An AI agent cyber attack raises three questions that EU law now answers in three different places, namely which reporting duties are triggered and on what timetable, which liability regime governs the damage once it is done, and which documents a claimant can obtain before it has proved anything at all.
When your own company’s AI agent is hacked, who is liable for what happens next? This is a question I expect to hear much more often as companies give AI agents access to internal systems, business applications, customer data and, increasingly, the ability to take actions without a human approving every step.
On 24 July 2026, the Digital Omnibus on AI regulation was published on the Official Gazette introducing changes to the EU AI Act which mark a critical step in reshaping the regulatory framework for artificial intelligence under the Digital Omnibus package.
The European Parliament committees IMCO and LIBE have now formally supported the postponement of certain obligations under the EU AI Act, according to the latest official press release.
AI liability under the Defective Products Directive will fundamentally change the legal framework for software and artificial intelligence in the European Union from 9 December 2026. Directive (EU) 2024/2853 introduces a clear and disruptive principle: software and AI systems are products for the purposes of strict liability.
