Agent liability

How agent liability works: 3 questions

1. Who did the action in law? An AI agent is not a legal person. Powell (2020) reads US agency law as one that sees a program as a tool of its user.
2. To whom does the law give the action? The default answer is the user. A contract between two parties can change this.
3. Can the customer get the cost back from the vendor? The vendor contract decides. A cap and the losses that the contract does not include can limit the recovery.

Rule	What it says
UETA section 14, US state laws	Electronic agents can make a contract with no human check
UNCITRAL Model Law on Automated Contracting, Article 7 (2024)	The action goes to “the person who uses the system for that purpose”
Same law, Article 7(3)	An “unexpected” outcome alone does not stop this
California AB 316, from 1 January 2026	A defendant cannot say that the AI “autonomously caused the harm”

Why agent liability matters: what the contract does not cover

The customer carries the risk, and the contract can limit what the customer gets back. Three terms cause this:

• Customer duties. The Atlassian AI Terms (October 2025) make the customer “responsible for its use of Agents”.
• Losses that are not included. Clifford Chance (February 2026) says that most technology contracts do not include key categories of loss.
• Caps. The same source says contracts limit supplier liability to the fees that the customer paid.

2 cases that show who pays

1. Moffatt v. Air Canada, 2024. Air Canada said that its chatbot was “a separate legal entity”. The tribunal did not agree and found no reasonable care. The airline paid 650.88 in damages, 36.14 in interest and 125 in fees.
2. Mobley v. Workday, July 2024. A US federal court held that Workday “may be liable on an agency theory” for its tools that help employers hire. The decision let the claim continue. It did not find Workday liable.

The UNCITRAL law also has an optional Article 8. It covers an action that the user could not reasonably expect. The other party then cannot rely on the action if it knew, or could reasonably know, that the user did not expect it.

In practice: 5 controls that lower agent liability

These five points are the synthesis of AI Matter from the sources above. They are not legal advice.

Control	Why it helps
Keep high stakes decisions away from the agent	Clifford Chance says to think about whether to give high stakes decisions to agents at all
Human-in-the-loop checks of important decisions	Shows the supervision that vendor terms ask for
An audit trail of each agent action	Shows what the agent did, and for which customer
Least privilege for agent credentials	Makes the largest possible loss smaller, against excessive agency
Read the cap and the losses that the contract does not include	The cap can be the fees paid

Where definitions disagree

The word “agent” has two meanings, and the two do not agree.

• In law, an agent is a person. Powell (2020) reads the Restatement of Agency as a view that a program cannot be a principal or an agent. Mobley applied agency to Workday, the company, not to its software.
• In AI, an agent is software that does actions. Noam Kolt (2025) uses the economics and the law of agency as a frame to study AI agents. He names liability as one of three governance principles.

An AI agent acts for a user, but the law gives its actions to that user.

Questions and answers

Who is liable when an AI agent makes a mistake?

Usually the company or person that uses the agent. The UNCITRAL Model Law on Automated Contracting gives the action to the user of the system. A vendor can also be liable. Mobley v. Workday (2024) is an example.

Can a company say that its AI agent acted alone?

That defence is weak. A tribunal in British Columbia did not accept it for an Air Canada chatbot in 2024. California law AB 316 stops it from 1 January 2026. Other defences, such as causation, stay.

Does the AI vendor share the liability for agent actions?

Only in part, by contract. The Atlassian AI Terms tell the customer to supervise agent actions. Clifford Chance (February 2026) says that contracts can cap supplier liability at the fees paid. It also says that most technology contracts do not include key categories of loss.