This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
Since 6 April 2025, a specific list of online review practices has been automatically unlawful in the UK, and the Competition and Markets Authority (CMA) started genuinely enforcing it in March 2026. For a business using AI to help manage reviews or online reputation, the practical question isn't whether AI is involved, it's whether the underlying practice is on the banned list.
In short: under the Digital Markets, Competition and Consumers Act 2024 (DMCCA), posting or commissioning fake reviews, hiding negative reviews, offering undisclosed incentives for reviews, and displaying misleading aggregated star ratings are all banned practices, regardless of whether a human or an AI tool carried them out. The CMA can fine a business up to 10 percent of its global turnover for infringing.
What actually became illegal, and when
The DMCCA's consumer protection regime, including the banned-practices list for reviews, came into force on 6 April 2025. The CMA's own fake reviews guidance (CMA208) sets out what's covered: submitting or commissioning fake reviews (positive or negative), publishing incentivised reviews without clearly disclosing the incentive, suppressing or hiding genuine negative reviews, and presenting star ratings or aggregated review data in a way that misrepresents what customers actually said.
The CMA is now actually enforcing this, not just publishing guidance
On 27 March 2026, the CMA opened its first five DMCCA investigations into fake and misleading reviews, against Autotrader, Feefo, Dignity, Just Eat, and Pasta Evangelists. The specific practices under investigation span the full lifecycle of a review: whether 1-star reviews were being excluded from Autotrader's platform and star ratings, whether Just Eat's ratings system inflated certain restaurants' scores, whether Dignity asked staff to write positive reviews of its own crematoria services, and whether Pasta Evangelists offered undisclosed discounts in exchange for 5-star reviews. No findings of infringement have been made yet in any of these cases, but the investigations themselves confirm the CMA is now applying the DMCCA's review rules in practice, not just on paper.
The owner of a UK independent retail chain, considering an AI tool to help draft responses to customer reviews and manage online reputation, had assumed this kind of activity was a low-risk marketing tactic with no real legal exposure. Seeing the March 2026 investigations changed that assumption: the enforcement is real, current, and already targeting exactly the kind of review-manipulation practices an AI tool could make easier to do at scale.
Where AI specifically raises the risk
None of the DMCCA's banned practices mention AI directly, they're written around the outcome, not the method. But an AI tool can make several of them easier to do at a scale that increases both the likelihood of getting caught and the size of the eventual penalty. An AI tool that auto-generates review content attributed to real or fictional customers falls squarely within the fake-reviews ban. An AI system that filters which reviews get published or which star ratings get shown, without human oversight of the filtering logic, risks the same review-suppression and misleading-display practices the CMA is investigating at Autotrader and Just Eat. An AI-drafted follow-up message that offers a discount code in exchange for a positive review, without clearly disclosing that incentive on the review itself, falls within the same undisclosed-incentive practice the CMA is investigating at Pasta Evangelists.
What's actually safe to do with AI
Using AI to draft a genuine, honest response to a real customer review, whether positive or negative, isn't a banned practice. Using AI to summarise review themes for internal reporting isn't either. Using AI to prompt real customers to leave a review, without tying that prompt to any reward or discount, is standard practice and not restricted by the DMCCA. The line sits at fabrication, concealment, and misleading presentation, not at using AI tools generally.
What a business publishing reviews needs to do
The DMCCA's obligations aren't limited to a business's own marketing. A business that hosts customer reviews on its own website, whether for its own products or as part of a comparison or marketplace feature, has a positive duty to take reasonable steps to prevent fake reviews and undisclosed incentivised reviews from being published, not just to refrain from writing them itself. The CMA's guidance points to a published reviews policy, a process for identifying and removing suspected fake reviews, and clear labelling of any incentivised review as the kind of reasonable steps it expects to see.
For a business using an AI-moderated review system, whether built in-house or bought from a vendor, this means the moderation logic itself needs to be checked against these rules. An AI filter that systematically down-ranks or hides negative reviews, even unintentionally through a poorly tuned relevance or quality score, risks reproducing the exact practice under investigation at Autotrader. Asking a vendor directly how their AI moderation or ranking system treats negative reviews, and getting a clear answer, is a reasonable first step before relying on one.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Are fake reviews illegal in the UK?
Yes. Since 6 April 2025, submitting or commissioning fake reviews, whether positive or negative, is a banned practice under the Digital Markets, Competition and Consumers Act 2024, automatically treated as unfair and unlawful.
What penalties can the CMA impose for fake reviews?
The CMA can fine a business up to 10 percent of its global turnover for infringing the DMCCA's consumer protection provisions, which include the review-related banned practices.
Is using AI to write review responses against the rules?
No. Using AI to draft a genuine response to a real customer review isn't a banned practice. The rules target fabricated reviews, concealed incentives, and misleading display of review data, not the use of AI tools generally.
Has the CMA actually taken enforcement action under these rules?
Yes. On 27 March 2026 the CMA opened its first five investigations under the DMCCA's fake-review provisions, against Autotrader, Feefo, Dignity, Just Eat, and Pasta Evangelists. No findings of infringement have been made yet, but the cases confirm active enforcement.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
If your business uses AI to draft customer-facing content, check what the ICO expects around transparency and disclosure more broadly.
Read the UK AI Governance Guide