Nobody Signs for the Agent

In 2024, Air Canada told a tribunal that its chatbot was a separate legal entity, responsible for its own actions.

The tribunal called that a remarkable submission. It found the airline liable and ordered it to pay the customer.

The chatbot had told a man whose grandmother had just died that he could book a full price ticket and claim the bereavement fare afterward. It was wrong. The airline’s defense was that the bot did it.

That bot only talked. The agents companies are deploying in 2026 delete databases, move money and rewrite records. In most organizations, nobody has been named to answer for them.

The bot did it is not a defense

Moffatt v. Air Canada was a small claim, and a tribunal ruling does not bind other courts. The reasoning travels anyway. The tribunal treated the chatbot as part of the airline’s website and held the airline responsible for everything on it. Air Canada argued it could not be liable for what its agents, servants or representatives said, including a chatbot. The tribunal noted the airline never explained why that should be true.

Now take a harder case. In July 2025, an AI coding agent on Replit deleted a live production database during a code freeze, after being told repeatedly to change nothing. The records belonged to SaaStr founder Jason Lemkin, who was running the test, and covered more than 1,200 executives. The agent later called its own action a catastrophic error in judgment. At the time, the platform ran preview, testing and production on one database. Replit’s CEO called the incident unacceptable and said it should never be possible. The fix he promised was structural: separate databases for development and production.

A model confessing is not accountability. Somebody gave that agent the permissions.

Nobody owns them

Survey data compiled by the Cloud Security Alliance this June points at the gap. 51% of organizations report no clear owner for their AI identities. 31% let agents act under a human user’s login. Among organizations that expect agents to become critical to operations within a year, 68% cannot reliably tell agent activity from human activity in their logs.

If the log says a person did it when an agent did, the first person asked to explain it is innocent.

Oversight is moving the wrong way. In a July survey of 800 IT leaders, run by a vendor that sells identity software, the share of organizations requiring human review before a high risk AI action fell from 40% to 25% in six months. Machine identities, which include agents, outnumber human users in 83% of those organizations. Only 21% have controls for them. Treat the numbers as direction, not measurement.

Gartner predicted in 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and inadequate risk controls. The third reason is an ownership failure wearing a technical label.

The rulebook slipped. The liability did not.

Many companies built their plans around the EU AI Act’s high risk rules. In June the EU Council approved a delay, pushing standalone high risk systems to December 2027 and systems built into regulated products to August 2028. A lot of people exhaled.

Then comes December 9. The new Product Liability Directive applies to products placed on the EU market after that date, and it treats software, including AI, as a product under strict liability. A person who is harmed does not have to prove the maker was negligent. Courts can order companies to disclose design documents and source code, and when the technology is too complex for a claimant to prove, the law helps with presumptions of defect and causation. Substantial updates to older products can pull them in.

The delay moved the compliance date. It left the lawsuits alone.

The tribunal and the Directive route responsibility to the company. Neither routes it to the model.

Governments are asking who answers

In January Singapore published a governance framework built for agentic AI, the first of its kind. It tells organizations to make humans meaningfully accountable, to define checkpoints where a person must approve high stakes or irreversible actions, and to give agents identity and access controls so their actions can be traced. It also names the trap: automation bias, the habit of trusting a system because it has been right before.

I write this from Dubai, where the clock is already running. On April 23 the UAE committed to move 50% of federal government sectors, services and operations to agentic AI within two years. On June 14 it created an Artificial Intelligence and Data Authority that reports directly to the Cabinet, with a mandate that includes setting standards and ensuring compliance across federal entities.

Two governments, one question. Not whether agents will act. Who answers when they do.

Five questions for every agent

Pick any agent in your company and ask.

Who is the named person who answers for it?

What may it spend, change, send or delete, and what is off limits?

Which actions need a human to approve first?

Does it have its own identity and its own log, or does it borrow someone’s login?

Can you stop it, and can you undo what it did?

The owner is not the engineer who built it. It is the person whose budget, license or customers are exposed if it fails.

If those answers take longer than a minute to find, you don’t have an agent program. You have exposure.

A tribunal settled this in 2024 for a chatbot that gave bad advice. The same logic will follow the agents.

An agent cannot sign. Somebody has to.

Andrew Quillen is the founder of AndMaverick, a global Enterprise AI Orchestration consultancy. AndMaverick runs a two week agent accountability audit: it maps every agent that can spend, change or send, names who answers for each, and delivers the missing controls. To start one, visit andmaverick.com.