Spotlight on Agentic AI | Liability

Many organisations are grappling with how best to integrate agentic AI into their business workflows, with a key driver being the capacity of this technology to increase efficiency and reduce costs. A classic example is a customer-facing business using an agentic AI agent in a customer support function. As well as being able to review and triage customer queries, the real benefit of agentic AI is that an AI agent has the ability to take actions – in this case that could include refunds, ordering replacement items or amending customer account details. But what redress does a company have against its AI supplier if the AI agent does something wrong or does not perform these tasks as expected? 

This article considers common liability issues arising from agentic AI contracts. 

What obligations does your agentic AI supplier have in respect of the AI? 

In our experience, many AI projects are contracted for using pre-existing standard IT and SaaS contracts with terms governing agentic AI merely bolted on. Even where a new contract is negotiated, suppliers are often using standard IT/SaaS contracts as a starting point. The challenge for agentic liability is that those terms do not reflect the significant task expansion of the AI agent, which will often access more data, integrate across systems and work autonomously with limited oversight in ways that are very different from traditional software.

The Supply of Goods and Services Act 1982 implies into agentic AI contracts a term that the supplier will carry out that service with reasonable care and skill. This implied term does not guarantee that an AI agent’s output or conduct meets any quality or accuracy threshold. Rather, a supplier complies by demonstrating it has applied reasonable care and skill in the development of the agentic AI, measured against the prevailing industry standard (more below).

Statutory implied terms are often explicitly excluded in the contract and replaced with an alternative express quality term, for example a requirement to provide the services in accordance with good industry practice. This term will often be defined in the contract but generally means the level of skill, care, diligence and technical competence that a reasonably capable and responsible organisation in the relevant industry would be expected to exercise under similar circumstances. 

Good industry practice is dynamic: the standard evolves in line with technology advances and expectations. While there remains a lack of broadly-accepted norms or governing standards for agentic AI, we suggest this might include: testing for hallucinations before deployment; implementing safeguards against harmful outputs and behaviours; incremental deployment, beginning with tightly restricted agents undertaking clearly defined tasks; detecting and logging incidents and retraining or updating the model; and documenting known limitations for users. 

As with reasonable care and skill, good industry practice focuses on how the supplier develops and implements the AI agent. It is unlikely to extend to ensuring that an AI agent’s output or conduct is error-free or even that it hits certain accuracy thresholds, given the known issues with AI accuracy.

Given there is an acceptance in the industry that AI (and agentic AI specifically) presents a level of inaccuracy and hallucination risk, suppliers are usually not prepared to give any additional guarantee of quality and/or accuracy of an agentic AI’s outputs, conduct or behaviour. More typically, agentic AI contracts contain specific exclusions which place responsibility for the risks associated with the output firmly on the customer (as below).

While typical indemnities found in IT contracts, most commonly for IP-related claims, are found in agentic AI contracts, they are often heavily caveated and cover specific issues (such as IP infringement) rather than broader loss or damage perpetrated by the agent, such as loss of use, data exfiltration, cyber breach, reputational damage and other agentic failure risks.

What restrictions or exclusions may apply to your agentic AI supplier’s obligations? 

To account for the risks associated with agentic AI, the contract is very likely to contain broadly drafted exclusions on the supplier’s liability for inaccurate or unexpected AI outputs and erroneous actions carried out by an AI agent.

The contract will also typically contain obligations on the customer in relation to the AI agent including:

The limited scope of the AI supplier’s obligations, combined with the above express exclusions and customer obligations, greatly restrict the ability of a customer to seek any meaningful redress against its AI supplier. If the supplier has followed defensible processes in the development and ongoing maintenance of the agentic AI, it is very difficult to demonstrate any breach arising from AI agents. Even if the supplier was found not to have met the required contractual standard (for example, by inadequately training the AI agent before deployment), the customer must still prove that the breach caused the AI agent to act in a particular way causing the loss. This may be difficult to show given that AI systems will not necessarily behave the same way twice. 

This leaves the customer shouldering the risk of unexpected or incorrect agentic conduct, which may be lower in the context of low-autonomy agents handing back regularly to human users where “no reliance” and “human oversight” terms still hold up. However, where autonomy increases and those checkpoints no longer exist, it is unclear how the courts might interpret and enforce this type of risk model, particularly in light of their reluctance to construe a contract in such a way as to reduce a party's core obligation to a "mere declaration of intent". 

How can customers mitigate against this risk when contracting for agentic AI? 

Previously in this series we have discussed the need for customers to identify the particular risks arising from the use of agentic AI and to define clear guardrails on the tasks that AI agents should undertake.

Key ways to manage the liability risk on customers in the supplier contract itself include: 

These contractual mitigation steps can necessarily only go so far, in which case understanding the scope of the AI agents' authority in your business and putting in place appropriate safeguards to enforce this will be critical in managing agentic AI liability risk.