AI Agent Liability: Six Regimes and One Governance Model

AI agent liability has stopped being a single question with a single answer, because six separate regimes now reach the same autonomous system, each of them carrying its own claimant and its own commencement date, so that an organisation managing only one of them stays exposed on the other five.

The AI Act allocates the roles of provider and deployer, Italian law No. 160 of 9 September 2026 has moved the burden of proof in civil proceedings, the new product rules bite on 9 December 2026, a German court has already treated artificial intelligence output as the operator’s own statement, and criminal liability together with corporate criminal liability underpins the whole structure.

In the matters I handle, the AI governance model determines the outcome long before anyone applies these regimes, because the organisations that run into difficulty are seldom those that chose the wrong supplier, and far more often those that cannot demonstrate who authorised the agent, what it could do and what it actually did, and did not perform a deep AI compliance assessment on the adoption of the AI agent and throughout its lifespan.

Six liability regimes now reach a single AI agent

An AI agent differs from a conventional model in the one respect that carries legal consequences, namely that it acts, pursuing an objective and moving between systems with little human intervention, it evolves, takes decisions and in case of difficulties it tries to overcome them, finding potential solution independently. That autonomy makes the causal chain harder to reconstruct, because it runs through decisions nobody recorded, and it turns human oversight into a function the company must evidence, with the proof of both sitting in logs that few organisations ever retained for legal purposes.

The six regimes, with the date that makes each of them operative, run as follows.

1. The allocation of roles under the AI Act, which catches the provider, and equally the deployer that becomes one through its own branding, a substantial modification or a change of intended purpose, with most high-risk obligations arriving on 2 December 2027.
2. Market surveillance, which catches provider and deployer alike through an inspection or a request for information, governed in Italy since 23 October 2026.
3. Civil liability in Italy, which catches any operator facing a claim for damage arising from the use of an artificial intelligence system, applicable since 30 September 2026.
4. Product liability, which catches the manufacturer and the whole supply chain where a defect affects a product placed on the market after 9 December 2026.
5. Liability for output, which catches the organisation publishing what the system says whenever that statement proves false or harmful, as one court has already held.
6. Criminal and corporate criminal liability, which catch individuals first and the company afterwards, wherever someone omits safety or oversight measures the law already requires.

I set out the operational version of this when I examined what happens when a company’s own AI agent is hacked, and the pattern repeated with the first AI agent data breach notification in Europe, where the difficulty lay in the missing record rather than in the agent.

AI agent liability starts with one decision: provider or deployer?

This is the provision I raise at the opening of every AI governance workshop, and it remains the one that organisations have thought about least.

Article 25 of the AI Act converts a deployer into a provider in three situations, namely where the deployer places its own name or trademark on a high-risk system already on the market, where it substantially modifies such a system, and, in the limb that catches agent projects most often, where it modifies the intended purpose of a system that was not high-risk, including a general-purpose artificial intelligence system, so that the system becomes high-risk.

That conversion operates completely rather than partially, because the original provider ceases to be the provider of that particular system and keeps only the duty to cooperate and to hand over the documentation the conformity assessment needs, unless it had clearly specified that nobody should turn its system into a high-risk one. This limitation on usage is often provided in terms that none actually reads and everyone ignores or overlooks.

An organisation therefore acquires the obligations of a provider by orchestrating a sound model into something the supplier never contemplated, which is exactly what an agent project does whenever it gives a general-purpose model credentials, tools and a role in a decision the law regulates. Article 25(4) then requires written agreements with the suppliers of every integrated component, covering the information, the technical access and the assistance that the new provider will need.

What Italian law changed about proof

Italian law No. 160 of 9 September 2026 has applied since 30 September 2026, rewrote the economics of this litigation, and the text is available here.

Disclosure sits in Article 17, which requires the court, on the application of a party alleging damage, to order the other party or a third party to produce the evidence specifically relevant to the functioning of the system, where the applicant has put forward facts that make the claim plausible, and without requiring that party to establish causation at that stage. The documents within reach include the event logs, the risk management documentation, the technical documentation and the information on the parameters of human oversight, subject to the protection of trade secrets, while a party that fails to produce them risks the court treating the facts alleged against it as admitted, and a third party refusing without justification faces a fine of between €1,500 and €10,000.

Article 18 establishes a presumption, so that where the damage results from the breach of an obligation under the AI Act, the court presumes the causal link between that breach and the damage, subject always to proof to the contrary.

Conformity comes next, under Article 19, which confirms that compliance with the AI Act, even certified compliance, does not of itself exclude the liability of the defendant.

Article 20 opens a direct action, letting the injured party ask whether liability cover exists, with a reply due within thirty days, and then sue the insurer directly within the limits of the policy, joining the party said to be liable as a necessary co-defendant.

The asymmetry nobody has priced

The point that follows has not, so far as I have seen, appeared elsewhere, and it changes what a company ought to do during the current quarter.

Article 17 operates generally, reaching any claim for damages, contractual or non and these provisions already apply even though the Digital Omnibus provisions on AI postponed most high-risk obligations to 2 December 2027 and 2 August 2028, a substantial proportion of the documents Article 17 reaches carry no obligation at all under the EU AI Act today, but they are required under Italian law.

The disclosure power therefore operates broadly right now, while the presumption it was designed to feed stays narrow and, for the moment, largely dormant, so that a claimant obtains logs and documentation on a standard of mere plausibility years before the standards against which a court will eventually read those documents take effect. Companies are building the record now, and they will have it read later against rules that did not exist when they wrote it.

The agent as a product, and as a publisher

Two further regimes treat an AI agent as something other than a service supplied under a contract.

The product layer arrives with Directive (EU) 2024/2853, which applies from 9 December 2026 to products placed on the market after that date, treats software and artificial intelligence as products however a supplier delivers them, and imposes strict and joint liability across a circle covering the manufacturer, anyone placing its name on the product, the maker of a defective component, importers and whoever substantially modifies the product outside the manufacturer’s control.

Two limitations decide whether that regime assists a given claimant, since only natural persons may sue and purely economic loss falls outside its scope, leaving a business damaged in its own operations with its contractual remedies, which is where companies will fight the great majority of their disputes about agents. I examined the product dimension of the same question in connected products under attack.

The publishing layer already operates, as the Munich Regional Court I showed in its decision of 28 May 2026 in case 26 O 869/26, when it restrained Google from repeating artificial intelligence summaries that had falsely associated two companies with scams, holding that the output constituted the provider’s own statement rather than third-party content, so that the hosting defences gave no protection. Evidence that readers follow those links in roughly one per cent of visits defeated the argument that users could check the cited sources, and I analysed the reasoning in Google AI Overviews liability. The lessons for anyone deploying an agent are that a disclaimer affords limited protection, that outputs naming identifiable companies or individuals carry the sharpest exposure, and that an output nobody can trace to a verifiable source might become, in law, the statement of whoever published it.

Criminal exposure, and the compliance model as the only defence

The criminal layer moves boards, for the straightforward reason that it names individuals rather than entities.

Italian law No. 160 of 9 September 2026 introduced Article 437-bis of the Criminal Code, punishing the omission of technical safety measures or of human oversight for high-risk artificial intelligence systems where a concrete danger arises, with a range of one to five years where the conduct endangers life or personal safety and of two to eight years where it endangers public safety or the security of the State, alongside a separate limb for outside actors who alter how a system works, and a reduced penalty for gross negligence.

The same law added that offence to the catalogue of predicate corporate criminal liability offences under Italian law No. 231 of 8 June 2001, at Article 25-vicies, with an exposure running from 600 to 1,000 units for Article 437-bis and from 200 to 700 units for the deepfake offence, alongside interdictive sanctions that reach the suspension of authorisations and exclusion from public contracts. The only defence available to the company is its compliance model, the so-called 231 model, which needs to be tailored on Italian law provisions, and then only where it has implemented that model effectively and supervises it independently, which means that a model drafted without reference to artificial intelligence risk will not answer an artificial intelligence offence, as I explained in AI criminal liability in Italy.

Who inspects, and how fast

Liability regimes produce claims over a period of years, whereas the regulatory layer produces a file within weeks, which is why it usually reaches a company first.

Italian law No. 179 of 7 October 2026, applicable since 23 October 2026, designates the national cybersecurity agency as market surveillance authority and single point of contact, with powers extending to inspections without prior notice, while the national digital agency accredits conformity assessment bodies as the notifying authority, and the central bank, the securities regulator, the insurance supervisor and the data protection authority keep the market surveillance role within their own sectors. I set out the practical consequences in the new Italian AI Act enforcement law.

Above that national structure sits the EU AI Office, which holds exclusive competence over artificial intelligence systems based on general-purpose models where the model and the system come from the same provider or undertaking, and which issued its first requests for information during October 2026, the mechanics of which I described in AI Act investigations.

The AI agent liability governance model

An AI governance model justifies its cost and the efforts to make it operational only where each element answers a specific regime rather than a general sense of risk, and mine has seven.

1. An inventory capturing embedded and shadow agents as well as declared ones, without which nobody can classify anything, and classification determines which obligations attach and which regulator takes an interest. Many clients still don’t know how their employees are using AI systems and sometimes which AI systems are used.
2. A written autonomy boundary for every agent, recording what it may do unattended, what needs approval and what it may never do, since that document answers both Article 437-bis and any oversight question under Article 17. An AI compliance assessment shall clearly set the rules of operation of an AI agent.
3. Human oversight vested in a named person who can stop the agent, because a regulator looks for real authority over the system rather than for a policy statement. Human oversight shall not be just a mere formal provisions in policies and procedures but shall be proved.
4. Legal sign-off under Article 25 before anything goes live, covering every change of purpose, every exercise of own-branding and every substantial modification, each capable of turning the organisation into a provider. This requirement requires an continuous monitoring of how an AI agent evolves.
5. Retention aligned to the longest applicable clock, given that logs, prompts, tool-call records, evaluations and risk assessments supply the evidence both in disclosure and in an inspection. This requirement shall be adequately balanced with data protection law obligations and limitations.
6. Supply contracts rewritten on documentation access, security, audit, incident information and cooperation in proceedings, with the written agreement Article 25(4) requires of every component supplier. A due diligence shall be performed not only with checklists but also through periodic audits.
7. A compliance model under Italian law no. 231 of 8 June 2001 addressing artificial intelligence risk, independently supervised and evidenced in its operation rather than its adoption. It is not a formal task, the model shall be updated and the updates shall be reflected in the operation of the business.

What follows is an opinion rather than settled law, with its risk stated openly. I expect the first Italian cases to turn on disclosure rather than on the merits, because Article 17 hands a claimant the documentation on a standard of plausibility, and the production stage is where defendants discover what they cannot explain. Courts may of course read necessity and proportionality strictly, and the dormant high-risk obligations may keep Article 18 out of play for years, although the conclusion survives either outcome, since the same records govern the regulatory file, the insurance position and the claim against the supplier.

What companies should do now

The steps below follow the deadline that drives them rather than the effort they require.

1. Set up an AI compliance organizational model which shall establish an AI committee in charge on assessing AI systems adopted by the company not only on the onboarding of the technology but also in relation to each use case and prescribing the rules of usage of AI systems by employees and officers.
2. Apply the Article 25 test to every agent in build, before anyone deploys it, because a change of intended purpose converts the organisation into a provider, and that conversion costs far less to avoid than to unwind.
3. Extend the retention of agent logs, prompts, tool-call records and evaluations without waiting, since disclosure has run since 30 September 2026 and deleted evidence is the one defect nobody can repair once proceedings begin.
4. Record the date on which the company placed each artificial intelligence enabled product on the market, before 9 December 2026, because the new rules reach only products placed on the market after that date, so two regimes will run in parallel and the date decides which applies.
5. Rewrite the 231 compliance model and integration contracts on documentation, audit and cooperation, given that the losses a business suffers fall outside the product rules, leaving the contract as the only route for a company that someone else’s agent has damaged.
6. Update the compliance 231 model so that it covers artificial intelligence risk, and evidence its implementation, because it remains the only defence to corporate criminal liability once a prosecutor establishes the offence.
7. Appoint, in writing, the committee/person responsible for stopping each agent, since courts and inspectors alike assess human oversight as a documented function rather than as an intention.

Most organisations begin with an assessment of their agents and the governance around them, a defined exercise that costs a fraction of reconstructing the same information under pressure.

If a claimant were to ask a court tomorrow to order the disclosure of everything that your most autonomous agent did last quarter, what would the production actually look like, and who within the organisation would be in a position to explain it?

When the Machine Decides is my weekly column on artificial intelligence law, published every Wednesday, in which each piece is anchored to a deadline that has already arrived and compared against how the same question is being resolved outside Europe.