Who is accountable when an AI agent acts?

An AI agent that only drafts text leaves a person holding the pen. An agent that issues a refund, cancels an order or sends a message has done something. If it goes wrong, the obvious question is who answers for it, and "the AI did it" is the one answer no court, regulator or customer has so far accepted.

This analysis sets out where responsibility lands when an agent acts, using primary legal and standards sources from Canada, the EU, the UK and the US. It is legal context, not legal advice. Laws differ by country and sector, and several of the rules below apply only to particular systems or from particular dates. If you are new to agents, start with our explainer on what AI agents are and how they use tools.

A tribunal has already rejected the "separate entity" defence

The clearest early test involved a chatbot rather than an agent. In Moffatt v. Air Canada, decided by British Columbia's Civil Resolution Tribunal on 14 February 2024, a customer relied on the airline's website chatbot, which said a bereavement fare could be claimed after travel. The airline's own policy page said it could not. Air Canada argued it could not be held liable for information provided by one of its agents, servants or representatives, including a chatbot.[1]

“In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions.”

— Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149, para. 27.[1]

The tribunal called this "a remarkable submission" and found negligent misrepresentation. It held that the airline owed the customer a duty of care given their commercial relationship, and that it "did not take reasonable care to ensure its chatbot was accurate".[1] Our ecommerce agent tutorial covers what the case means for answering customer questions.

The decision is a small-claims ruling in one Canadian province and binds no one elsewhere. Its value is the reasoning. The chatbot only gave information. An agent that changes records or moves money is a stronger case for the same conclusion, because the business chose to give it that power. That last point is our inference, not something the tribunal decided.

Four parties, four kinds of responsibility

Responsibility for one agent action usually splits four ways. The EU's AI Act supplies useful vocabulary even where it does not apply.

The provider answers for what it supplies

The AI Act defines a provider as the person or body that develops an AI system or model, or has one developed, and places it on the market or puts it into service "under its own name or trademark".[2] For high-risk systems, Article 16 lists the provider's duties: meet the Act's requirements, put its name and contact address on the system, run a quality management system, keep documentation and the logs under its control, undergo conformity assessment and take corrective action when needed.[2]

The revised Product Liability Directive, (EU) 2024/2853, adds a liability route. It states that "software is a product for the purposes of applying no-fault liability", however it is supplied, including as a service, and that AI system providers should be treated as manufacturers.[3] A court assessing whether a product is defective must consider "any ability to continue to learn or acquire new features" after it is placed on the market. A manufacturer cannot escape liability for defects caused by software updates within its control, and liability to an injured person cannot be limited by contract.[3]

Two limits matter for business agents. The directive applies to products placed on the market after 9 December 2026. It compensates natural persons for death or personal injury, damage to property and destruction or corruption of data, but excludes property used only for professional purposes and data used professionally. Its recitals add that pure economic loss does not "by themselves" trigger liability.[3] An agent that refunds the wrong business customer is unlikely to be a Product Liability Directive case.

The deployer answers for how the agent is used

A deployer is anyone "using an AI system under its authority", except for personal non-professional use.[2] That is the business that connects an agent to its systems. For high-risk systems, Article 26 requires deployers to use the system according to its instructions, monitor it, keep the automatically generated logs under their control for at least six months, and tell workers before using it at work. It also says deployers "shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support".[2]

The boundary between the two roles can move. Under Article 25, a deployer or other third party becomes the provider of a high-risk system if it puts its own name on one, substantially modifies one, or changes the intended purpose of a system, including a general-purpose one, so that it becomes high-risk.[2] A business that builds an agent on a general-purpose model for, say, screening job applicants should not assume the model vendor carries the provider's duties.

The UK government made the practical point in a 2024 worked scenario about a fictional firm using a third-party AI recruitment tool:

“It’s common for the law to allocate liability to the last actor in the chain”

— UK Government, A pro-innovation approach to AI regulation: government response (February 2024), Case study 1.[4]

The approver answers for the decision, if the decision was real

An approval step only shifts anything if the person approving can understand what they are approving and can refuse. The AI Act's human oversight article says people assigned to oversee a high-risk system should be able to monitor it, to "remain aware" of automation bias, to interpret its output, to "disregard, override or reverse" it, and to halt it through a "stop" button or similar procedure.[2] NIST's AI Risk Management Framework asks organisations to "define and differentiate roles and responsibilities for human-AI configurations and oversight".[5]

Inside the organisation, the approver is answerable for their decision. Outside it, the customer's claim is normally against the business, not the employee. If the approval screen hid the facts that mattered, the failure belongs to whoever designed the screen. Approval should be judged as part of the system, not as a place to put blame.

The organisation answers to everyone else

Customers, regulators and courts deal with the organisation. NIST's framework puts accountability at the top: "Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment", and roles and responsibilities should be "documented and are clear to individuals and teams throughout the organization".[5] ISO/IEC 42001:2023 frames the same idea as a management system. ISO describes it as specifying requirements for "establishing, implementing, maintaining, and continually improving" an AI management system, for organisations "developing, providing, or using" AI.[6]

Which rules apply, and when

Most business agents, such as those that triage support email or investigate invoices, are not high-risk under the AI Act. High-risk status depends on use, such as employment or creditworthiness, listed in Annex III. Even so, Articles 14, 16 and 26 are a useful map of how lawmakers expect duties to divide. The original Act set 2 August 2026 for most provisions; the Digital Omnibus on AI, in force since 27 July 2026, moved the Annex III high-risk date to 2 December 2027.[2][7]

The gap the EU decided not to fill

In 2022 the Commission proposed an AI Liability Directive to adapt fault-based civil liability rules to AI. Its 2025 work programme listed the proposal for withdrawal, giving the reason: "No foreseeable agreement - the Commission will assess whether another proposal should be tabled or another type of approach should be chosen."[10] The withdrawal was published in the Official Journal on 6 October 2025, and EUR-Lex records the procedure as "Proposal withdrawn".[8]

The question has not gone away. In October 2026, POLITICO reported members of the European Parliament pressing for new liability rules, and quoted a Commission statement that "At this stage, there is no plan to reintroduce a proposal on AI liability."[11] For now, fault-based claims about AI harm in the EU run through national law, alongside the Product Liability Directive.

The UK relies on existing regulators

The UK has no AI-specific statute. The House of Commons Library's October 2026 briefing says AI "is regulated in the context in which it is used, through existing legal frameworks".[9] The 2023 white paper set five cross-sector principles for regulators, one of which is accountability and governance. It calls for governance measures with "clear lines of accountability established across the AI life cycle".[12]

A worked example: tracing one refund

This is a hypothetical example. It describes no real company, incident or system, and the allocation of responsibility is illustrative, not a legal finding.

A mid-sized online retailer selling in the EU deploys a customer-service agent built on a vendor's agent platform. The agent can look up orders and propose refunds. Refunds under €50 go through automatically. Larger ones wait in a queue for a customer-service lead to approve.

A customer asks to cancel a €140 order. The agent searches by surname, finds two customers with the same name, picks the wrong one and proposes cancelling and refunding that customer's order. The approval card shows the customer name, amount and reason, but not the order number or delivery address. The lead approves in seconds. The agent executes. A different customer's order is cancelled days before a birthday.

AI Chronicle

Tracing it through the map:

• The customer bought from the retailer, so the retailer apologises, restores the order and puts things right. Whether it can recover anything from the platform vendor depends on their contract.
• The system owner allowed the agent to identify orders by name search instead of exact order ID, and approved an approval card that hid the identifier. Both are configuration decisions.
• The approver decided on the information the screen gave them. The log shows what they saw, which is the evidence that the screen, not the person, was the weak point.
• The provider is involved only if its platform behaved contrary to its documentation, for example by executing against a different record than the one the agent selected.

The fixes follow the trace: an exact-ID lookup tool, an approval card that shows the order number and what will change, and a new test case for duplicate names. Our invoice-exception agent tutorial applies the same logic to accounts payable, where segregation of duties already demands it.

The controls that make responsibility traceable

Every share of responsibility above depends on evidence that someone can produce later. Four controls do most of the work.

Named owner. NIST asks that roles be documented and clear.[5] Our nine-step method for building a supervised agent ends with the same instruction: write down who owns the configuration, who approves and who can switch the agent off.

Permissions. Responsibility follows capability. An agent that cannot release a payment cannot wrongly release one. Set limits in the systems the agent connects to, not only in its instructions, and keep the register current as tools change.

Approval logs. A log that records only "approved" proves little. Record what the approver was shown, so a reviewer can later tell a careless decision from a misleading screen. This is the practical answer to the automation bias the AI Act names.[2]

Audit trail. The AI Act requires high-risk systems to "technically allow for the automatic recording of events (logs)" over their lifetime.[2] NIST describes transparency as reaching "how and when deployment, post-deployment, or end user decisions were made and by whom".[5] Records also matter in court. The Product Liability Directive lets courts order disclosure of relevant evidence and presume a product defective if the defendant fails to disclose it.[3] When an agent fails, the trail is what lets you diagnose which layer broke. Vendors who promise autonomy rarely show this layer; it is one of the things AI agent demos leave out.

Questions readers commonly ask

Does an "AI can make mistakes" notice move responsibility to the user?

Do not rely on one. In Moffatt, the tribunal asked why customers should have to double-check one part of a website against another.[1] The Product Liability Directive's recitals say warnings "cannot be considered sufficient to make an otherwise defective product safe".[3]

If a person approved the action, are they personally liable?

Usually the organisation answers externally. Internally, the approver answers for a decision they had the authority and information to make. The AI Act ties oversight to people with competence, training, authority and support.[2] Take legal advice on employment and professional rules in your jurisdiction.

Is the model provider liable when our agent gets something wrong?

Sometimes. Under the Product Liability Directive, a provider can be liable for defective software that injures a person or damages their property or non-professional data.[3] Most business losses fall outside it, so contracts and national law decide how costs split.

Does the EU AI Act apply to our agent?

It depends on what the agent is used for. High-risk duties attach to listed uses such as employment and credit, and apply from 2 December 2027 for those systems.[7] A business that repurposes a general-purpose system for a high-risk use can take on provider duties.[2]

Do we need ISO/IEC 42001 certification?

No law we cite requires it. It is a voluntary management system standard that organises policies, roles and continual improvement for AI.[6]

The next step

Accountability is only as good as your ability to explain what went wrong. Next, read why AI agents fail, and how to diagnose the failure, which turns an audit trail into a diagnosis.

About these sources

All pages were accessed on 16 October 2026. Legal sources are cited for what they state, not as legal advice; laws differ by jurisdiction and sector, and readers should consult a qualified lawyer. The retailer, refund agent, approval flow, failure and responsibility map are hypothetical and illustrative. AI Chronicle has not built or tested the system described.

Related reading

• AI agent vs. AI workflow: how to choose
• How to measure AI productivity without hiding review work