← All blog posts

POST 08 · REGULATOR

The vulnerable customer your AI just disadvantaged: a regulator's-eye view.

From the regulator's desk, the question is not whether the AI is sophisticated. It is whether the supplier knew it would behave this way, and what they did about it. "We didn't realise" is not a defence. It is a finding.

Most AI failures in energy supply do not look like failures from inside the supplier. They look like outcomes — slightly worse for some customers than others, slightly slower for some segments, slightly less accurate at some times of year. Aggregated, those slightly-worse outcomes form a pattern. Patterns, in regulated markets, are findings.

What the regulator actually sees.

A customer in a Section 75 group in Northern Ireland whose complaint about a billing decision was handled by an AI handler that did not recognise the disability indicator. A customer on the priority services register whose self-disconnection signal was missed because the smart-meter anomaly was below the model's confidence threshold. A microbusiness in the Republic of Ireland whose contract renewal recommendation was generated by a TPI's AI tool the supplier had no view of. Each case looks individual. Aggregated against the supplier's published Code of Practice, they look like a posture.

How the regulator decides whether it is a finding.

Three questions. Was the AI Impact Assessment in place before the system went live? Did it name this failure mode, even if the mitigation was imperfect? And did the supplier act on its own evidence — frontline flags, complaint patterns, monitoring outputs — once the failure mode appeared? A supplier that can answer yes to all three is in a different conversation than one that cannot.

Why "we didn't realise" stopped working in 2025.

Because the regulator's expectations changed, not the technology. Consumer Standards now treat AI-mediated outcomes as outcomes, not as a separate category. The EU AI Act has set a baseline for high-risk systems that increasingly travels into UK regulator thinking. Ofgem, the CRU and UREGNI have all signalled, in their casework if not in their press releases, that they expect suppliers to know what their AI is doing.

What the regulator hopes to find.

Not perfection. Evidence. An AIIA they can read. A frontline review log they can sample. An owner they can name. A change history they can follow. A supplier's published Code of Practice that the AI is being held to. The regulator is not looking for the supplier to be defensive. They are looking for the supplier to be ready.