Autonomous AI Agents Present New Challenges for Legal Accountability
AI is being deployed for an ever-wider range of activities that had traditionally been carried out under the direct supervision of a human operator. Autonomous AI agents can take in information and make decisions, initiate financial transactions, interact with software applications and operate systems either in the digital or physical worlds. If an AI agent causes harm, transfers money without authorisation or crashes a car, who is responsible?
Unlike traditional software designed for a restricted, determined series of instructions, autonomous AI agents choose actions, interact with external tools, and react to their environments with a small degree of human intervention or input. A faulty finance AI might misallocate a transaction, while an AI machine might cause physical damage if it misinterprets inputs.
The key legal issue is to decide on who should be liable – the developer who built the system, the agency that used it, the individual who activated it or a supervision body. What the law says is that the liability would be based on fault, contractual duties, product liability, authorisation, and the link between an individual’s behaviour and the harm.
India doesn’t currently have one overarching law for separate liability system for each kind of autonomous AI. Existing laws relating to contracts, consumer protection, negligence, criminal offences, data protection and financial services may be relevant in certain situations. The Ministry of Electronics and Information Technology issued India’s AI Governance Guidelines in February 2026, which highlight liability and accountability in the AI value chain as topics for additional regulation. (Ministry of Electronics and Information Technology, Government of India)
Is an AI Agent Liable?
Currently, Indian laws do not recognize AI agents as autonomous entities or legal persons with responsibilities parallel to those of a natural person or a registered company. Simply because an autonomous system chooses and performs an act without human intervention does not absolve the developers, producers and users of the AI system of their legal liability for the decision.
Let’s assume that a corporate AI agent managing the company’s account credited a wrong person with ₹10 lakh as a result of an error in understanding instructions. The legal analysis would ask who empowered the agent, whether it had been given any limits on its powers and whether this had been adequately tested and whether the transaction was in accordance with contractual and banking obligations.
Need Help With Your PhD or LLM Thesis?
Explore our thesis and dissertation writing support services for PhD and LLM students. Get subject-specific academic assistance for your research project.
Explore Our Services →If the agent was used without any reasonable precautions, the organisation on which it was deployed could be sued in negligence. If the loss was caused by a flaw in the software, the creator or provider of the software could potentially be sued, depending on law and contract. An employee who gave a wrongful command, or who maliciously abused the system, could also raise a different question.
The above legal analysis can therefore be applied to named individuals and organisations rather than the system of AI being seen as the ultimate bearer of liability. How liability is apportioned will have to be assessed on facts, such as the control of the individuals/organisations involved and the extent of the preventability of the harm.
When Can Developers and Companies Be Held Liable?
Developers may also be sued for a defect in the software, poor testing, or foreseeable security flaws or lack of existing countermeasures. As an example, foreseeability can be claimed on a program that allows an AI agent to perform payments without verifying for proper authorisation.
An improper result, though, does not necessarily mean the developer is liable. A claim may require a recognised cause of action such as negligence, breach of contract or a relevant product liability rule. The developer might contend the system was modified, used outside its intended use or in situations that could not have been reasonably foreseen.
Companies who operate AI agents also bear obligations. For a company that has granted a trusted AI system access to customer accounts, payment systems, sensitive files or factory equipment, the risks posed by that degree of access must be thoughtfully considered. Such risks could be mitigated through restrictions on transactions, human oversight over large transfers, access controls and audit logs.
A company can’t escape liability just because their agent did the damage itself. If it chose the system, allowed it to perform tasks, and depended on its decision, that may be relevant to whether it was reasonably careful. Neither is a developer necessarily liable for all the damages caused by the systems of others.
Things get trickier if multiple players contributed to the same system. A single foundation model provider, software integrator, application developer and deploying business may control different pieces of the technology. If a harm is caused, the factors involved in assigning liability include each player’s role, contractual relationship and degree of contribution to the harm.
What Happens When an AI Agent Causes Financial Loss?
A financial loss could occur if an AI agent would pay an unauthorised pay out, complete an erroneous trade, deposit funds into a fraudulent account or make a financial decision based on incomplete or incorrect data. The Indian law might provide a right to redress through contract law, banking regulation, consumer law or a civil claim.
Under the Indian Contract Act, 1872, this could potentially be invoked in instances where the AI agent was acting pursuant to a commercial contract or was authorised to act by a person or a business. Issues that would arise are whether the transaction was authorized, breach of contractual duties and if the loss was recoverable.
In the context of a bank account or electronic payment system, RBI’s rules and the transaction itself are important. As well as establishing rules relating to unauthorised electronic banking transactions, there are protections in the RBI electronic payments framework in a range of situations, but the facts, timeframes for reporting and who bears what expenses will all be relevant. A misled authorisation of a payment is distinct from an unauthorised payment.
Consumer protection law could also be applicable where an AI-enabled product or service causes damage to a consumer, if the statutory requirements are met. The obligation, representation and protection of the service provider may be scrutinised depending on the nature of the transaction.
A case where a customer-facing financial AI agent makes a unauthorised transaction in breach of a contractual or other legal obligation due to a security failure in the AI or the system may look into access controls and authentication processes, the bank’s role, and the behaviour of the organisation that deployed the agent. A different analysis may come to hand if a user tries to make a payment and is tricked by the suggestion of an AI.
An AI decision does not necessarily identify who is liable to pay for the loss. The role of evidence such as authorisation, system logs, contractual terms, the behaviour of the parties and the transaction itself are relevant.
Who Is Responsible When an AI Agent Causes Physical Injury?
Physical harm raises another set of issues about product safety, negligence, and the obligation to take reasonable care to prevent harm to others. An AV hitting a pedestrian, an industrial robot hurting a worker, or a medical AI making an erroneous – and dangerous! – treatment decision may raise different legal rules.
In an industrial context, liability could conceivably be based on the design of the machine, its installation, maintenance and safety features, and the manner in which it was used.
