As organisations embrace the next wave of artificial intelligence, a critical question is moving from theoretical debate to boardroom reality: when an AI agent makes a costly mistake, who is responsible?
While the technology is advancing rapidly, the legal position remains clear. Accountability still rests firmly with the humans and organisations behind the systems.
Artificial intelligence is no longer simply a productivity tool. Increasingly, businesses are deploying AI agents capable of making decisions, interacting with customers, drafting communications, analysing data and initiating actions with minimal human intervention.
READ MORE: Aflac Northern Ireland named Security Team of the Year
For organisations across Northern Ireland, the opportunities are significant. AI promises greater efficiency, improved customer experiences and new ways of delivering services. Yet as businesses hand more responsibility to autonomous systems, legal and regulatory risks are becoming harder to ignore.
One of the most common questions emerging from boardrooms and legal teams is deceptively simple: if an AI agent causes harm, who is liable?
At present, the answer is relatively straightforward. AI itself cannot be held legally responsible. Liability will almost always fall on the businesses, professionals or individuals who develop, deploy or rely upon the technology.
AI Is Not a Legal Person
Despite increasingly sophisticated capabilities, AI systems have no legal status under UK law. They cannot be sued, prosecuted, enter into contracts or owe duties of care.
This means organisations cannot simply point to the technology when something goes wrong. Whether the issue involves incorrect advice, a data breach, misleading information or a flawed business decision, courts are likely to focus on the actions of the organisation that deployed the system rather than the software itself.
In practical terms, "the AI made a mistake" is unlikely to be viewed as a compelling legal defence.
Existing Laws Are Already Being Applied
A common misconception is that businesses face little legal exposure because the UK has yet to introduce comprehensive AI-specific legislation.
However, legal experts suggest existing laws are already capable of addressing many AI-related disputes.
The UK Jurisdiction Taskforce's Legal Statement on Liability for AI Harms, published in July 2026, concluded that most disputes arising from AI can be addressed through established legal principles including contract law, negligence, consumer protection legislation and data protection regulations.
As a result, organisations may be exposed to liability where AI systems generate inaccurate advice, defamatory content, misleading representations, contractual breaches or regulatory infringements.
Rather than examining whether a machine produced the output, courts are likely to ask a more familiar question: did the organisation act reasonably when selecting, deploying and supervising the technology?
The Growing Importance of Human Oversight
For professional service firms, the risks are particularly significant.
Solicitors, accountants, architects, engineers and healthcare professionals all owe duties to exercise reasonable skill and care. Those obligations do not disappear simply because part of the work was assisted by AI.
Indeed, liability may arise if professionals rely on unsuitable AI systems, fail to carry out proper due diligence, inadequately supervise outputs or neglect to identify obvious errors generated by automated tools.
The legal expectation is increasingly becoming one of informed oversight. AI may accelerate decision-making, but responsibility for those decisions remains with humans.
This presents a challenge for organisations eager to unlock efficiency gains while ensuring appropriate governance controls remain in place.
Data Protection Risks Move Centre Stage
For many organisations, particularly those operating in highly regulated sectors, data protection may represent the most immediate source of AI-related liability.
Modern AI systems frequently process significant volumes of personal and commercially sensitive information. They may access customer records, internal business systems, employee data and confidential documents.
Where an AI solution exceeds its authorised scope, contributes to a security failure or enables an unlawful disclosure of personal information, regulators are unlikely to accept technological autonomy as an excuse.
Businesses must therefore consider whether AI deployments comply with requirements surrounding lawful processing, transparency, automated decision-making and data protection impact assessments under UK GDPR.
With cyber threats becoming increasingly sophisticated and regulatory scrutiny continuing to intensify, governance around AI usage is rapidly becoming a board-level concern.
Contracts Could Become the Key Battleground
As AI ecosystems become more complex, contractual arrangements are expected to play a central role in determining liability.
Most organisations rely on an interconnected chain of providers, including data suppliers, model developers, software vendors, implementation partners and cloud infrastructure providers.
When something goes wrong, attention frequently turns to the contracts governing those relationships.
Performance guarantees, indemnities, liability caps, intellectual property provisions and data protection obligations may ultimately determine where financial responsibility rests.
For businesses procuring AI solutions, robust contract reviews are becoming increasingly important. Understanding precisely what suppliers are promising, and what liabilities they are excluding, could prove critical if disputes arise later.
A Challenge for Existing Legislation
Although traditional legal principles remain largely applicable, many experts acknowledge that existing legislation was not designed with autonomous AI systems in mind. The Computer Misuse Act 1990 is one example.
Enacted decades before modern AI existed, the legislation requires prosecutors to establish intent or recklessness for certain offences. Where harmful actions arise from ambiguous prompts or unexpected AI behaviour, attributing the necessary mental element may become considerably more difficult.
Similarly, traditional product liability laws were developed primarily with physical products in mind.
As AI-driven software becomes more autonomous and adaptive, questions continue to emerge around how these frameworks should apply to standalone software and foundation models.
These legal uncertainties are fueling ongoing discussions among policymakers, regulators and industry leaders about the need for updated legislation.
Why Northern Ireland Should Pay Particular Attention
For Northern Ireland businesses, developments within the European Union add another layer of complexity.
The EU has moved ahead of the UK in developing a dedicated regulatory framework through the AI Act while also modernising its product liability regime.
Perhaps most significantly, the revised Product Liability Directive explicitly recognises software, including many AI systems, as products and introduces new mechanisms that could make it easier for claimants to pursue compensation.
Because of obligations arising under the Windsor Framework, Northern Ireland will need to give effect to aspects of this updated product liability regime.
The result could be a growing divergence between legal approaches in Northern Ireland and those applying elsewhere in the UK.
For organisations operating across both UK and EU markets, understanding these differences will become increasingly important as regulatory frameworks continue to evolve.
Governance Will Be the Competitive Advantage
While policymakers continue debating the future of AI regulation, organisations cannot afford to wait for legislative certainty.
Existing laws already create meaningful liability risks, and regulators appear increasingly willing to scrutinise how organisations deploy emerging technologies.
The businesses best positioned to benefit from agentic AI will be those that treat governance as seriously as innovation.
That means establishing clear accountability structures, maintaining inventories of AI systems, conducting supplier due diligence, implementing meaningful human oversight, retaining audit trails and regularly reviewing contractual and insurance arrangements.
In other words, successful AI adoption will depend as much on governance and risk management as on technological capability.
As AI agents become embedded in everyday business operations, the central legal principle remains unchanged: responsibility cannot be delegated to a machine.
For Northern Ireland organisations embracing AI-driven transformation, that reality may prove the most important lesson of all.
To read the full extended article Agentic AI and Legal Liability: What UK businesses need to know | A&L Goodbody LLP.
Read the Autumn 2026 edition free online →
Stay connected with NI's tech community:
