Liability, agents and professional duty

Who answers for what a model says

A language model writes by predicting likely words, so it can state a wrong fact as fluently as a right one. The failure is called a hallucination, and why it happens is explained in Sampling, hallucination and memorisation, an Intermediate module. Businesses now put such models in front of customers as chatbots that answer questions about prices, refunds and terms, and a wrong answer can cost a customer money or lead to a contract on terms the business did not mean to offer.

A lawyer asked about a wrong answer starts by asking who, in law, made the statement that the chatbot gave. The Law Commission of England and Wales, the body that reviews the law and recommends reform, wrote in a July 2025 discussion paper on AI and the law that AI systems “do not currently have separate legal personality”, so that an AI system is not itself able to be sued or prosecuted. A claim therefore has to be brought against a person, such as the developer of the model, the business that built it into a product or the business that put the product in front of customers.

The paper’s concern is that more autonomous systems could open “liability gaps”, cases in which harm caused by an AI system is not the legal responsibility of any natural or legal person, which the Law Commission thinks most likely with highly autonomous and adaptive systems. Autonomous and adaptive systems, in the paper’s sense, act with little human direction and can develop behaviour that their makers did not program. The paper adds that such gaps may not arise in practice, and that a gap would not be unique to AI, since not every harm caused by a person or a company leads to liability either. The paper also discusses giving some AI systems a form of legal personality, an option it calls perhaps radical, while saying that it is not clear that any AI system is yet advanced enough to warrant it.

In England and Wales, a person who enters a contract after a misrepresentation by the other party, and suffers loss as a result, can claim damages under section 2(1) of the Misrepresentation Act 1967. The party that made the misrepresentation is liable as if it had been made fraudulently unless that party proves it had reasonable grounds to believe, and did believe up to the time of the contract, that the facts it stated were true. Section 2(4) excludes a consumer who has a right to redress for the same conduct under the statutory scheme against unfair commercial practices, at present the consumer’s rights of redress under the Consumer Protection from Unfair Trading Regulations 2008. The Act does not mention automated statements, so a court would have to decide whether a chatbot’s answer is a statement made by the business; the Law Commission’s view that AI systems lack legal personality of their own points towards treating the business as the speaker. Disclaimers in a business’s terms meet a further rule: under section 3 of the same Act, a term in a contract other than a consumer contract that excludes or restricts liability for misrepresentation has effect only so far as the party relying on it shows that it is reasonable.

Consumers who buy a service have a further route under section 50 of the Consumer Rights Act 2015. Section 50 treats whatever is said or written to the consumer by or on behalf of the trader about the trader or the service as a term of the contract, where the consumer takes it into account in deciding to enter the contract or in a later decision about the service. On the section’s words, an answer from a trader’s chatbot appears capable of being something written to the consumer on the trader’s behalf, subject under section 50(2) to any qualification the trader gave on the same occasion. Section 57 makes a contract term that would exclude the trader’s liability under section 50 not binding on the consumer, so a warning given with an answer may count for more than an exclusion clause in the trader’s general terms.

Product liability, the law under which a producer pays for harm caused by a defective product without the injured person having to prove fault, has been widened in the EU to cover AI. The new Product Liability Directive, Directive (EU) 2024/2853, defines a product in Article 4(1) to include software. Its recital 13 names AI systems as software and says that their providers under the AI Act should be treated as manufacturers. In the AI Act’s terms, a provider is a business that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A business that develops a chatbot, or has one developed, including by building it on another firm’s model, and puts it into service on its website under its own name may therefore be a provider. Member states have until 9 December 2026 to bring the Directive into their national law, under Article 22. As corrected by a corrigendum published in the Official Journal on 7 May 2026, Article 2(1) applies the Directive to products placed on the market or put into service after 8 December 2026.

The right to compensation under Article 5 of the Product Liability Directive belongs to natural persons who suffer damage. Article 6 allows a claim for death or personal injury, including medically recognised damage to psychological health, and for the destruction or corruption of data not used for professional purposes. Article 6 also allows a claim for damage to property, with exceptions for the defective product itself and for property used only for professional purposes. The exceptions also cover a product damaged by a defective component, such as software, that the product’s own manufacturer built into it or connected to it, or that was added under that manufacturer’s control, for example by a third party with its consent. A company that loses money by relying on a chatbot’s wrong answer falls outside the Directive, since a company is not a natural person and financial loss on its own, without injury or damage to property or data, is not among the kinds of damage that Article 6 lists. Recital 13 also says that information is not a product, so the Directive does not apply to the content of digital files such as e-books. Whether harm flowing from a chatbot’s wrong answer, such as an injury to someone who followed it, counts as a defect in the software or as information outside the Directive is therefore an open question.

A product is defective under Article 7 when it does not provide the safety that a person is entitled to expect or that the law requires, and the circumstances a court weighs include the effect of any ability the product has to continue to learn after it is placed on the market. To ease the claimant’s task of proof, Article 9 of the Product Liability Directive lets a court order the defendant to disclose relevant evidence once the claimant has presented facts and evidence that make the claim plausible. Under Article 10(4), a court presumes defect or causation where technical or scientific complexity makes them excessively difficult to prove and the claimant shows that they are likely, a presumption the defendant may rebut. Recital 48 names among the examples of that complexity the use of machine learning, in which a system learns its behaviour from examples, and a causal link between defect and damage that the claimant could prove only by explaining the inner workings of an AI system.

Article 11(1)(c) lets a manufacturer escape liability by proving that the defect probably did not exist when the product was placed on the market. Under Article 11(2) that defence is unavailable where the defect is due to software, including updates, or to a lack of updates needed to keep the product safe, so long as the software or the updates are within the manufacturer’s control. Article 15 prevents liability under the Directive from being limited or excluded by a contract term as against the injured person. The Commission had also proposed a separate directive on adapting the rules of non-contractual civil liability to AI, but it withdrew that proposal, and the notice of withdrawal was published in the Official Journal on 6 October 2025.

In England, Wales and Scotland, product liability rests on the Consumer Protection Act 1987, whose section 1(2) defines a product as “any goods or electricity”, and the Law Commission says that there is uncertainty about whether that definition extends to software and AI systems. Northern Ireland differs: the new Directive applies there under Article 13(3) of the Windsor Framework, as a committee of the Northern Ireland Assembly reported in December 2024. In a consultation on product liability that opened on 8 October 2026 and closes on 14 January 2027, the Law Commission provisionally proposes that software and AI systems should count as products however they are supplied. Its summary of the consultation paper adds that pure information should stay outside the Act. By pure information the Law Commission means facts, data or ideas that, unlike software, do not perform a function of their own. Harm from such information, the Commission says, generally arises only when someone relies or acts on it or builds it into another product. Its other proposals include a rebuttable presumption of defect, limited by strict thresholds to cases where the evidence is exceptionally hard to obtain. Faced with the presumption, a defendant could try to rebut it, and if the rebuttal failed, damages would be assessed as if the defect were proved; or it could accept the defect and pay a share of the damages. The court would set that share starting from half, adjusting it for the claimant’s own conduct and for how far an ordinary consumer could have understood and accepted the risk. In both cases the claimant would still have to establish damage and causation, and a defence that applied would still defeat the claim. The Law Commission also proposes compensation for destroyed or corrupted data, except data used only for professional purposes, and expects to publish its final recommendations for reform of the 1987 Act in late 2027.

Agents and the law of agreements

An agent is an AI system that runs a language model in a loop, planning a step, using a tool such as a web browser or a payment service, reading the result and deciding what to do next, as The system around the model, an Advanced module, explains. An agent asked to book a hotel may therefore search, compare, choose a room and pay without its user approving each step. The legal question for a lawyer is whether the user is bound by what the agent agreed, and who bears the loss when the agent gets it wrong.

English contract law has met machines that make agreements before, and the Law Commission considered them in its 2021 advice to Government on smart legal contracts, contracts whose terms are performed automatically by computer code. In Thornton v Shoe Lane Parking, as the Law Commission reads it, the owner of a car park made an offer to motorists by holding out a ticket machine ready to take their money. Relying on that case, the Law Commission took the view that a person who deploys a program can make an offer and that a person who interacts with it can accept. Whether an agreement has been made is decided, in its view, by asking what the parties objectively intended by deploying and interacting with the code, and it concluded that the existing law can accommodate such contracts without legislation.

The Law Commission’s advice assumed deterministic programs, which in its description operate within the parameters set by their programmer and do only what they are programmed to do. On mistakes in contracts made between such programs, the Law Commission treated as a useful reference point a test from the Singapore Court of Appeal in Quoine v B2C2, which looks at what the programmer knew, or ought to have known, when writing the program. A language model agent behaves differently, since the same request can produce a different response each time and it chooses its own steps, so its user may not have foreseen, let alone programmed, the action in dispute. How an English court would apply the law of mistake, or decide whether the user is bound at all, when an agent does something its user did not expect is an open question.

Prompt injection, text planted in a web page or an email that an agent reads and then obeys, makes it harder still to say whether the user is bound, since the disputed action may then have been chosen by a stranger to the contract. The cases and statutes discussed in this module do not say how a financial loss under a contract caused in that way would be shared between the user, the business that built the agent and the other party. For the injury and damage that the Product Liability Directive covers, its Article 13(1) keeps a manufacturer liable to the injured person where any third party, such as someone exploiting a security flaw, also helped cause the damage. The person who planted a prompt injection would therefore not reduce the manufacturer’s liability to the injured person for an agent that was defective, although Article 13(1) leaves national law free to let the manufacturer recover a contribution from that person. Under Article 13(2), the fault of the injured person, or of someone for whom the injured person is responsible, can reduce or remove that liability. The Directive does not mention prompt injection, so the general test of defect in Article 7 has to answer an open question: is an agent that a planted prompt injection can steer defective? That test asks whether the agent is less safe, taking its cybersecurity into account, than a person is entitled to expect.

The law of agency offers another way to think about AI agents. In law an agent is a person who acts for another, called the principal, and the law of agency decides when the principal is bound by what the agent does. The Supreme Court summarised its general principles in Law Debenture Trust Corporation v Ukraine. Actual authority comes from an agreement between principal and agent, by which the principal gives the agent the right to enter into legal relations with third parties on its behalf. Apparent authority arises from a representation by the principal to a third party that the agent has authority, on which the third party could and did reasonably rely, and the representation then prevents the principal from denying that it is bound. The Court added that a third party who fails to make the inquiries a reasonable person would have made is not protected by apparent authority.

In its 2021 advice the Law Commission concluded that a computer program could not be regarded as a party’s agent in law. The Commission said that it was following the Singapore Court of Appeal’s decision in Quoine v B2C2. The Commission also relied on a remark made in passing by a deputy High Court judge in R (Software Solutions Partners Ltd) v HM Customs & Excise that, on current authority, only a person with a mind would appear to be capable of being an agent in law. Whether a court would instead reason by analogy, for instance by treating a user who lets an AI agent deal with sellers as representing that the agent may do so, is an open question.

Internationally, UNCITRAL, the United Nations commission that drafts model laws on trade, adopted a Model Law on Automated Contracting on 11 July 2024, a text that countries may choose to enact into their own law. Article 5 says that a contract formed using an automated system is not to be denied validity on the sole ground that a natural person did not review or intervene in its formation, and Article 1(2) makes clear that such a system may operate in a non-deterministic way, as a language model does. Article 7 attributes an action of an automated system to the person who uses the system to take that action, unless the parties have agreed a procedure of their own, and says that attribution is not to be denied only because the outcome was unexpected.

An optional Article 8, for states that choose to adopt it, then softens Article 7 for actions the user did not expect. Subject to any contrary agreement, the other party to the contract is not entitled to rely on an action of the user’s system that the user could not reasonably have expected, if the other party knew, or could reasonably be expected to have known, that the user did not expect it. UNCITRAL’s guide to the Model Law says that Article 8 covers outputs affected by third-party interference, which appears wide enough to include prompt injection.

Within the EU, Article 9 of the Electronic Commerce Directive requires member states to allow contracts to be concluded by electronic means and not to deprive them of legal effect because they were made electronically, though it does not say when an action of an automated system binds the person who uses it. Payments made by agents raise the same questions of authority in a sharper form, and the EU and UK rules on a payer’s consent and on proving it are explained in The system around the model, an Advanced module.

Financial regulators and agents

Financial regulators in the EU and the United Kingdom have so far said that their existing rules apply to firms that use AI. The Financial Conduct Authority, the FCA, regulates the conduct of UK financial firms. Its page on its approach to AI says that it does not plan to introduce extra regulations for AI and will “rely on existing frameworks, which mitigate many of the risks associated with AI”. Among those frameworks the FCA names the Consumer Duty, which requires firms, in their retail business, to design products and services that meet the needs of their target customers and provide fair value. Another is the Senior Managers and Certification Regime, whose Senior Managers Regime allocates responsibility for a firm’s regulated activities to named individuals.

The FCA Board asked Sheldon Mills, one of the FCA’s executive directors, to lead a review of how AI could change retail financial services, and the FCA published the Mills Review on 6 July 2026. The FCA’s page on the review expects AI to “recommend actions, initiate transactions, and execute decisions within agreed parameters”, and the review finds that the overall regulatory framework remains sound but will need to evolve. On accountability, the Mills Review says that the Senior Managers Regime still applies but that firms and regulators will need to work through how it operates as AI systems become more autonomous. At higher levels of autonomy, in the review’s words, “issues of consent, auditability, redress and the allocation of responsibility across delivery chains are likely to become more pronounced”, and its recommendations go to the FCA Board to consider.

Payments that an AI agent starts on a user’s behalf are what the FCA calls agentic AI payments. In its regulatory priorities for payments firms of March 2026, the FCA said that it would work with the Treasury to modernise payments regulation, including “considering whether change or development of regulation is needed to support agentic AI payments”. The Bank of England’s Financial Policy Committee watches for risks to the UK financial system as a whole. Its Financial Stability Report of July 2026 says that more autonomous AI systems in payments raise new questions about “authorisation, traceability, fraud detection and liability, resilience, legal accountability, and the liquidity arrangements needed to manage failed, disputed or reversed payments”. The report adds that Bank staff are studying agentic payments and agentic trading in depth, and it names cyber risk as the most immediate concern from rapidly advancing frontier AI, meaning the most capable AI models.

In the EU, the European Securities and Markets Authority, ESMA, said in a statement of 30 May 2024 on AI in retail investment services that it expects investment firms using AI to comply with MiFID II, particularly its organisational requirements, its conduct of business rules and the duty to act in the client’s best interest. ESMA’s statement adds that “firms’ decisions remain the responsibility of management bodies, irrespective of whether those decisions are taken by people or AI-based tools”, and that firms need controls over staff use of third-party AI tools, including tools that staff use without senior management’s knowledge and approval. The European Banking Authority, which issues guidelines for EU banks and payment firms, studied the AI Act’s extra safeguards for the systems the AI Act classifies as high-risk, a list that includes AI used to assess people’s creditworthiness. Focusing on that use, the EBA compared those safeguards with EU banking and payments law. In a factsheet of November 2025 the EBA reported that it had not found significant contradictions between the AI Act and that legislation and had not identified an immediate need for new or revised EBA guidelines.

Internationally, the Financial Stability Board, a body of financial authorities that works with the G20, finalised 12 sound practices for financial institutions’ use of AI on 15 October 2026. Among the risks of agents it lists unauthorised actions, steps an agent takes in pursuit of its goals without adequate human approval or oversight. Its sound practices call on institutions to keep records that attribute an agent’s actions to that agent and show what triggered them, what it accessed and whether it stayed within its permissions, taking a risk-based approach to how much they log. Its chair, Andrew Bailey, wrote to G20 finance ministers and central bank governors on 28 August 2026 that “for the financial system, the most immediate concern is the potential impact of frontier AI on cyber risk”.

Research published by Anthropic, the company that makes the Claude models, in December 2025 illustrates the cyber risk that the Financial Stability Board and the Bank of England describe. Its subject was smart contracts, programs that hold and move funds and need not amount to a contract in law. Smart contracts run on a blockchain, which is a shared public ledger of transactions. In a simulation, AI agents wrote working attacks worth $4.6 million in simulated stolen funds on contracts that had been attacked in the real world after the models’ training data ended, a choice Anthropic made to reduce the chance that the models had seen those attacks in training. Scanning 2,849 recently deployed contracts without known flaws, again in simulation, the agents found two previously unknown vulnerabilities, at an average cost of $1.22 for an agent to scan each contract.

Professional duty

Lawyers who use AI answer for it personally, as the judiciary’s guidance has said since December 2023. The courts, regulators such as the Solicitors Regulation Authority and the Bar Standards Board, and the professional bodies of England and Wales have since said the same in the judgments and guidance described below. The leading judgment, R (Ayinde) v London Borough of Haringey, concerned two cases in which the High Court was given citations of cases that do not exist, and of real cases for passages they do not contain. Its facts and its statement of the duty to check AI research against authoritative sources are worked through in Does AI reason?, a Beginner module.

The Divisional Court also set out the court’s powers when false material is put before it. The powers it listed are public admonition of the lawyer, a costs order, a wasted costs order, striking out a case, referral to a professional regulator, contempt proceedings and referral to the police. Placing false material before the court with the intention that the court treats it as genuine may be a contempt of court, depending on the person’s state of knowledge. Negligence about whether the material is false is not enough, but knowledge that it is false, or the lack of an honest belief that it is true, may be. In the most serious cases, deliberately placing false material before the court with the intention of interfering with the administration of justice amounts to the common law offence of perverting the course of justice, for which the maximum sentence is life imprisonment.

A referral to the lawyer’s regulator is likely to be appropriate, the court said, where a lawyer places false citations before it, whether because AI was used without proper checks or for another reason. Save in exceptional circumstances, the court added, public criticism alone is unlikely to be a sufficient response. The judgment also called on those with leadership responsibilities, such as heads of chambers and managing partners, to take practical and effective measures. In future hearings under its Hamid jurisdiction, the court’s power to enforce the duties lawyers owe it, the profession can expect the court to inquire whether those leadership responsibilities have been fulfilled.

The duties set out in Ayinde apply equally where the AI tool is one a firm itself provides, as a later judgment shows. In Cork v Smith, decided in May 2026, a judge of the Insolvency and Companies List found that two letters a firm of solicitors sent to the court were misleading. The first quoted, as if it were the text of an insolvency rule, words that do not appear in the Insolvency (England and Wales) Rules 2016. The evidence was that a junior solicitor had used an AI tool the firm was piloting and did not appear to have told the supervising solicitors that AI had been used. The judge said that it was incumbent on the more senior lawyers to check the junior’s work, and that the junior should have been told to check all references given by AI and to say whether AI had been used. Finding that public criticism alone would not be enough, the judge held that the published judgment, together with the firm’s referral of itself to the Solicitors Regulation Authority, was the proportionate response, and added that legal professionals may not “outsource the process of legal research or of legal reasoning to an AI”.

The Upper Tribunal, in UK v Secretary of State for the Home Department, an appeal by a person anonymised as UK, stated in its headnote that a lawyer who delegates work to another fee-earner remains responsible for supervising it. The tribunal added that a supervisor who fails to ensure that a junior’s work is free of false citations is likely to be more culpable than a lawyer who fails to check their own work. The headnote also records that the tribunal’s claim form for judicial review has been amended to require a legal representative to confirm by a statement of truth that each authority cited exists, can be found from the citation given and supports the proposition for which it is cited.

The Solicitors Regulation Authority, the SRA, built on these judgments in its warning notice “Misuse of AI” of 17 August 2026. The SRA says that AI does not have separate legal personality, that solicitors who use it remain accountable for their work, and that firms need effective governance structures, systems and controls to manage its risks under paragraph 2.1 of the SRA’s Code of Conduct for Firms. In the SRA’s view, supervisors remain accountable for work done through junior or non-authorised colleagues, reliance on an AI output “would not be a suitable defence” where false citations come before a court, and a solicitor who fails to have proper regard to the notice is at risk of disciplinary action.

For barristers, the Bar Standards Board’s guidance on the use of AI, valid from 18 May 2026, treats using an AI tool as outsourcing under the BSB Handbook, so that the barrister remains responsible for the work. The Board describes agentic features, which let an AI system take an action automatically based on its output, as “likely to be of high risk for most applications at the Bar”. Barristers who automate even low-risk tasks, the guidance adds, remain responsible “for any actions such a system may take”.

The judicial guidance on AI now in force, dated 31 October 2025 and replacing earlier versions, tells judges that “All legal representatives are responsible for the material they put before the court/tribunal and have a professional obligation to ensure it is accurate and appropriate”. The guidance adds that a representative who uses AI responsibly need not ordinarily mention it, though that depends on context, and that judges are personally responsible for material produced in their name.

The Civil Justice Council, which advises on the civil justice system, published the final report of its working group on AI in court documents on 29 October 2026. The report recommends against new rules requiring lawyers to declare their use of AI in statements of case, skeleton arguments and other advocacy, and says that lawyers should remain responsible for the accuracy and reliability of those documents under their existing obligations. The report does recommend that a witness of fact declare that AI used in preparing a witness statement has not generated or influenced its substantive content, and that an expert make a declaration where AI generates or influences the substance of a report. The Civil Justice Council’s recommendations are addressed mainly to the Civil Procedure Rule Committee and would need to be taken up by it before they change court procedure.

The Law Society’s guide Generative AI: the essentials, last updated on 30 June 2026, tells solicitors that using generative AI “does not absolve you of legal responsibility or liability if the results are incorrect or unfavourable”. Across Europe, the Council of Bars and Law Societies of Europe advises in its guide on generative AI of 2 October 2025 that lawyers verify AI output before using it in their work, save in certain kinds of task, such as one that does not create any risk. The Council warns that using unverified output could expose a lawyer to sanctions for professional misconduct or contempt of court and to malpractice claims.