Fast Company Middle East asked a useful question on October 15: "AI agents need a boss. So, who should that be?" Its answer makes operational sense: defined ownership, controls that tighten as consequences rise, continuing review, and records of human intervention.
The question I keep running into follows from that one. When an agent gets it wrong, who answers for it, who is liable, and who pays?
I came to the article with four positions:
1. No company can divest AI risk.
2. Companies will not push AI risk down to individual contributors.
3. Executive responsibility remains.
4. Individual liability doesn't belong in an AI policy.
I tested each against the case law, statutes and enforcement record. None survived exactly as I'd have said it. The biggest correction was to the second.
One caveat applies to everything below. The cases I discuss involve chatbots, screening tools, professional filings and corporate oversight. They don't resolve how liability applies to an autonomous agent acting across systems through multiple tools. I think their reasoning informs that analysis, but applying it to a real deployment means examining the system, the people involved and the claim.
First, three questions that get blurred
Summarizing Optro's Guru Sethupathy, the article says an employee using an agent remains responsible for its decisions and output. That could mean following instructions, reviewing a decision, or paying a judgment. Those are different assignments.
Accountability identifies who must act inside the company: configure permissions, approve a use, investigate a failure, stop deployment.
Liability determines who can be held legally responsible. That depends on the claim, the jurisdiction, and each person's duties and conduct.
Payment concerns who ultimately covers the defense or the loss. Indemnification, insurance, contracts and statute can produce a different answer than liability does.
A company assigns internal duties, negotiates some financial protection, and stays subject to the law governing its conduct. My original positions blurred those three.
Belief 1: No company can divest AI risk
Verdict: legal obligations stay with the company. Some of the bill can move.
Buying a vendor's system or naming an employee as its owner doesn't discharge the company's duties. Indemnities and insurance can shift part of the cost. They don't shift the duty.
The deployer stays responsible. In Moffatt v. Air Canada, 2024 BCCRT 149, the British Columbia Civil Resolution Tribunal held the airline liable for negligent misrepresentation after its website chatbot gave a customer wrong information, and rejected the argument that the chatbot was responsible for its own statements. It's one small-claims decision in one province, but it shows how a decision-maker treats the "the AI did it" defense (discussion of the decision).
EU law writes the duty the same way. EU AI Act Article 26 puts oversight and log-retention duties for high-risk systems on the deployer, from December 2, 2027 for Annex III systems and August 2, 2028 for the relevant Annex I product systems (Article 26, Commission update).
The law looks past the software to the people using it. The Restatement (Third) of Agency, an influential summary of U.S. common law, says a computer program can't be a principal or an agent, and treats programs, "at present," as instrumentalities of the people who use them (§ 1.04 cmt. e, as quoted in Kolt, "Governing AI Agents"). Ian Ayres and Jack Balkin argue that the law should hold the people and organizations that design, deploy and use AI to objective standards (essay). Moffatt is a separate Canadian decision. My inference is that all three point the same way: responsibility gets traced to the organization behind the system.
Vendors can be added, not substituted. In Mobley v. Workday, 740 F. Supp. 3d 796 (N.D. Cal. 2024), Judge Rita Lin allowed disparate-impact claims under Title VII, the ADEA and the ADA to proceed on allegations that employers delegated a traditional hiring function to Workday's screening tools, making Workday, the company, their agent (July 2024 order). That was a ruling on the sufficiency of the allegations, not a finding of discrimination, and the court dismissed the intentional-discrimination claims. Workday was the only defendant; the employers weren't parties. The court reasoned that if a vendor performing a delegated hiring function couldn't be liable as the employer's agent, companies could escape liability by handing hiring to someone else, including AI. The ruling added a potentially liable party. It decided nothing about the employers. In healthcare, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity is generally a business associate, directly liable under the applicable HIPAA rules (HHS guidance).
Read vendor indemnities against the claim and the deployment. An intellectual-property indemnity may provide no protection at all for an erroneous payment, a discriminatory decision or an unauthorized disclosure. Modification and combination exclusions can also matter when an agent connects models, tools and customer data. Check what triggers the indemnity, which exclusions apply, and whether a liability cap limits recovery. Ordinary use of an integration doesn't, by itself, mean protection is lost.
None of this makes a deploying company liable for every harmful output. A claimant still needs a cause of action and has to prove it.
My revised position: identify the company's duties first. Then sort out which obligations vendors share and which costs contracts or insurance can actually cover.
Belief 2: Companies will not push AI risk down to individual contributors
Verdict: payment protections don't prevent employees from being blamed. Employment protections are a separate analysis.
Employees can be personally liable. A corporate role doesn't immunize anyone from their own torts. In Frances T. v. Village Green Owners Association, 42 Cal. 3d 490 (1986), the California Supreme Court held that corporate directors aren't liable for the corporation's torts merely because of their position, but can be personally liable for torts they participate in or direct, because agents are liable for their own acts. The case involved directors, and it reaches other employees through the same agency principle, with the same limits: the employee must owe the injured person a duty, and California narrows an agent's personal liability for purely economic loss. A personal negligence claim still needs a duty and the other elements (opinion).
Other sources of individual exposure were here before AI:
• Professional duties. In Mata v. Avianca, 678 F. Supp. 3d 443 (S.D.N.Y. 2023), the court sanctioned two lawyers and their firm $5,000, jointly and severally, after ChatGPT-generated citations to nonexistent cases reached a filing and the lawyers kept standing behind them once questioned. Other licensed professions have their own versions. Sanctions opinion
• Statutes that reach individuals. HIPAA's criminal provision expressly covers employees and other individuals who knowingly obtain or disclose individually identifiable health information maintained by a covered entity without authorization. A policy violation alone doesn't make a crime. 42 U.S.C. § 1320d-6
• Intentional misconduct. Directing an agent to commit fraud is the person's own act.
Payment is a separate question, and it's where my instinct had legal support. California Labor Code § 2802 requires employers to indemnify employees for necessary losses incurred in doing their jobs or following directions, except directions the employee believed unlawful. Section 2804 voids waivers. Neither erases the employee's liability to the person harmed, and neither bars every claim by the employer: Labor Code § 2865 makes an employee guilty of a culpable degree of negligence liable to the employer for the resulting damage. § 2802, § 2804
California also generally bars wage deductions for ordinary losses from mistakes or simple negligence, and the Labor Commissioner cautions employers about relying on even the narrow exception for dishonest, willful or grossly negligent acts (Labor Commissioner guidance).
California's protection is unusually strong. Other states' rules differ, and some offer much less. Check the state's law before assuming the same answer.
Those rules answer the money question. They don't, by themselves, decide whether discipline, termination or a license complaint is lawful. Whistleblower, anti-retaliation, contractual and other protections can limit some adverse actions, but none of them protects against unfair blame in general. Being the name on the approval when the output goes wrong carries consequences no reimbursement statute reaches. Madeleine Clare Elish calls this the "moral crumple zone": responsibility for an automated system's failure landing on a human who had limited control over it.
A required human review doesn't discharge the company's duties. In a civil claim, an employee's conduct within the scope of employment may also expose the employer under applicable vicarious-liability rules. What a thin review step can do is move blame inside the company: the reviewer becomes the explanation for a failure the design made likely. If a review requirement can't realistically be performed at the volume the workflow demands, it protects nobody.
My revised position: employee liability, reimbursement rights and employment consequences each need their own analysis. A policy can assign duties fairly and still leave someone exposed. I can't tell you how often companies push blame down; the law only tells you where that's limited and where it isn't. Calling someone an owner doesn't protect them.
Belief 3: Executive responsibility remains
Verdict: held as organizational accountability. Personal exposure follows what the executive built, knew, and did next.
In In re McDonald's Corporation Stockholder Derivative Litigation (Del. Ch. 2023), denying a motion to dismiss, the Court of Chancery held that officers owe oversight duties within their areas, with the CEO's covering the whole company. Liability requires bad faith. The court described the duty as covering both a good-faith effort to put reporting systems in place and a response to red flags, but the claim before it was a red-flags claim. The case didn't test whether an officer can be liable for failing to build reporting systems.
The FTC's Drizly consent order (January 2023) shows another path. For 10 years, CEO James Cory Rellas must ensure an information security program at any business that collects, uses, discloses or stores the order's defined consumer information for 25,000 or more consumers where he is majority owner, CEO or a senior officer with responsibility for information security. The FTC alleged he had been warned of security problems after an earlier incident. It's one enforcement matter, not a rule for AI executives, but the template is easy to see.
Concealment is its own risk. Former Uber CSO Joe Sullivan's convictions for obstruction and misprision of a felony were affirmed by the Ninth Circuit in March 2025, and the Supreme Court denied review on June 29, 2026. Docket
Some regimes don't require conscious wrongdoing at all. Under United States v. Park, an officer's responsibility and authority to prevent or promptly correct an FDCA violation can support misdemeanor liability without proof of knowledge or intent, subject to a defense that the officer was powerless to prevent it. Relevant for AI in FDA-regulated operations.
Enforcement theories have limits too. In July 2024, the court dismissed most of the SEC's claims against SolarWinds and its CISO. In November 2025, the SEC dismissed the rest with prejudice, stating that the decision doesn't necessarily reflect its position on any other case (SEC release). Being named and being held liable are different events.
My revised position: executive accountability covers the conditions for deployment, the adequacy of oversight, and the response to serious problems. It comes with a fairness requirement. The executive needs budget, information, escalation rights and authority to suspend use. Without them, the title is a scapegoat in waiting, which is how many in the security community read the Sullivan case. The Record
Belief 4: Individual liability doesn't belong in an AI policy
Verdict: half right. Liability isn't the policy's to assign. Duties are, and breaching them has real consequences.
An internal designation doesn't transfer the company's statutory duties or decide liability to third parties. Policies still matter legally. They document commitments, assigned responsibilities and knowledge, and whether the organization followed its own controls. A policy is evidence of the standard the company set for itself. Its legal significance depends on the claim; an internal rule doesn't automatically establish the legal standard of care.
A clause making employees responsible for "all AI-related losses" can collide with indemnification and reimbursement rights where they apply, and it leaves every operational question unanswered.
Useful provisions say:
• Which agents and uses require approval and registration.
• What each owner or reviewer must do.
• What evidence must be available for review.
• When errors, unauthorized activity and control failures must be reported.
• Who can suspend deployment.
• What disciplinary process applies, consistent with applicable law.
• Which professional obligations continue to apply.
An attestation records a representation that review happened. Its value depends on the review actually performed. Requiring an impossible review can become evidence that the company's stated control didn't operate as described.
A starting clause:
AI accountability. [Company] retains its obligations under applicable law for its development, deployment and use of AI systems. Each deployed agent must have a designated Agent Owner responsible for its registration, approved configuration, permissions, monitoring and change management. The Process Owner is responsible for the workflow's required reviews, approvals and escalation procedures. [Designated executive] is responsible for enterprise AI governance and has authority to suspend deployment or require corrective action. [Company] will provide the authority, information, training and resources reasonably necessary to perform assigned duties.
Personnel must follow the duties assigned to their roles, complete required training, and promptly report suspected errors, unauthorized activity and control failures. When a required pre-action review cannot be completed, the affected action must remain on hold and be escalated. Violations may result in discipline, consistent with applicable law. This policy does not waive indemnification or reimbursement rights provided by applicable law or binding agreements.
Adapt it to the organization and jurisdiction, and pair it with procedures people can actually perform.
What to build so accountability works
The test for any assignment: can the named person see the relevant activity, get help, and act within the authority they were given? When the answer is no, the fix is a documented decision to supply the missing control, restrict the use, or suspend the agent. Handing the agent to someone more senior counts only if that person can close the gap. An executive title doesn't create missing logs, vendor notice or a working kill switch.
1. Keep an agent register. Owner, purpose, workflow, tools, data access, permissions, operating limits. Define which changes require renewed approval. Then look for the agents nobody registered: review the admin and audit tools of every platform that lets employees build or connect agents, and make registration easy enough that people use it.
2. Preserve attribution. Identify the agent or application, the user where relevant, and the authorization behind consequential actions. Delegated access can be appropriate. The logs should still distinguish what the software did from what a person did.
3. Set controls by consequence. Payment limits, restricted recipients, staged execution, approval before consequential actions.
4. Make review feasible. Define what reviewers verify and what evidence they get. Test it at expected volume. If it can't be performed, change the staffing, the workflow or the autonomy.
5. Assign suspension authority and test it. Include a route for when the owner is unavailable.
6. Plan for turnover. Reassign ownership within a set period or suspend the deployment.
7. Check contracts and insurance against actual uses. Change notice, logs, assurance, incidents, data use, indemnification, and business associate agreements where required. Coverage depends on the actual policy and claim.
Questions I'd keep testing
How should leadership separate ordinary alerts from serious warnings? Monitoring creates a record of what the organization detected and how it responded. The useful work is setting escalation thresholds, documenting decisions, and making sure serious issues reach someone with authority. Deliberately not looking creates its own oversight risk.
When does review stop being a control? At some volume, a human approving agent output is checking boxes. Where is that line, and who is responsible for noticing the workflow crossed it?
How should duties change when an employee builds or materially changes an agent? Someone choosing tools, permissions, data sources or release conditions needs duties tied to those choices, along with testing requirements and approval limits. Licensed professionals also keep their applicable professional obligations. Each assignment should match the person's actual work, authority, training and access to information.
If you've assigned an employee ownership of an agent, compare the policy with that person's permissions, review workload and suspension authority. The gaps between them are where I'd start.
Current as of October 29, 2026. General information, not legal advice. Laws and their application vary by jurisdiction and facts.