The CMA fined £4.7m in its first year of deciding for itself.

Direct enforcement means the regulator decides whether the law was broken and sets the penalty itself, rather than asking a court to do both. That changes the arithmetic for a business deciding whether to risk it, and it changes the speed at which a practice gets stopped.

The letters matter more than the fines

157 advisory and warning letters against 14 investigations is a ratio worth noticing. The CMA's preferred instrument in year one was correspondence, and it worked: on fake reviews it wrote to 54 review publishers and reports that 90% of the businesses contacted then took action, with investigations opened into 5 who did not.

That is the shape of a regulator establishing a norm rather than making an example. It also means a letter is a real event with a real deadline, not an opening position.

Drip pricing is the one that catches ordinary firms

The largest named case was the AA Driving School and BSM, which settled over drip pricing. The AA was fined £4.2 million and agreed to refund over £760,000 to learner drivers.

Drip pricing is showing a price and then adding unavoidable charges later in the journey. It is not a dark art — it is what happens when a booking fee, a card fee or a compulsory extra sits on the third screen because that is where the payment provider put it. A great many perfectly honest small businesses have a version of this and have never examined it.

What a professional firm should check

1. Your first advertised price. If any unavoidable charge is added later — booking, admin, card, mandatory insurance — the headline is not the price. Fix the headline rather than the disclosure.
2. Your reviews. The requirement is robust policies so that reviews give an honest picture. Soliciting only from happy clients, or filtering what gets published, is the practice being looked at.
3. Your sign-up and cancellation journeys. Online choice architecture is the third focus area, and it covers designs that make agreeing easy and leaving hard.

Why this sits on a site about AI

Because two of the three focus areas are now things software does on your behalf. A booking flow adds fees according to rules somebody configured years ago. A review request goes out automatically to a segment somebody defined. A cancellation journey is whatever the platform shipped.

Which makes this a specific instance of a general problem: you are accountable for what your systems decide, including the decisions nobody made on purpose. That is the same argument as the automated decision-making note in a consumer-law register, and the remedy is the same — know what the system does and be able to show it.

What this does not tell you

One year of a new power, and an enforcement pattern in year one is a statement of priorities rather than a boundary. Areas that got letters this year can get investigations next year.

It also does not tell you what the CMA would make of your particular pricing, which depends on facts we do not have, and we are not lawyers. What we would take from it is that the cheap moves — reading your own checkout as a customer, and reading your own review process as a sceptic — are available this afternoon. The register of what we have checked about ourselves is at what we checked, and the figures we removed is the same exercise applied to our own claims.