When an AI agent books the wrong flight, deletes a database, or executes a fraudulent transaction, the question of who is legally responsible has no clear answer under current U.S. law. That gap is widening as companies deploy autonomous software agents that can browse the web, send emails, and move money without a human approving each step.
The core problem is that liability frameworks built for human decision-makers and static software do not map cleanly onto systems that make judgment calls. An autonomous agent can act in ways its developers did not specifically program and its operators did not specifically authorize, leaving plaintiffs, defendants, and insurers arguing over where the chain of causation ends.
Legal analysts point to existing doctrines — product liability, agency law, negligence — as partial fits at best. Product liability assumes a defective design or warning failure. Agency law assumes a human principal directing an agent's actions. Neither cleanly covers a model that generates novel behavior from training data.
David Cohen, a professor at Drexel University's Kline School of Law who studies autonomous systems, told Live Science that responsibility traces back to human choices at every stage. "Autonomy always begins with something a human hands it," he said, referring to the data, objectives, and permissions a developer or operator supplies before an agent runs.
That principle matters because it gives courts a place to anchor fault. If a company deploys an agent with broad financial permissions and inadequate guardrails, the company — not the model — is the defendant. If a developer ships an agent knowing it can be manipulated, the developer carries exposure.
Insurance carriers are already adjusting. Several commercial insurers now ask applicants whether they use AI agents to make binding decisions, and some have added exclusions for harms caused by autonomous actions. That shifts risk back onto the companies deploying the systems.
Regulators have moved slower. The European Union's AI Act, which began phasing in obligations in 2024, assigns duties based on risk tier but does not resolve civil liability for agent-caused harm. In the U.S., no federal statute directly addresses it, leaving the question to state courts and contract law.
For businesses, the practical answer is contractual. Vendors increasingly cap liability for AI outputs, and customers increasingly demand indemnification. Whichever side has more leverage writes the rule — until a court or legislature writes a different one.
