Page Contents
Key Contacts
Related Services
Artificial Intelligence (AI) is evolving from a workplace tool into a digital colleague. Businesses are increasingly deploying AI agents capable of making decisions, interacting with customers, drafting documents, analysing data and initiating actions with limited human oversight.
The commercial opportunities are considerable, but so too are the legal risks. One question arises repeatedly: if an AI agent causes harm, who is liable? For now, the answer is straightforward. AI agents do not bear legal responsibility. Liability will almost always fall on the organisations and individuals that develop, deploy or rely upon them.
The UK legal landscape
AI Is not a legal person
Despite increasing autonomy, AI systems have no legal personality under UK law. They cannot be sued, prosecuted, owe duties of care or bear contractual obligations. The fact that an AI system acted autonomously is unlikely, by itself, to absolve a business from liability.
Criminal liability
AI systems cannot themselves be prosecuted. However, businesses and individuals may still face criminal liability arising from their use, particularly in relation to fraud, data protection offences and unauthorised access to computer systems.
A particular challenge arises under the Computer Misuse Act 1990 (CMA), which was enacted long before modern AI systems existed. To secure a conviction for offences such as unauthorised access to computer material or impairment of computer systems, prosecutors must prove the requisite mens rea; namely intent, or in some cases recklessness.
It is often the case that harmful conduct stems from an AI agent responding to an ambiguous, poorly worded or apparently innocuous prompt. In those circumstances, establishing the necessary mental element may be significantly more difficult. Although liability may still attach to the individual concerned, proving beyond reasonable doubt that they intended, or were reckless as to, the resulting unauthorised conduct may present evidential challenges.
Existing legal principles
The UK Jurisdiction Taskforce's Legal Statement on Liability for AI Harms (the Statement), published on 7 July 2026, concluded that, contrary to popular perception, most AI-related disputes can be addressed using existing legal principles, principally through contract, tort and statute.
Organisations may face liability where AI-generated outputs result in:
In practice, courts are likely to focus less on the fact that AI generated the output and more on whether the business acted reasonably in deploying, supervising and relying upon it. Simply arguing that “the AI got it wrong” is unlikely to be an effective defence.
Contractual liability
Liability within the AI ecosystem is likely to be determined primarily through contract. Data providers, foundation model developers, application developers and end users are connected through a network of contractual relationships. Where loss occurs, liability will generally be allocated according to those contractual arrangements, with claims often moving up or down the supply chain through indemnities, warranties and limitation provisions.
Businesses procuring AI solutions should pay particular attention to:
Even where an affected party has no direct contractual relationship with an AI supplier, liability may still ultimately be allocated throughout the supply chain through interconnected contractual arrangements.
Negligence
Professionals such as solicitors, architects and doctors owe a duty to exercise reasonable skill and care. That duty applies equally where AI agents are used as part of service delivery. According to the Statement, negligence may arise where a professional:
An AI-generated error will not automatically shield a professional from liability if the error ought reasonably to have been identified or prevented.
A claimant must still establish causation. While the autonomous and opaque nature of AI systems may create evidential difficulties, traditional principles of factual and legal causation remain capable of addressing AI-related harms. Whether responsibility can be attributed to a participant in the AI supply chain will depend heavily on the facts of each case. However, the “black box” characteristics of certain AI systems may make attribution and proof of causation more difficult in practice.
AI-generated statements
Businesses may also face exposure arising from false or misleading content generated by AI systems. Depending on the circumstances, liability could arise for negligent misstatement, misrepresentation, deceit or defamation where AI-generated content is adopted, authorised or published on an organisation's behalf. Relevant considerations include the degree of human involvement, how the AI system is presented to users and the expectations of those relying on its outputs.
Consumer protection and statutory liability
Where AI forms part of a physical product, such as a robot, autonomous vehicle or smart device, liability may arise under product liability legislation if that product is defective and causes death, personal injury or property damage. However, standalone AI software is unlikely to be characterised as “goods” under current UK law.
Businesses should also be mindful of Section 13 of the Supply of Goods and Services Act 1982, which implies a term that services must be provided with reasonable care and skill. Where AI deployment forms part of a service offering, failures in testing, oversight or implementation may amount to a breach of that duty.
Regulatory considerations
For many UK organisations, data protection is likely to represent the most immediate source of AI-related liability. AI agents frequently process significant volumes of personal data and may have access to internal systems, customer records and commercially sensitive information. If an AI system causes an unlawful disclosure, exceeds its intended processing scope or contributes to a security incident, regulatory scrutiny may follow regardless of whether the immediate cause was human error or AI behaviour.
Businesses should also consider whether AI deployments trigger requirements relating to transparency, lawful processing, automated decision-making and data protection impact assessments under UK GDPR.
Liability may also arise under sector-specific regulatory regimes, including financial services and healthcare regulation, where AI use results in non-compliance with applicable legal obligations.
Shortfalls in the current UK framework
Although existing legal principles are loosely capable of addressing AI-related harms, they were not designed with autonomous AI systems in mind.
The autonomy, opacity and unpredictability of AI agents can make it difficult to allocate responsibility across complex supply chains involving multiple developers, providers and users. These characteristics may also create evidential difficulties when establishing fault, causation and foreseeability.
Certain legal regimes are particularly strained. The CMA predates modern AI and may prove difficult to apply where harmful outcomes emerge from ambiguous prompts or unforeseen autonomous behaviour. Likewise, existing product liability laws were developed primarily for physical products, leaving uncertainty around the treatment of standalone software, foundation models and adaptive AI systems.
EU developments
The EU has moved further than the UK in establishing a dedicated AI regulatory framework.
The EU AI Act imposes obligations on providers, deployers, importers and distributors of certain AI systems. Although the Act does not itself create a comprehensive civil liability regime, breaches may be relied upon in national liability proceedings and may help define the standard of care expected within the AI supply chain.
The EU has also modernised product liability law through the new Product Liability Directive (PLD), which expressly treats software, including many AI systems, as products and introduces strict liability for defective products that cause damage. It also includes disclosure obligations and evidential presumptions intended to assist claimants in technically complex disputes.
The PLD is also of particular relevance to Northern Ireland. Pursuant to the Windsor Framework, Northern Ireland is required to implement measures giving effect to the PLD by 9 December 2026. As a result, Northern Ireland is likely to become subject to a product liability regime that is more closely aligned with the EU approach to software and AI systems than the regime applying elsewhere in the UK.
Governance and risk mitigation
The law governing agentic AI will continue to evolve and further regulation is likely. However, businesses should not assume that the absence of AI-specific UK legislation equates to an absence of legal risk. Existing principles of contract, negligence, professional responsibility, consumer protection and data protection already provide multiple avenues through which liability may arise.
For UK businesses, the key issue is not whether AI can be deployed safely, but whether it can be deployed responsibly. Those organisations that can demonstrate appropriate governance, effective oversight and robust risk management will be best placed to realise the benefits of agentic AI while avoiding costly legal surprises. With this in mind, organisations deploying AI agents should consider the following safeguards:
For more information in relation to any of the points raised in this article, please contact Keith Dunn, Eileen McKendry-Gray, Patrick Murray or a member of the A&L Goodbody Belfast Commercial & Technology team.
Date published: 22 October 2026
