaints and vulnerability policies.
Sources: Ofcom, "AI in telecoms markets: the impact on consumers' experiences so far and how it may develop", 25 September 2026; Ofcom call for input on AI in telecoms, 27 January 2026; Ofcom approved complaints code of practice (annex to General Condition C4); Ofcom statement on the review of ADR in the telecoms sector, 8 July 2025.
