AI agent liability: contract and governance steps

AI agent liability is now a board-level question, and the UK has just made the answer less comfortable. On 6 November 2026, the Digital Regulation Cooperation Forum — the CMA, FCA, ICO and Ofcom — said existing competition, consumer and data protection law apply to personal AI agents, and that "an AI agent's autonomy does not diminish the responsibility of organisations that deploy it" (CIO).

That matters to anyone buying or selling agent projects through a marketplace. If the deployer carries the duty, the contract has to move risk, evidence and control back into the build. Standard SaaS terms were never written for software that acts.

Why AI agent liability sits with the deploying enterprise

The regulators were explicit that existing legal frameworks already cover agents, including online safety, financial services, payments and cyber security rules (CIO). There is no gap to wait out and no pending statute that will hand the problem to the vendor.

Lawyers see the same picture. A Cloud Security Alliance research note states that deploying an agent does not transfer liability to the agent; it concentrates accountability on the deploying organisation, and that standard vendor contracts routinely cap damages at monthly subscription fees while disclaiming accuracy (CSA). The same note ties AI agent liability to a "reasonable oversight" standard: enterprises are exposed unless they can show documented, operable monitoring, auditing and safety systems were in place when the agent acted.

The US courts have avoided settling the question. In its August 2026 opinion in Amazon.com Services v. Perplexity AI, the Ninth Circuit called the agent "a tool, not a person for statutory purposes" and expressly declined to create a new legal regime for agentic AI (American Bar Association). Treat every jurisdiction as unresolved and negotiate accordingly.

What the governance surveys say about readiness

The gap between adoption and control is measurable. IBM's October 2026 study of more than 3,200 senior executives across eight countries in Europe and the Middle East found that 80% had an AI-related incident reach the board or C-suite in the past year, while only 40% changed governance policy in response (IBM).

Only 37% said their governance is designed to scale with agentic AI deployment, even though 75% expect agents to have some autonomy over decisions by 2027 (IBM). A TCS study of 1,333 leaders across 25 countries found just 10% of enterprises let agents execute decisions without human approval across multiple functions (ETLegalWorld).

Views on who pays are split. In IBM's data, 20% of respondents want liability shared proportionally between deployer and vendor, 19% want a regulatory framework that does not yet exist, and 14% would place it on the vendor (IBM). Your contract is where that argument gets settled before an incident, not after.

The same picture holds in the UAE. Three in four executives surveyed by IBM there say an AI-related incident reached the board or C-suite in the past year, and only 41% say their governance is designed to scale with agentic AI deployment (ITP.net).

Write authority into the contract, not just access

Traditional software licences define named users and uptime. Agent agreements must define what the system may access, decide, communicate, change and execute, because agents touch CRM, email, procurement, finance, HR and third-party APIs with little real-time human involvement (Stoel Rives).

A general promise of "human oversight" is not a control. Ask for a three-tier schedule in the statement of work:

• Autonomous actions: retrieval, drafting, classification, ticket creation, internal workflow initiation.
• Human-approval actions: external communications, customer-facing decisions, security and access changes, financial approvals, data deletion.
• Prohibited actions: executing contracts, moving funds, employment decisions, regulatory filings, waiving legal rights.

Stoel Rives also recommends the agreement set spending thresholds, approval workflows, escalation rights and data-access classifications (Stoel Rives). For the controls to specify in discovery, see the guide to AI agent permissions buyers must require.

How to write indemnities, audit rights and liability caps

AI agent liability turns on paper as much as on model behaviour. Start with the indemnity: it should cover third-party claims arising from the agent acting outside its agreed authority, from a defect in the vendor's model or orchestration layer, and from the vendor's breach of data protection law. Generic IP indemnities will not reach these.

Then push on the cap. A cap tied to monthly subscription fees is meaningless against an agent that misdirects payments or discloses customer records. Carve out agent-caused breaches, regulatory fines and data incidents from the general cap, or set a separate, higher cap tied to contract value.

Finally, make audit rights operational rather than annual. Ask for:

1. 1Access to action logs, tool-call records and approval trails within an agreed window.
2. 2The right to test agent behaviour in a sandbox before each major model or prompt change.
3. 3Notice and change control when the vendor updates the underlying model.
4. 4Named security and incident contacts with defined response times.
5. 5A suspension right that lets you halt agent activity immediately.
6. 6Exit assistance, including export of logs and configuration.

Good drafting also names the owner. A single leader absorbing all AI agent liability weakens risk assessment, because that person is rewarded for minimising the risk they judge (Accounting Today). Write shared accountability across IT, security, compliance and legal into the agreement.

Human oversight needs evidence, not good intentions

An agent reports success; the workflow moves on. That response may mean a request was queued, not that the intended result occurred. As one CIO contributor puts it, permission is not proof, and applying separation-of-duties discipline to agents means more than asking the acting agent to review its own work (CIO).

The same piece recounts incidents where containment failed: a Hugging Face disclosure in July 2026, an Anthropic review reporting three incidents across 141,006 evaluation runs, and an OpenAI agent stopped about two and a half hours after an alert (CIO). Ordinary form submissions, not exotic attacks, were among Anthropic's findings.

Design oversight so a human approves consequential steps and a separate party verifies completion against the source system. Keep the approval record. That record is the difference between documented oversight and an assertion made after the fact. The AI governance knowledge hub covers the control framework in more depth.

Split AI agent liability across the delivery chain

Agent projects usually involve a model provider, an implementation partner and your own team. Each carries a different piece of AI agent liability, and the contract should say which.

A model provider may disclaim output accuracy. An implementation partner configures tools, permissions and guardrails. Your organisation sets the goals and approves the actions. Map the boundary in a simple table attached to the agreement, and make each party warrant only its own layer. Where the vendor integrates third-party models, require disclosure of subprocessors and flow-down of the same audit and incident obligations.

The engagement model shapes this too. Fixed-price work suits tightly specified agent builds with clear acceptance tests. Time and materials suits discovery-heavy pilots where scope will move. Compare the risk each carries in this guide to fixed price, time and materials, and dedicated teams.

Frequently asked questions

Who is liable when an AI agent makes a mistake?

The organisation deploying the agent generally carries the responsibility. The DRCF said an agent's autonomy does not diminish the deploying organisation's duty to comply with applicable law (CIO). Contract terms can shift financial risk to a vendor, but they do not move the regulatory duty.

Do existing laws apply to AI agents, or do we need new rules?

The UK's four digital regulators said existing competition, consumer, data protection, online safety, financial services, payments and cyber security requirements already apply to personal AI agents (CIO). The Ninth Circuit has explicitly avoided creating a new legal regime for agentic AI (American Bar Association).

What indemnity should an AI agent contract include?

Aim for cover for actions outside agreed authority, defects in the vendor's model or orchestration, and breaches of data protection law. Legal advisers report growing demand for AI-specific indemnities and liability caps in vendor agreements (ETLegalWorld).

How much human oversight should we keep?

At minimum, every consequential action should require approval, and completion should be verified independently. Only 10% of enterprises currently let agents execute decisions without human approval across multiple functions (ETLegalWorld), so approval gates remain the norm, not the exception.

What this means for buyers

You cannot contract your way out of regulatory duty, but you can stop paying for vendor failures. Before you sign, take five steps:

1. 1Classify every agent action as autonomous, approval-required or prohibited, and attach it to the contract.
2. 2Demand action logs, approval trails and evidence of completion, not just success messages.
3. 3Carve agent-caused data incidents and regulatory breaches out of the liability cap.
4. 4Secure sandbox testing, change notice and an immediate suspension right.
5. 5Name a board-level owner for AI risk and record the oversight decisions taken.

When you are ready to shortlist, browse the vendor directory by capability and jurisdiction, then post your project with the control schedule attached so every bidder prices the same obligations. Vendors that can evidence their controls will answer faster and more credibly, and you will be comparing real offers rather than marketing claims. AI agent liability is the clause set that decides which of those offers you can actually defend.