Ofcom published its first assessment of AI’s impact on telecoms customers on 25 September 2026, and buried in a research document is the clearest statement a UK regulator has yet made about what acceptable AI customer service looks like. Two expectations, both short enough to quote in full. Providers must be transparent with customers when they are interacting with a GenAI application. And providers’ AI applications must not act as “gatekeepers” creating barriers to accessing support through channels providers are required to offer.
That is worth more attention than the headline figure it arrived with. Most guidance on AI governance is a page of principles that no one can be measured against. These two are close to binary: either you disclose that a customer is talking to a machine, or you do not; either the automation can block the route to a human, or it cannot. They are auditable in an afternoon. And while Ofcom regulates telecoms, the research itself shows customers are meeting AI chatbots most often in retail, where 11% of UK adult internet users encountered one — nearly double the 6% who met one at a telecoms provider. Expectations articulated in one regulated sector do not stay there. They become the benchmark that procurement questionnaires, client contracts and customers themselves apply everywhere, which makes this a useful specification for any UK business building or buying AI–powered support, regulated or not.
What Ofcom found, and what it decided to do about it
The adoption picture is one of breadth without depth. 53% of online UK adults have used GenAI tools in the past 12 months, which is a majority and a striking number for a technology this young. But that figure measures people choosing to use a tool. When you ask instead about encountering AI deployed by a business, the numbers drop sharply: 23% of UK adult internet users say they interacted with an AI chatbot in the same period. Broken down by sector, that was most commonly retail at 11%, then financial services and utilities at 8% each, and telecoms at 6%.
For telecoms specifically, 8% — the one in twelve of the headline — had interacted with an AI service in relation to their broadband, mobile or phone account. The breakdown of what they were trying to do is the most useful part of the whole dataset: 6% to resolve an issue, 3% for a price or product comparison, and 2% to make a complaint. Those figures can overlap, so they do not sum. Note the shape: the dominant use is problem–solving, and a meaningful slice is complaints — which is precisely the category where automation performs worst and where a gatekeeping failure does the most damage.
Running the other way is the 46% who report no interaction with AI at all over twelve months. Ofcom expects that to fall as adoption continues, and it almost certainly will. But it is the operative number for anyone designing a support journey today, because it describes customers who will encounter your assistant with no prior mental model of what it can do, no learned habits for getting past it, and no basis for calibrating how much to trust it. A design that assumes familiarity is designing for the other half.
On sentiment, the research is more interesting than a simple satisfaction score. Ofcom found views are mixed: some customers welcome the speed, while others read AI as a way of reducing access to human support — and critically, they read it that way “often regardless of whether AI actually resolves the issue faster”. Most people recognise the time AI could save, but “share concerns about risks to their personal data and privacy”. And many feel that negotiating with a human still gets them a better deal.
Ofcom’s regulatory conclusion, for now, is restraint. Policy Director Cristina Luna–Esteban said the regulator is “working with telecoms firms to ensure a future where AI works in consumers’ best interests and firms ensure human support remains available when they need it”. Ofcom says there is currently only “limited evidence” of AI being a systemic cause of harm, and considers existing rules sufficient — while stating it will act if evidence of harm emerges. No new rulebook, then. A stated standard and a watching brief.
It would be easy to read Ofcom’s finding of only limited evidence of systemic harm as permission to proceed as planned. Read the whole sentence. The regulator has published the standard it expects, said the current rules can carry it, and stated plainly that it will act if evidence of harm emerges. That is a structure with a trigger in it, and the trigger is evidence — which accumulates from customer complaints, consumer group research and press coverage rather than from regulatory inspection. A provider whose AI is quietly blocking access to human support is not in a safe position because no rule names it; it is contributing to the evidence base that would justify a rule. And for businesses outside telecoms there is a second–order effect worth noting: once a regulator has articulated a two–sentence test in public, that test gets applied by clients, insurers, procurement teams and journalists to organisations the regulator has no jurisdiction over at all.
How UK AI customer service expectations took shape this month
Ofcom’s assessment did not land in isolation. It arrived days after a consumer charity made the same argument from the opposite direction, and the two together are what make this month a turning point in the UK conversation.
Read together, the two publications are unusually well matched. Citizens Advice supplied the harm evidence — the people who gave up, the sense of being deliberately obstructed. Ofcom supplied the specification — transparency and no gatekeeping. That combination is how UK regulation typically develops: a credible account of consumer detriment, followed by a stated expectation, followed either by industry adjustment or by rules. Businesses currently sit in the window where adjustment is voluntary and cheap.
What the adoption numbers actually say
The chart below uses Ofcom’s published figures, all expressed as a share of UK adult internet users over the past 12 months. One caution before reading it: the top two bars answer a different question from the rest. They measure using GenAI tools on your own initiative, and having no AI interaction at all. The bars beneath measure encountering a chatbot deployed by a business. They are not additive and should not be compared as though they were the same behaviour.
The gap between the first bar and the third is the most commercially useful thing in this dataset. A majority of online adults have chosen to use a GenAI tool, but fewer than a quarter have met one working for a business. That is not a contradiction; it is a statement about who currently controls the interaction. When a customer opens ChatGPT they are using a tool for their own purposes and can abandon it costlessly. When they meet your assistant they are inside a process you designed, pursuing an outcome only you can deliver. The same underlying technology, encountered in those two contexts, produces entirely different expectations — and a business reasoning from the 53% to conclude “customers are comfortable with AI now” is reading the wrong number.
The sector ordering carries a second lesson. Retail at 11% is where most of these encounters happen, and retail is also where the stakes per interaction are typically lowest — a delivery query, a returns question, a stock check. Telecoms at 6% is lower but the interactions are weightier: contract disputes, service faults, billing. Customers are therefore forming their general impression of business AI largely in a low–stakes context and then carrying that impression into high–stakes ones. Whether that helps or hurts depends entirely on which experience came first.
One in twelve — and why a small number is the interesting one
The figure Ofcom led with, and the one worth planning around, is deliberately modest.
A small arc is the honest visual. This is an early–stage behaviour, not a settled one, and that has a direct implication for how much weight to put on current satisfaction data: the population with an opinion about telecoms AI is still a minority, and their experiences were formed on first–generation deployments. Sentiment measured now is measuring the industry’s first attempt.
The internal breakdown is where the design guidance sits. 6% came to resolve an issue and 2% came to make a complaint. Both of those are, in the taxonomy that matters, judgement cases rather than lookups — something has gone wrong, the situation may not match a standard path, and the customer needs someone able to make a decision. Only the 3% doing price or product comparison is a genuinely good fit for automation, and even that is contested, because Ofcom also found that many customers feel negotiating with a human still gets them a better deal.
That last finding deserves isolating, because it explains something that otherwise looks irrational. Ofcom reports that customers who see AI as reducing access to human support often feel that way “regardless of whether AI actually resolves the issue faster”. Speed, in other words, does not buy trust. The reason is that the customer’s objection is not about latency but about whose interests the system serves. A customer who suspects the assistant exists to protect the provider’s margin rather than to solve their problem will not be reassured by it protecting that margin more efficiently. Combine this with the finding that people believe human negotiation gets a better deal, and the picture is coherent: some customers read automation as the company withdrawing its discretion, and discretion is the thing they were hoping to appeal to.
The practical consequence for any business is uncomfortable but clarifying. You cannot resolve this trust deficit by improving the model. A faster, more accurate assistant that still cannot make a concession, waive a charge or exercise judgement will be experienced as a better–built wall. What changes the perception is evidence that the human route remains genuinely open — which is exactly what Ofcom’s second expectation requires, and why the gatekeeping test is the more substantive of the two.
Measuring your own support journey against the two tests
Ofcom’s expectations are specific enough to audit. The rows below turn them into checkable conditions, with badges indicating how often each is a live problem in a UK business.
The fifth row is the transparency question most businesses get wrong without meaning to. Giving an assistant a friendly first name is a reasonable design choice for warmth, and it becomes a transparency problem the moment a customer reasonably concludes they are speaking to a member of staff called Alex. Ofcom’s expectation is that it must be transparent when a customer is interacting with a GenAI application — and a persona that obscures that, even unintentionally, works against it. The fix is not to remove the personality but to state the position once, plainly, at the start.
The seventh row connects to a finding businesses tend to underrate. Ofcom reports that most people recognise the time AI could save but “share concerns about risks to their personal data and privacy”. Those concerns are not satisfied by a privacy policy, because nobody reads one mid–conversation. They are addressed by a sentence at the point of interaction explaining what happens to what the customer types — and, on the business side, by having actually established the answer: whether the assistant is a third–party service, what it retains, and whether content is used for model training. Support conversations are unusually rich in personal data, so under UK GDPR those are questions with real answers rather than rhetorical ones.
What meeting the standard costs
The bands below are indicative planning figures for UK businesses bringing an AI support deployment in line with the standard Ofcom has articulated — not quotes.
| Business profile | Typical scope | Indicative cost | What you get for it |
|---|---|---|---|
| Small business with an existing chat widget | Clear AI disclosure at the start, unconditional handover on request, human contact details restored to the contact page, complaint route taken out of automation | £400 – £1,800 | Both Ofcom tests met, usually within a week, at the lowest cost of anything on this table |
| SME deploying AI support for the first time | Scoping to lookups rather than judgement cases, disclosure and escalation designed in from the start, data handling position established, transcript review process | £2,000 – £8,000 | An assistant that satisfies the standard by design rather than being retrofitted after a complaint |
| Business with regulated or contractual service obligations | Channel obligation mapping, evidence that automation does not gate any required route, documented limits on what the assistant may offer, audit trail of automated interactions | £8,000 – £30,000 | A demonstrable position for a regulator, a client audit or a procurement questionnaire rather than an assertion |
| Supplier to regulated clients | All of the above plus a written AI use statement suitable for client due diligence, sub–processor disclosure, and alignment with clients’ own consumer duties | £6,000 – £25,000 | The answer ready before a client asks — increasingly a question on supplier questionnaires rather than a courtesy |
| Any business, ongoing | A named owner, a monthly sample of conversations that ended without resolution, and a resolution metric reported alongside volume | £0 – £2,500 a year | Early sight of the problem while it is still cheap, instead of discovering it from a complaint or a consumer group’s research |
The first row is the one most readers need and it is close to trivial. Ofcom’s two expectations are, in implementation terms, a disclosure line and a working escalation path. Neither requires a better model, a new platform or a project. What makes them hard is not technical difficulty but that they cut against the commercial logic that justified the deployment — every unconditional escalation route is a contact that reaches a person, and the business case was built on that number going down.
Two ways to read a regulator’s restraint
Reactive posture
Reading “limited evidence of harm” as clearance
- No new rule was made, so nothing needs to change and the roadmap continues unaltered
- AI disclosure left implicit, with a human–sounding persona doing the opposite of disclosing
- Escalation available only when the assistant concludes it cannot help
- Complaints routed through the same automated front door as routine queries
- Effort directed at making the assistant faster, on the assumption that speed resolves the trust problem
- Privacy concerns treated as answered by an existing policy nobody reads mid–conversation
- The business finds out where it stands from a complaint, a client questionnaire or a consumer group’s research
Proactive posture
Where virtual CIO oversight with Cloudswitched takes you
- The two published expectations adopted as an internal standard now, while compliance is voluntary and cheap
- A single plain sentence at the start of every interaction stating that the customer is dealing with AI
- An unconditional route to a person that does not depend on the assistant agreeing to provide it
- Complaints and vulnerability kept out of automation entirely, by design and in writing
- Recognition that trust is about whose interests the system serves, so effort goes to the escalation path rather than the response time
- Data handling explained at the point of interaction, with the underlying position actually established
- A written AI use statement ready for client due diligence before the first questionnaire arrives
The left–hand column is not negligence; it is a reasonable reading of a regulator that has declined to make a rule. The difficulty is that Ofcom’s restraint is explicitly conditional on evidence, and evidence of this kind is generated by the sector’s own conduct rather than gathered by inspection. Every customer who cannot reach a human and complains to a consumer group is a contribution to the case for prescriptive rules. Businesses that adopt the standard now are, among other things, protecting the light–touch regime they currently benefit from.
Ofcom’s expectations are unusually easy to check because neither is a matter of degree. Test one, transparency: open your own support journey as a customer and ask whether, within the first exchange, you are told plainly that you are dealing with AI rather than a person. Not implied by tone, not disclosed in a footer, not recoverable from a terms page — stated. If your assistant has a human first name and no disclosure line, you have failed this test in a way your customers will notice before you do. Test two, gatekeeping: ask for a human. If you get one immediately, you pass. If you get another attempt to help, a request to describe the problem first, or a suggestion to try the help centre, you do not — and note that failing this test is usually a deliberate configuration choice made by somebody optimising a metric rather than an oversight. Then apply both tests specifically to the complaints route, because that is where 2% of Ofcom’s telecoms respondents were heading and where a gate does the most damage. Write down what you find and date it. That document is the beginning of a defensible position.
Why this belongs on a board agenda rather than a support team’s backlog
The instinct is to treat AI customer service as an operational matter for whoever runs support. This month’s two publications are an argument for handling it a level higher, for a reason that has nothing to do with technology. The decisions that produce the failures — what to measure, whether escalation is unconditional, whether complaints may be automated, what the assistant is allowed to concede — are all trade–offs between cost and customer access. Those are not engineering choices and they should not be made by whoever is closest to the tooling. They are the kind of judgement a virtual CIO engagement exists to surface: decisions with a clear short–term financial upside and a diffuse, delayed reputational cost.
There is a supplier dimension too, and it is arriving faster than most businesses expect. Ofcom’s expectations apply to telecoms providers, but the organisations reading them include every regulated firm wondering whether its own regulator will say something similar — and those firms pass their obligations down through procurement. A written statement of how your business uses AI in customer–facing processes, what it discloses, and how a customer reaches a human is becoming a routine due diligence question rather than an unusual one. Having the answer drafted is considerably cheaper than assembling it during a tender.
The security and data protection angle rounds it out, and it is where the Cyber Essentials discipline of enumeration earns its keep again. An AI support assistant is a third–party service processing your customers’ personal data, reachable from the internet, integrated with your systems, and frequently procured outside the IT function by a marketing or operations team. That makes it precisely the kind of asset that never reaches an inventory, never gets a data protection assessment and never appears in a scope conversation. Ofcom’s finding that customers “share concerns about risks to their personal data and privacy” is, for once, a customer instinct that matches the internal reality rather well.
The final point is about timing, and it is the reason this is worth acting on in a quiet week rather than a busy one. Right now the standard is published, the obligation is absent, and the fixes are a disclosure line and an escalation path. If evidence of harm accumulates and Ofcom or another regulator moves to rules, the same changes will have to be made anyway — to a deadline, with documentation requirements, and alongside every competitor doing the same thing at the same time. The work does not get smaller by waiting. Only the discretion about how to do it does.
The story at a glance
| Item | Detail |
|---|---|
| What was published | Ofcom’s initial assessment of AI’s impact on telecoms customers, 25 September 2026 |
| Expectation one | It must be transparent to customers when they are interacting with a GenAI application |
| Expectation two | Providers’ AI applications must not act as “gatekeepers” creating barriers to accessing support through channels providers are required to offer |
| GenAI tool use | 53% of online UK adults have used tools such as ChatGPT, Meta AI, Google Gemini or Microsoft Copilot in the past 12 months |
| Business chatbot contact | 23% of UK adult internet users interacted with an AI chatbot in the same period |
| By sector | Retail 11%, financial services 8%, utilities 8%, telecoms 6% |
| Telecoms–specific AI use | 8% — about one in twelve — used an AI service in relation to telecoms services |
| What they used it for | 6% to resolve an issue, 3% for a price or product comparison, 2% to make a complaint — figures overlap and do not sum |
| No AI contact at all | 46% of UK adult internet users, a figure Ofcom expects to fall |
| Consumer sentiment | Mixed — some welcome the speed, others see AI as reducing access to human support, “often regardless of whether AI actually resolves the issue faster” |
| Privacy | Most recognise the time AI could save but “share concerns about risks to their personal data and privacy” |
| The negotiation finding | Many feel that negotiating with a human still gets them a better deal |
| Ofcom’s quote | Policy Director Cristina Luna–Esteban: working with firms “to ensure a future where AI works in consumers’ best interests and firms ensure human support remains available when they need it” |
| Regulatory position | Only “limited evidence” of AI as a systemic cause of harm; existing rules considered sufficient for now |
| The condition attached | Ofcom says it will act if evidence of harm emerges |
| Why it matters outside telecoms | A published, testable two–part standard becomes the benchmark clients, insurers and procurement teams apply to businesses Ofcom does not regulate |
| Cheapest way to comply | A plain disclosure line at the start, and an unconditional route to a human that the assistant cannot refuse |
This story sits directly alongside several we have covered recently. The Citizens Advice call for a “right to talk to a human” is the essential companion piece — published four days before Ofcom’s assessment, it supplies the harm evidence for which Ofcom has now supplied the specification, and the two should be read together. Ofcom’s investigations into VoIP number misuse show the same regulator in a different posture, and are a useful reminder of what happens when supervisory concern hardens into formal action. The Kiteworks shutdown warning makes the case for knowing which third–party services process your data — an AI assistant is exactly such a service. Cambium Networks entering administration is the supplier–risk version of the same question. And Vodafone’s copper switch–off is a reminder that the human–support channel customers say they prefer depends on a phone network currently being rebuilt.
Two tests. Would your customer journey pass either?
Ofcom has published something genuinely rare: an AI standard specific enough to audit. Cloudswitched’s virtual CIO service helps UK businesses make exactly this class of decision well — where automation belongs, what gets disclosed, which contacts must always reach a person, what an assistant is permitted to offer, and how the data position stands up. These are strategic trade–offs between cost and customer access, not configuration settings, and they are considerably cheaper to get right before a client questionnaire or a complaint forces the question.
Talk to us about Virtual CIO ServicesFrequently asked questions
Adopt the standard while it is still voluntary
The changes Ofcom’s expectations imply — a disclosure line, an unconditional escalation path, complaints kept out of automation, a documented data position — are the same changes a business would have to make if rules arrived. The only thing that shrinks by waiting is your discretion over how to do them. Cloudswitched works with UK businesses on this as a strategic question rather than a support–desk configuration: where AI genuinely helps, what customers must be told, which contacts always reach a person, and how to evidence all of it when a client asks.
Talk to us about Virtual CIO Services
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
