You Cannot Outsource Accountability to an Agent

On 14 February 2024 a small-claims tribunal in British Columbia ruled on a dispute over a bereavement fare. Jake Moffatt had asked the chatbot on Air Canada’s website about the fare and been told they could apply for it after booking. Air Canada staff later told them the airline did not accept retroactive applications. Air Canada argued it could not be held liable for information given by its chatbot. Tribunal member Christopher Rivers wrote that the airline “suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission.” It made “no difference whether the information comes from a static page or a chatbot.” Air Canada was ordered to pay C$812.02, interest and fees included.

Accountability for an AI agent stays with the people and businesses that build, sell and use it. I have found no ruling or statute that accepts the agent’s autonomy as a defence. What is still open is how the cost is split among them. You can hand an agent a task, and the accountability stays with you. So before an agent acts, a named person with real authority must be able to show what was done to prevent harm.

The A7 essay calls the distance between the authority a company hands its agents and the accountability it builds around them the Delegation Deficit. This piece covers who pays when that gap opens. What an agent is, how much autonomy to give one and what happens when agents deal with each other have their own pieces.

What the law says so far

The oldest rule is E-SIGN, the US federal e-signature law of 2000. It lets a contract formed by “electronic agents” stand “so long as the action of any such electronic agent is legally attributable to the person to be bound” (15 U.S.C. §7001(h)). Where the act is attributable, the law treats the software as the person’s instrument.

Moffatt applied the ordinary law of negligent misrepresentation. Air Canada owed its customer a duty of care and “did not take reasonable care to ensure its chatbot was accurate.” Its reasoning is the point: a chatbot on a company’s website speaks for the company.

Mobley v. Workday puts the vendor in the frame. Derek Mobley alleges that Workday’s screening tools discriminated by race, age and disability. In a July 2024 order, Judge Rita Lin of the US District Court for the Northern District of California dismissed the claims of intentional discrimination and let the disparate-impact claims proceed. She accepted, at this early stage, the theory that Workday acted as an agent of the employers who used it: “Drawing an artificial distinction between software decisionmakers and human decisionmakers would potentially gut anti-discrimination laws in the modern era.” In May 2025 she preliminarily certified a collective of applicants aged 40 and over. Nothing has been decided on the merits, and the case is in discovery as of October 2026. The order adds a defendant without removing one. The statutes reach “any agent of” an employer, and employers “cannot escape liability for discrimination by delegating their traditional functions, like hiring, to a third party.”

California has put the point in statute. Civil Code §1714.46, added by AB 316 and in force since 1 January 2026, says a defendant “who developed, modified, or used artificial intelligence” that is alleged to have caused harm may not assert “that the artificial intelligence autonomously caused the harm to the plaintiff.” Subsection (c) keeps every other defence, including causation, foreseeability and the comparative fault of others. The section removes one excuse. It creates no liability of its own.

The EU splits the question in two. The AI Act sets duties, not compensation. For high-risk systems, Article 26 requires deployers to “assign human oversight to natural persons who have the necessary competence, training and authority”, to monitor the system and suspend it if it presents a risk, and to keep its logs for at least six months. Article 99(4) allows fines of up to EUR 15 million or 3% of worldwide turnover for breaching those duties. Under the Digital Omnibus, Regulation (EU) 2026/1744, they apply from 2 December 2027 to the Annex III systems, which include hiring and creditworthiness tools.

Compensation comes from the new Product Liability Directive, (EU) 2024/2853, which member states must carry into national law by 9 December 2026. It counts software as a product and makes the software’s manufacturer liable for defects without proof of fault. Anyone who substantially modifies a product outside the manufacturer’s control becomes its manufacturer (Article 8(2)). A court can order a defendant to disclose evidence, and a defendant that fails to do so faces a presumption that the product was defective (Articles 9 and 10). It covers products placed on the market after 9 December 2026.

Side by side, the six rows below show what each instrument establishes so far and what it leaves open.

What the law has not settled

Four questions are open, and they decide who pays.

1. Attribution. E-SIGN and California both assume an agent’s act belongs to someone. I haven’t found a ruling that decides whether an agent that takes an action its user never contemplated is acting as its user’s instrument or as its vendor’s defective product.
2. The split between vendor and deployer. Until Mobley ends, a business that buys a screening tool should assume that both it and its vendor can be sued.
3. Business losses. The Product Liability Directive compensates natural persons only, and excludes property used exclusively for professional purposes and data used for professional purposes (Article 6). The Commission’s proposed AI Liability Directive, which would have eased other AI claims, was formally withdrawn in October 2025. A company harmed by another company’s agent falls back on contract and national tort law.
4. What the remaining defences are worth. California removed one argument and kept causation, foreseeability and comparative fault. How courts will weigh those when an agent sits between the defendant and the harm is untested.

Two incidents no court decided

In July 2025 Jason Lemkin, the founder of SaaStr, was testing Replit’s AI agent when it deleted a live company database during a code freeze, Fortune reported. The agent told him a rollback would not work in that case. He recovered the data manually. Replit’s chief executive, Amjad Masad, wrote on X: “Unacceptable and should never be possible.” The lesson is narrow: an agent’s account of what it did is not evidence. The record has to come from systems the business controls.

The second shows where blame lands when nobody planned for it. In March 2018 an Uber test vehicle driving itself struck and killed Elaine Herzberg in Tempe, Arizona. A year later the Yavapai County Attorney’s Office found “no basis for criminal liability for the Uber corporation”; Herzberg’s family had settled with the company soon after the crash. The safety driver, Rafaela Vasquez, pleaded guilty to endangerment in July 2023 and was sentenced to three years of supervised probation. The National Transportation Safety Board had listed Uber’s inadequate safety procedures and ineffective oversight of its drivers among the contributing factors.

The researcher Madeleine Clare Elish calls this a “moral crumple zone”, where responsibility “may be misattributed to a human actor who had limited control over the behavior of an automated or autonomous system.” That matters because a named owner is this piece’s fix. A person who is named but cannot change or stop the system becomes the one who absorbs the blame.

What to have in place before an agent acts

Outside EU high-risk systems, the law prescribes no controls. These three are my judgment of what lets a business show the reasonable care Air Canada failed to take.

1. A named person with authority. One person answers for each agent in production and can change its limits or switch it off without asking anyone. “Competence, training and authority” is the AI Act’s wording for high-risk deployers, and it is also the answer to the crumple zone: the name must come with the power. Naming an owner does not move the company’s liability onto that person.
2. Records the business holds. Log what the agent was asked, what it accessed, what it did and who approved it, in systems outside the agent’s reach. Keep them at least as long as Article 26(6) requires. A deployer that becomes a manufacturer under Article 8(2) of the Product Liability Directive can be ordered to disclose evidence, and failing to disclose risks a presumption of defect.
3. Limits in code, and a stop that has been tested. Write the agent’s authority as limits the software enforces: amounts, the data it may touch, and actions that need a person’s approval. Then rehearse the stop. Article 26(5) expects a deployer to suspend a high-risk system that presents a risk, and a stop nobody has rehearsed may fail on the day it is needed.

Contracts come last because they move money, and only money. A vendor indemnity can pay for a claim. It does not take the deployer off the list of defendants. Vendor questions are in the piece on third-party AI risk. When to stop a live system and what a board should be able to switch off have their own pieces, and the A7 readiness assessment checks whether your governance supports the autonomy you already run.

Where this could be wrong

The first objection is that the law is moving toward vendors. In Europe that is partly true: the Product Liability Directive puts defects on the manufacturer, and a business that deploys an unmodified product may never be the defendant. But a business that fine-tunes or repurposes an agent can become its manufacturer under Article 8(2), or its provider under Article 25 of the AI Act. Air Canada was a deployer, and Mobley’s reasoning assumes employers stay liable alongside the vendor.

The second is that one tribunal decision, one open case and one statute are thin ground. They are. Moffatt binds no one and Mobley has no verdict. The argument needs only the direction they share: none of them accepted that the software acted on its own.

The third is that one owner per agent won’t scale to thousands of agents. Then the unit becomes a class of agents with the same limits, and one person owns the class. An agent nobody owns scales worse.

Sources and changes

• Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149, 14 February 2024.
• 15 U.S.C. §7001(h), Electronic Signatures in Global and National Commerce Act, Pub. L. 106-229, 30 June 2000.
• US District Court, N.D. Cal., Mobley v. Workday, Inc., No. 23-cv-00770-RFL: order on the motion to dismiss, 12 July 2024; order granting preliminary collective certification, 16 May 2025; docket, read 6 October 2026.
• California AB 316 (Krell), Chapter 672, Statutes of 2025, adding Civil Code §1714.46, approved 13 October 2025.
• Regulation (EU) 2024/1689 (AI Act), Articles 25, 26 and 99, as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ 24 July 2026.
• Directive (EU) 2024/2853 on liability for defective products, OJ 18 November 2024, Articles 2, 4 to 10 and 22.
• Withdrawal of Commission proposals, C/2025/5423, OJ 6 October 2025.
• Beatrice Nolan, "AI-powered coding tool wiped out a software company’s database in ‘catastrophic failure’", Fortune, 23 July 2025.
• NPR, "Uber not criminally liable in death of woman hit by self-driving car, says prosecutor", 6 March 2019; Associated Press via NPR, "Backup driver of an autonomous Uber pleads guilty to endangerment", 28 July 2023.
• Madeleine Clare Elish, "Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction", Engaging Science, Technology, and Society 5 (2019).

Changes on 6 October 2026. Cut from about 5,700 words to a Reference and retitled; it was “Agentic AI: Who Is Responsible When the Agent Decides?”. Mobley v. Workday is now described as the court records it: claims allowed to proceed and a collective preliminarily certified, with no finding of liability. The withdrawal of the AI Liability Directive is dated to its October 2025 notice in the Official Journal. Three composite scenes, six survey figures, an insurance market estimate, six quotations, four further incidents and seven custom visuals are removed. The Delegation Deficit is now defined only in the A7 essay.