The Digital Regulation Cooperation Forum (DRCF) is a voluntary body through which four UK regulators coordinate their work on digital markets: the Competition and Markets Authority (CMA), the Information Commissioner's Office (ICO), the Office of Communications (Ofcom) and the Financial Conduct Authority (FCA). It exists because a single online service can fall under competition law, data protection law, online safety law and financial regulation at the same time, and the agencies enforcing those regimes do not always pull in the same direction. The DRCF does not make rules or take enforcement decisions. Its job is to settle overlaps before they reach companies and publish joint positions where remits meet.

What the forum is, and what it is not

According to the DRCF's own description, it "is a voluntary forum. It is not a statutory entity, nor does it have a statutory remit." It "does not provide formal advice or direction to member regulators, who remain individually accountable." Each member is a statutory regulator in its own right; the forum is a coordination layer above them.

The four members split the digital economy roughly as follows. The CMA enforces competition and consumer law and, since January 1, 2025, runs the strategic market status regime under the Digital Markets, Competition and Consumers Act 2024. The ICO enforces the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations, which govern cookies and tracking. Ofcom regulates broadcasting, telecoms and, under the Online Safety Act 2023, user-to-user and search services. The FCA supervises financial services, including payments, lending and investment products sold online.

A note on names: the ICO became the Information Commission, a board-led body, on September 30, 2026, under the Data (Use and Access) Act 2025. Its functions are unchanged. DRCF publications and coverage of its October 2026 joint statement still refer to the member as the ICO.

How it works

The forum is funded equally by the four members and run by a small core team led by a chief executive. According to the Institute for Government (IfG), which published an explainer in May 2026, the team numbers "around 20 full-time staff," seconded from the member regulators or employed through arrangements with Ofcom. Kate Jones is chief executive, and the chair rotates among the member chief executives. The IfG lists Sarah Cardell, chief executive of the CMA, as chair as of May 2026.

The working cycle is annual. Each autumn the DRCF issues a call for input asking businesses, civil society and academics where regimes overlap or conflict. Member chief executives then agree a workplan, published each spring, and an annual report reviews the previous year. The sixth workplan, for 2026/27, was published on April 27, 2026, alongside the 2025/26 annual report. It names research into consumer attitudes to AI risks and a "DRCF Research Lab" to coordinate research agendas across members.

The outputs fall into a few categories:

  • Joint statements, in which two or more members set out how their regimes interact. The first, from the CMA and ICO on May 19, 2021, argued that "rather than competition and data protection being in opposition, they are complementary agendas."
  • Foresight papers on technologies such as digital identity, quantum computing and the metaverse.
  • Innovation support, most visibly the AI and Digital Hub, a pilot service offering free, informal, cross-regulatory advice to companies, and its successor, the Thematic Innovation Hub.
  • Calls for input on specific topics, which gather evidence for all four members at once.

A worked example shows why the coordination layer exists. A consent banner on a news site is a data protection question for the ICO. If a dominant platform designs a consent flow that steers users towards sharing data with it and away from rivals, the same screen becomes a competition question for the CMA. If the site carries paid scam ads, Ofcom's online safety duties apply. If the ads promote unregulated investments, the FCA is involved.

Origin and evolution

The CMA, ICO and Ofcom launched the forum on July 1, 2020. "The Forum formalises our existing collaborative efforts," Simon McDougall, then the ICO's executive director for technology and innovation, said at launch. The timing followed the CMA's market study into online platforms and digital advertising, published the same day.

The FCA joined as a full member in April 2021, having been an observer. The CMA-ICO joint statement followed in May 2021, alongside an updated memorandum of understanding between the two that enabled information sharing. It named two live adtech cases: Google's Privacy Sandbox and real-time bidding.

In December 2021, the House of Lords Communications and Digital Committee called the forum "a small step in the right direction" but noted it was "non-statutory" with "no power to direct its members." It recommended placing it "on a statutory footing, with the power to resolve conflicts between its members," renaming it the Digital Regulation Board and giving it an independent chair. The government rejected that in March 2022, arguing that a statutory body able to direct regulators might "confuse issues of regulator independence and accountability."

The forum then widened its reach. It launched the International Network for Digital Regulation Cooperation (INDRC) in June 2023, and in August 2023 the CMA and ICO published a joint position paper on harmful online design. In 2024 it set a three-year vision whose five priorities include anticipating developments such as agentic AI. The AI and Digital Hub ran as a year-long pilot, and on October 10, 2025, the DRCF published insights from it and announced a Thematic Innovation Hub, with agentic AI as its first theme. A second series, on authentication and trust, opened for input on June 25, 2026, covering digital verification and deepfakes.

Why it matters for marketers

For the advertising industry, the forum is where the UK's privacy, competition and safety regimes are reconciled. Many of the hardest questions in UK adtech sit across two or more of its members. When the ICO advised the government in May 2026 to ease consent rules for contextual targeting and measurement, the change had competitive consequences for publishers and platforms. Ofcom's draft fraudulent advertising codes under the Online Safety Act, consulted on from July 10, 2026, touch financial promotions that the FCA polices. And the CMA's designation of Google with strategic market status led to a conduct requirement on publisher controls over AI features that involves the use of content and data.

The forum's agentic AI work is the most direct link to ad tech today. Agents that buy media handle personal data, make commercial recommendations and can execute payments, touching all four regimes.

Limitations and criticisms

The central criticism has not changed since 2021: the forum has no power to resolve disagreements between its members. If the ICO and CMA reach different conclusions, the DRCF can host the discussion but cannot decide it. Supporters say this preserves independence; critics say it leaves firms uncertain exactly where regimes collide.

Membership is a second dispute. Advocates of a wider forum point to bodies such as the Advertising Standards Authority, the Payment Systems Regulator and the Gambling Commission, whose remits also touch digital services. The forum's leaders have resisted. Kate Jones told a Commons committee on October 25, 2023, that the value of adding smaller regulators "would have to be weighed against the costs." John Edwards, the Information Commissioner, warned that a membership of "27 or 30 regulators" would be "unwieldy." It holds quarterly roundtables with ten other regulators instead.

A third concern is output: joint statements bind no one, and no published figures show whether coordination has reduced conflicting guidance. Civil society groups, including the child-rights organisation 5Rights Foundation, have used the annual workplan consultations to press for firmer commitments.

DRCF compared with adjacent terms

  • DRCF vs INDRC: the DRCF coordinates four UK regulators. The International Network for Digital Regulation Cooperation, launched by the DRCF in June 2023, connects cross-regulatory bodies in other countries for information sharing.
  • DRCF vs the CMA's digital markets unit: the unit inside the CMA enforces the strategic market status regime with binding legal powers. The DRCF has no enforcement powers of its own.
  • DRCF vs UK Regulators Network (UKRN): the UKRN brings together economic regulators of utilities and transport on cross-sector issues such as consumer vulnerability. The DRCF is limited to digital regulation.
  • DRCF vs EU coordination bodies: the European Board for Digital Services and the Digital Markets Act high-level group are created by EU law. The DRCF rests on voluntary agreement and terms of reference.

Recent developments

On March 31, 2026, the forum published a foresight paper on agentic AI that set out five levels of autonomy and warned that agents given broad permissions over emails and customer records create "expanded attack surfaces". The paper stated that "AI agents do not fall outside existing UK regimes."

The ICO separately opened a call for evidence on October 8, 2026, asking about agent identification, authentication and scoped permissions, with responses due November 20, 2026. On October 15, the DRCF opened its call for input on the 2027/28 workplan, also due November 20.

On October 30, 2026, the four members published a joint statement on protecting people and businesses in an agentic economy. It confirmed that consumer protection, competition, data protection, financial services, online safety and cybersecurity obligations apply to personal AI agents, and that an agent's autonomy "does not diminish corporate accountability for legal compliance," according to Freevacy's summary. It names fraud, inappropriate sharing of personal information and misleading recommendations as risks. The CMA added the statement to its guidance on complying with consumer law when using AI agents the same day.

Timeline

  • July 1, 2020: CMA, ICO and Ofcom launch the Digital Regulation Cooperation Forum.
  • March 10, 2021: DRCF publishes its first annual workplan, for 2021/22.
  • April 2021: FCA joins as a full member after a period as an observer.
  • May 19, 2021: CMA and ICO publish their joint statement on competition and data protection.
  • December 2021: House of Lords committee recommends a statutory Digital Regulation Board.
  • March 2022: Government rejects the Digital Regulation Board recommendation.
  • June 2023: DRCF launches the International Network for Digital Regulation Cooperation.
  • August 2023: CMA and ICO publish a joint position paper on harmful online design.
  • 2024: DRCF sets its three-year vision and pilots the AI and Digital Hub.
  • January 1, 2025: DMCC Act digital markets regime takes effect, expanding the CMA's remit.
  • October 10, 2025: DRCF publishes AI and Digital Hub pilot insights and launches the Thematic Innovation Hub on agentic AI.
  • March 31, 2026: DRCF publishes its agentic AI foresight paper.
  • April 27, 2026: Sixth workplan (2026/27) and 2025/26 annual report published.
  • June 3, 2026: Call for input on consumer interest and AI opens.
  • June 25, 2026: Thematic Innovation Hub opens a series on authentication and trust.
  • September 30, 2026: ICO becomes the Information Commission.
  • October 15, 2026: Call for input on the 2027/28 workplan opens.
  • October 30, 2026: Joint statement on protecting people and businesses in an agentic economy.
  • November 20, 2026: Deadline for responses to the 2027/28 workplan call for input.

Summary

Who: The Competition and Markets Authority, the Information Commissioner's Office (now the Information Commission), Ofcom and the Financial Conduct Authority, supported by a core team of about 20 staff under chief executive Kate Jones.

What: A voluntary, non-statutory forum that coordinates the four regulators' work on digital services through annual workplans, joint statements, foresight research and innovation advice, without powers to direct its members.

When: Launched on July 1, 2020, by three regulators; the FCA joined in April 2021. Its latest output is the October 30, 2026 joint statement on AI agents, and its 2027/28 workplan call for input closes on November 20, 2026.

Where: The United Kingdom, with international links through the INDRC network it launched in 2023.

Why: Digital services fall under several regimes at once, and the forum aims to reduce conflicting guidance and close gaps where competition, data protection, online safety and financial rules overlap, most recently for agentic AI.