Agentic AI Liability Questions May Draw Regulatory Scrutiny

"There's clearly an important difference between asking an agent to draft an email and willingly giving it unfettered access to a corporate bank account or to your wallet," Raut said.

His proposed principle: "Liability should follow meaningful control at the stage of the transaction."

Existing laws address pieces of the problem. The Computer Fraud and Abuse Act may help determine when an automated system's access becomes unauthorized. It says less about whether an AI agent can bind its principal to a purchase, how merchants authenticate agents, or who absorbs losses when a system exceeds its intended authority.

That gap carries a cost. "If the laws that you have currently don't really address the issues about liability in multi-agent transactions, the cost is the uncertainty," Raut said. "Eventually you have to price in the uncertainty."

Raut expects lawmakers to pay closer attention once autonomous systems begin moving substantial sums and a major commercial dispute exposes the gaps in existing doctrine. The pressure for clearer rules, he said, may come from balance-sheet exposure rather than abstract concerns about AI.

Competition implications follow. If dominant platforms can restrict transactions to their own agents, autonomous commerce could reinforce existing digital ecosystems. Raut favors interoperability subject to technology-neutral security requirements, allowing platforms to prevent fraud without shutting out competing agents.

For businesses, the questions are becoming concrete. "Developers need to know what obligations attach to their systems," Raut said. "Employers need to know when they're responsible for an agent's conduct. Platforms need to know when they can block agents, and merchants need to know when an agent's transaction is binding."