AI Agent Liability: Courts Say You Pay, Insurers Step Back

Published: October 5, 2026 | Category: Technology | By Mahesh

AI agent liability used to be a conference-panel topic. In 2026 it became a billing question. A growing set of laws and regulators now say the same thing in different accents: the business that puts an agent to work owns what the agent does.^[1][2] At the same time, a growing number of insurers have started writing AI out of the policies that would normally pay for the damage.^[8] Those two movements are heading toward each other, and a company deploying agents stands exactly where they meet.

This piece closes a loop in the Depth Grid agent series. We have covered the protocol wars deciding the agentic web, the security flaws inside MCP, payments with no human present and the unsolved identity layer. Each of those answered how an agent acts. This one asks who carries the loss when it acts wrongly, and why the earlier layers turn out to be the evidence a court or an underwriter will ask to see.

Why the Agent Series Ends at a Courtroom

Follow any agent task far enough and it ends in somebody’s loss. A tool call deletes the wrong records. A purchase goes through at the wrong price while nobody is watching. A message from an agent convinces a customer of something untrue. The protocols we have tracked decide how those actions are carried out. They say nothing about who answers for them afterwards, and the legal system has been filling that silence with answers that look strikingly alike.

The common thread comes from old doctrine rather than new statute. A review of United States law by Baker McKenzie explains that a principal can be responsible for what its agent does within the scope of its authority. The law also separates actual authority, which the principal really granted, from apparent authority, which exists when the principal’s words or conduct lead an outsider to believe the agent was cleared to act.^[11] The review concludes that courts and regulators will mostly look to the humans and companies behind an AI agent.^[11]

Apparent authority deserves a second look from anyone building agents. If your agent introduces itself to a supplier as acting for your company, the supplier’s reasonable belief can matter more in a dispute than whatever your internal policy said the agent was allowed to do. Practice guides on Indian law make a blunter version of the same point: the country does not treat agentic AI systems as independent legal actors, so harm gets traced through contract, tort, product liability and consumer protection rules.^[13] The machine is never the defendant. A person or a company always is, and the live question is which one.

Three Decisions That Closed the “The Agent Did It” Escape Route

The earliest and smallest came from a Canadian tribunal in February 2024. A customer of Air Canada asked the airline’s website chatbot about bereavement fares and received guidance that its own policy did not support. When he claimed a refund on that basis, the airline argued, among other things, that the chatbot was a separate legal entity answerable for its own statements. The British Columbia Civil Resolution Tribunal rejected the argument and held the airline responsible for everything on its website, whether it came from a static page or a chatbot. It awarded damages of CA$650.88, and with interest and fees the bill came to CA$812.02.^[3]

The sum is tiny. The reasoning is not. Nobody needed an elaborate theory of machine agency, because the tribunal treated the chatbot as part of the company’s own shopfront. A small claims tribunal binds no court elsewhere, so read the case as a signal and not a rule. It remains the argument regulators have been repeating ever since.

California then turned the instinct into statute. AB 316 was approved on 13 October 2025 and added Section 1714.46 to the state’s Civil Code. From 1 January 2026, a defendant who developed, modified or used artificial intelligence that allegedly harmed someone cannot argue that the AI caused the harm autonomously.^[1] The wording rewards a close read. The law does not make a defendant automatically liable and it leaves other defences open, including arguments about causation and foreseeability.^[1] What it removes is the cheapest defence of all, the shrug.

Britain reached a similar place through consumer law. The Competition and Markets Authority published guidance on 9 March 2026 saying the rules are identical whether a customer deals with a person or an agent. A business answers for its agent as it would for an employee, even when a third party designed or supplied the technology.^[2] The guidance also sets a managerial bar. Businesses are expected to test agents, to have an experienced person monitor results and complaints and to fix problems quickly by changing prompts or workflows.^[2] In plain terms the regulator wants you to supervise an agent the way you would supervise a new hire who works at enormous speed and has no instinct for edge cases.

One caveat belongs here. None of these three tests the scenario that worries engineers most, a chain of agents from different companies calling each other’s tools with a loss surfacing at the far end. In the sources reviewed for this piece I found no reported court decision that deals with that situation directly. The principle looks settled for one deployer and one agent. For the chain it is still being written.

Europe Dropped One Law and Sharpened Another

Europe’s story has a twist. The European Commission proposed an AI Liability Directive in 2022 to make fault-based claims easier for people harmed by AI systems. Its 2025 work programme listed the proposal for withdrawal because no agreement was in sight, and the withdrawal notice appeared in the Official Journal on 6 October 2025.^[5] Anyone who read that as Europe going quiet on AI liability read it wrongly.

The real change sits in a different law. The revised Product Liability Directive, Directive (EU) 2024/2853, treats software as a product and counts AI systems within that. It keeps the no-fault principle, so a victim need not prove negligence, only a defect and its link to the damage. Member states must write it into national law by 9 December 2026.^[6] The directive also creates presumptions in defined circumstances, including when a defendant fails to disclose evidence and when technical complexity makes proof unreasonably hard for the victim.^[6]

Read those two features together. An agent assembled from a model, a toolchain and several third-party servers is about as technically complex as software gets. In a dispute, the party that cannot produce logs and documentation is the party a presumption will fall on. Strict liability aims first at the producer, which usually means the model or agent vendor, while consumer and agency rules aim at the deployer. A company can therefore be pulled in from one direction and have to claw its money back from the other, which works only if the contract allows it. Heavy customisation adds a further wrinkle, because a deployer that substantially modifies a system may start to look like a producer. Counsel should answer that question before a claimant does.

Singapore and India: Accountability by Guidance Rather Than Statute

The Infocomm Media Development Authority of Singapore launched its Model AI Governance Framework for Agentic AI on 22 January 2026 at the World Economic Forum, and it is the clearest practical statement of what “accountable” should mean. The framework rests on four dimensions: bound the risks up front, make humans meaningfully accountable, put technical controls in place and enable end-user responsibility.^[4] The accountability section is unusually specific. It asks organisations to define checkpoints where a human must approve an action, to enforce those approvals through system controls rather than instructions buried in a prompt and to test whether oversight works by tracking override rates and response times.^[4] It also warns about automation bias, the habit of approving whatever an automated system proposes.

The framework redraws the value chain as well, separating model developers and agent providers from the hosts of external MCP servers or tools.^[4] After our report on the security flaws inside MCP, that separation reads as a warning. Once the host of a tool is a named link in the accountability chain, “we only used a third-party server” stops working as an answer.

India has taken the lightest route. The Ministry of Electronics and Information Technology released its AI Governance Guidelines on 5 November 2025. They are voluntary and they recommend no standalone AI statute. They propose a graded liability model in which responsibility scales with a party’s role, the risk involved and the due diligence it exercised, and they flag the IT Act, including its safe-harbour provisions, as a candidate for amendment.^[10] A government release in December 2025 repeated that a new horizontal AI law is not needed at this stage.^[10]

For an Indian startup or IT services firm, the quiet at home is no shelter. Many of the agents built here run for clients in California, Britain or the EU, and those clients will pass their exposure back through contract terms. That is an inference from how outsourcing deals usually work and not a quotation from any statute, but it is the safest planning assumption: expect to be held to the strictest rulebook among your customers.

Red marks a binding legal exposure. Sources: California Legislature; UK CMA; EUR-Lex; IMDA; MeitY.^{[1][2][6][4][10]}

The Insurance Retreat Nobody Priced In

If the law says the deployer pays, the natural next question is whether insurance pays on the deployer’s behalf. That is where the picture turns uncomfortable. Verisk, whose Insurance Services Office writes standard policy wording that American carriers widely use, published three optional generative AI exclusion endorsements with a January 2026 edition date. They carry the form numbers CG 40 47, CG 40 48 and CG 35 08.^[9] Between them they give an insurer ready-made language to strip generative AI losses out of a commercial general liability policy.

Carriers have been using them. A CSIS analysis counts more than 60 property and casualty providers that filed AI exclusions in 2026 and names Berkshire Hathaway, Chubb, Travelers, AIG, Tokio Marine, W. R. Berkley, Great American and Fairfax among them.^[8] The Berkley endorsement is the sweeping one, barring coverage for any claim involving any actual or alleged use of AI.^[8] AIG said it has no current plan to apply its exclusion but has secured the regulatory option to do so.^[8] The same analysis reports that Verisk confirmed on 10 July that it was drafting exclusions aimed at agentic AI, eleven days before OpenAI disclosed that its test agents had breached Hugging Face.^[8] Our latest report on OpenAI’s review of what its agents did on their own shows why underwriters are nervous.

There is a counter-current. HSB, part of Munich Re, introduced an AI liability product for small and medium businesses on 18 March 2026. It is designed to pay for bodily injury, property damage and personal or advertising injury claims linked to AI, which some general liability policies exclude, and it reaches customers through partner carriers pending regulatory approval rather than direct sales.^[7] HSB’s own survey found that 74 percent of small and medium businesses already use AI and 91 percent plan to.^[7] The market is splitting. General policies are narrowing while specialist cover is starting to appear.

Look at what each side of that split covers before feeling reassured. The HSB product, as described, centres on injury, damage and content claims. It says little about the loss most agent builders actually fear, an agent that moves money wrongly, leaks data or commits the company to something it should not. Those risks tend to sit under cyber and professional policies, and the Berkley wording shows how wide an exclusion can be drawn. Our guide to cyber insurance for small businesses explains how those policies are structured.

None of these exclusions applies automatically. They arrive as endorsements, and many show up at renewal, which makes the next renewal the moment to read the wording. The practical result for anyone running agents is retained risk. The law has placed the liability on you, while a growing part of the insurance market has stepped away from carrying it.

Where the Earlier Layers Turn Into Evidence

Here the series comes together, because every layer we have covered leaves a trail that a lawyer or an underwriter will want. Agent identity is the strongest example. The unsolved part we described, proving which agent acted and on whose authority, is the same fact a court needs when it asks whether apparent authority existed. A signed delegation record stating what the agent could and could not do is more than a security control. It is the document that decides who the counterparty was entitled to rely on.

Payments work the same way. The protocols behind agents that buy with no human present are built around signed records of what was authorised, and in a chargeback or consumer dispute that record separates an approved purchase from an agent’s error. At the tool layer, logs of which servers an agent called and with what permissions help locate a defect inside a chain, which is the exercise that both the EU presumptions and Singapore’s value chain mapping reward. The National Cybersecurity Center of Excellence at NIST opened a project on agent identity and authorisation in February 2026, a sign that US standards work treats these records as shared infrastructure rather than a vendor feature.^[12]

Logs cut both ways, and honest advice should say so. A detailed record proves diligence, but it also proves what the company knew and when. The OpenAI review is a reminder that the timeline of discovery and disclosure can become the headline. Keeping good records is still better than having none, particularly under a regime where missing evidence can tilt a presumption. It works best alongside a clear retention policy and legal advice on what gets kept.

What This Means If You Deploy Agents

Give every agent a named human owner. Not a team and not a shared mailbox. Pick a person whose job includes reading the agent’s incident log and who can switch it off. The CMA’s employee comparison and Singapore’s accountability dimension both assume someone like this exists.^[2][4]

Read your policies before the renewal date and not after a claim. Ask your broker three direct questions. Does any policy carry a generative or agentic AI exclusion, whether an ISO form or the carrier’s own wording? Would a loss caused by an agent acting inside your systems fall under cyber, professional or general liability? Is any specialist AI cover worth pricing? Get the answers in writing.

Treat vendor contracts as a recovery tool and not an escape hatch. Because the UK regulator says responsibility stays with the deployer even when someone else built the agent, a vendor clause will not protect you from your own customer.^[2] It can help you recover afterwards. Look for indemnities that cover agent behaviour, rights to export logs, notice duties after an incident and clarity on who counts as the producer if you customise the system.

Put human checkpoints where the money and the risk are, then measure them. Singapore’s idea of counting override rates is the useful one.^[4] If reviewers approve nearly everything within seconds, you have a paper control. Choose the few actions with real consequence, such as payments above a set limit, deletions and external commitments, and require approvals that the system itself enforces. Chip-level controls such as Nvidia’s agent safety platform can help enforce limits, though analysts quoted in our coverage say such tools address only a minority of enterprise agent security problems.

Indian teams should plan to the strictest client. A founder in Bengaluru or Pune building agents for a customer in London or California inherits that customer’s rulebook through the contract. Draft your own terms with that in mind and keep the evidence trail from the first deployment.

None of this is an argument for stopping agent deployment. Companies that understand the exposure can price it and design around it. The ones in trouble will be those who discover the gap between the law and their insurance only after a claim lands. Four dates are worth watching: the EU product liability deadline on 9 December 2026, any move by AIG to activate its exclusion, a final Verisk form for agentic AI and the first court ruling on a chain of agents.

Common Questions

Who is liable when an AI agent makes a mistake?

In the jurisdictions reviewed, the business that deploys the agent carries the main exposure. California bars defendants from arguing that AI caused harm autonomously, and the UK regulator says a business answers for its agent as it would for an employee. The AI vendor can face separate claims too, because the revised EU Product Liability Directive brings strict liability to software and AI systems from December 2026.

Can a company blame its AI vendor for an agent's mistake?

Not as a defence against the customer. The UK Competition and Markets Authority says responsibility stays with the business using the agent even where a third party designed or supplied it. A vendor contract can still help the business recover money afterwards, so indemnity clauses, log access and incident notice terms matter.

Does insurance cover AI agent mistakes in 2026?

It depends on the policy and the renewal date. Verisk's ISO published optional generative AI exclusion endorsements in January 2026 and more than 60 US insurers have filed AI exclusions, according to CSIS. Specialist cover is also appearing, such as the HSB product launched in March 2026 for small and medium businesses. Ask your broker in writing what your current wording excludes.

Is there an AI liability law in India?

No. India has no standalone AI statute. The MeitY AI Governance Guidelines of November 2025 are voluntary and propose a graded liability model, while existing contract, tort, consumer protection and IT Act rules apply today. India does not treat agentic AI systems as independent legal actors.

What does California AB 316 do?

AB 316 added Section 1714.46 to the California Civil Code and took effect on 1 January 2026. A defendant who developed, modified or used AI that allegedly caused harm cannot argue that the AI acted autonomously. Other defences, including causation and foreseeability, remain available.

What happened to the EU AI Liability Directive?

The European Commission proposed it in 2022 and listed it for withdrawal in its 2025 work programme, citing no foreseeable agreement. The withdrawal was published in the Official Journal on 6 October 2025. The revised Product Liability Directive, which covers software and AI and must be transposed by 9 December 2026, now carries most of the weight.

This analysis is editorial commentary based on the public sources listed below. It is not legal, insurance or investment advice. Laws, guidance and policy wording change often, so confirm current requirements with qualified counsel and your insurance broker before acting.

Sources

1. California Legislature, AB 316 (Krell), "Artificial intelligence: defenses," Chapter 672, Statutes of 2025, approved October 13, 2025. Link
2. UK Competition and Markets Authority, "Complying with consumer law when using AI agents," March 9, 2026. Link
3. American Bar Association, Business Law Today, "BC Tribunal Confirms Companies Remain Liable for Information Provided by AI Chatbot," February 2024. Link
4. Infocomm Media Development Authority of Singapore, "Model AI Governance Framework for Agentic AI," January 2026. Link
5. European Parliament Legislative Train, "AI liability directive," withdrawal published in the Official Journal C/2025/5423, October 6, 2025. Link
6. European Union, Directive (EU) 2024/2853 on liability for defective products, EUR-Lex. Link
7. HSB, "HSB Introduces AI Liability Insurance for Small Businesses," March 18, 2026. Link
8. Center for Strategic and International Studies, "The Insurance Industry’s Retreat from AI Threatens to Slow Innovation and Adoption," 2026. Link
9. Independent Insurance Agents and Brokers of America, "Verisk to Roll Out New General Liability Exclusions for Generative AI Exposures," October 2025. Link
10. Ministry of Electronics and Information Technology and Press Information Bureau, "India AI Governance Guidelines," November 5, 2025, and PIB release of December 19, 2025. Link
11. Baker McKenzie, "United States: Legal Accountability for AI Agents," June 2026. Link
12. NIST National Cybersecurity Center of Excellence, "Accelerating the Adoption of Software and AI Agent Identity and Authorization," February 2026. Link
13. Chambers and Partners, "Artificial Intelligence 2026: India, Trends and Developments," 2026. Link

Read More on Depth Grid

• AI Agent Identity: The Unsolved Layer
• OpenAI Is Still Counting What Its AI Agents Did on Their Own
• Nvidia Open Agent Safety Platform: What It Covers
• AI Agents Can Now Buy Things With No Human
• OpenAI Shelved a Model for Lying, Then Built Agents on the Old One

Article by Mahesh | Depth Grid