AI, explained
Who is liable when an AI agent makes a mistake?
Courts have not accepted the software did it as a defence in forty years of computing, and they are not about to start now.
This is not a legal opinion, and the specifics vary by jurisdiction and by contract. But the commercial logic is consistent enough to plan around, and it starts with the fact that liability follows the customer relationship.
Three layers, in the order they get tested
- You, the deployer. You published the price, sent the message, made the booking, gave the advice. Your terms with the customer govern. If the agent quoted wrongly, the argument about whether a contract was formed turns on ordinary contract law, not on AI.
- Your builder or integrator. Whatever the professional services agreement says about warranties, defect remedies and liability caps. Read the cap. It is usually a multiple of fees, and it is usually far below the loss it would need to cover.
- The model provider. Their terms typically disclaim fitness for purpose, place responsibility for outputs on the customer, and cap liability tightly. Some now offer indemnities for third-party intellectual property claims arising from outputs, which is narrower than it first sounds and does not cover your agent being wrong.
Human-in-the-loop is a liability control, not a UX choice
Put an approval step wherever an error is expensive or irreversible: money moving, prices quoted, contracts issued, medical or legal content, anything sent to a regulator, anything that cannot be retracted. Then genuinely design the step so it can be exercised. An approval screen presented at a rate no human could actually read is worse than none, because it manufactures the appearance of oversight without the substance, and that is the first thing an opposing lawyer will probe.
What audit logs actually prove
Keep, at minimum: the input received, the retrieved context, the model version, the output produced, who approved it, and when. The value is that it converts an argument about what probably happened into a record. It lets you show the agent behaved as configured, or show precisely where it did not and when you caught it. Retain them long enough to outlive your complaint window, and remember that under GDPR these logs frequently contain personal data and need a lawful basis and a retention period like anything else.
What insurers ask
Professional indemnity and cyber policies were written before agents. Underwriters ask what decisions are automated, whether a human approves them, what the financial exposure per transaction is, whether you log, and what your incident response looks like. Tell your broker before deployment rather than after an incident, and get the answer in writing.
The practical checklist
- Cap the agent's authority in code, per transaction and per day.
- Disclose that customers are dealing with an automated system.
- Approval gates on anything irreversible.
- Immutable logs with the model version recorded.
- Terms that address automated quotes and errors explicitly.
- A named human owner for each agent.
Digiton designs these controls into the build rather than bolting them on. An AI audit covers the oversight model alongside the technical scope.
Frequently asked questions
Who is liable when an AI agent makes a mistake?
The deploying business almost always faces the customer first, because the customer contracted with you rather than with your model provider. Whether you can pass that loss to an integrator or vendor depends entirely on your contracts, and their liability caps are usually much lower than the exposure.
Does the model provider cover us?
Rarely in the way people expect. Provider terms generally place responsibility for outputs on the customer and cap liability tightly. Some offer indemnities for third-party intellectual property claims about generated content, which does not help when your agent simply gets a customer answer wrong.
Does human approval remove the risk?
It reduces it substantially and it changes the argument, but only if the review is real. A reviewer approving faster than the content could be read gives you the appearance of oversight without the substance. Design the throughput so approval is genuinely possible, and log who approved what.
Related
Ready to put AI to work?
Book a discovery audit and we will map the highest-ROI AI agents and automations for your business.
Book a discovery audit →