Who Is Liable When an AI Agent Gets It Wrong?

A Question With No Answer Yet

An AI agent authorised to manage supplier payments sends a six figure wire against an invoice it judged to be legitimate. A procurement agent commits to a contract term a human would never have signed off. A customer service agent issues refunds that drain a promotions budget in an afternoon. None of these are hypothetical any more. Agents are already booking, buying, negotiating and emailing on behalf of companies, and the harder question is catching up fast: when one of them causes real financial or reputational damage, who actually pays for it.

As of late 2026, there is no settled answer. No court has yet issued a ruling that resolves liability for an autonomous agent's actions, and legal commentators tracking the space, including the 2026 AI legal forecast published by law firm Baker Donelson, describe accountability for agentic systems as one of the most consequential questions moving from innovation into compliance. Regulators are watching closely. The case law is not there yet.

Three Candidates, No Winner

Strip the debate back and three parties keep surfacing as the possible bearer of liability. The first is the deploying company: the business that switched the agent on, gave it access to a bank account or a CRM, and set its goals. Under ordinary agency principles, a company is often responsible for the acts of its agents, human or otherwise, carried out within the scope of their authority. The second is the AI vendor that built and sold the underlying system, who could face claims rooted in product liability or negligent design if the agent behaved in a way its own specification never anticipated. The third, and the one generating the most genuine debate, is what analysis from the compliance researchers at BigID frames as the agent's "operator": whoever was actually directing or supervising that specific action at the moment it happened. That might be the deploying company. It might be a contractor. It might be another piece of software entirely, sitting somewhere in a chain of agents acting on each other's outputs.

None of the three frameworks maps cleanly onto how agents actually work. Agency law assumes a principal who can reasonably foresee and control what their agent does. Product liability assumes a defect in a fixed, inspectable product. Neither was written for a system that interprets ambiguous natural language instructions and then acts on an interpretation nobody explicitly signed off.

Why the Law Is Behind the Technology

Part of the gap is simply timing. A dispute over a specific harmful agent action needs to happen, work through discovery and motions, and produce a written judgment before anyone has case law to point to, and that process takes years. Most agents capable of causing real financial exposure have existed for a much shorter time than that. Baker Donelson's forecast frames 2026 as the year this shifts from a theoretical compliance topic to an active one, precisely because deployment is outpacing the legal frameworks meant to govern it.

The deeper problem is structural, not just slow courts. Older liability regimes assume a reasonably traceable chain of human decisions. An agent that chains several tool calls together, draws on a vendor's model, operates inside a company's own systems, and executes an action no single human reviewed in advance breaks that chain in a way the law has rarely had to address. Regulators have noticed. BigID's analysis points to accountability for autonomous decisions as a live regulatory concern, precisely because existing frameworks were not built for systems that act at this speed and with this little direct human sign off.

What to Record While the Law Catches Up

Here is the part that should occupy any company deploying agents right now, regardless of how the legal question eventually resolves: none of the three liability theories above work without evidence. A court asking whether the deploying company controlled the agent's action, whether the vendor's design was defective, or who counted as the operator at the relevant moment is going to ask for records. What was the agent authorised to do. Who granted that authorisation, and when. What data and systems could it reach. What did it actually do, and does that match what it was told to do. A company that cannot answer those questions with a documented trail is exposed under every theory of liability on the table, not just the one that eventually wins in court.

At Mickai, this is the exact problem our AI Readiness assessment is built to address before an agent ever touches live systems. We help a company work out what its historic data actually contains, who is permitted to see and act on which categories of it, and what staged authorisation should look like before any agent is given write access to something that costs money or carries risk. The output is not a policy document that sits in a drawer. It is a record, tied to specific permissions and specific sign offs, of exactly what was authorised and by whom. Whichever way the liability question eventually settles, that record is what actually protects a company, because it turns "the agent did something unexpected" into a traceable decision with a named owner, rather than a shrug.

The honest summary is that nobody, not the courts, not the regulators, not the vendors, has settled who pays when an agent gets it wrong. That uncertainty is not a reason to wait before deploying. It is a reason to make sure that whatever an agent is allowed to do today is written down clearly enough that the question of who authorised it never has to be guessed at later.

Sources

• Baker Donelson, '2026 AI Legal Forecast: From Innovation to Compliance', bakerdonelson.com
• BigID, 'Who Is Liable If an AI Agent Causes Harm?', bigid.com