Copyright Copyright and privacy obligations already govern the data, but agentic systems add the problem of preserving identity and accountability as software acts on it own
Akul Saxena
SANTA CLARA, Calif., Sept. 18, 2026 – Companies are giving AI agents access to files, software and company data faster than they are building the controls needed to govern what those agents can see, inherit and reach, governance executives said this week.
The exposure runs in three layers: Copyright and consent apply when material enters a system, privacy law applies while personal information sits inside it, and accountability becomes the question once an agent acts.
Rights get decided before data goes in
A song, a photograph or a face carries legal rights long before a model produces anything from it. Licensing and consent therefore have to be settled when the material goes in, said Alice Xiang, global head of AI governance at Sony Group Corp., the Japanese electronics and entertainment company, speaking on a separate panel at the AI Infra Summit here.
"If you don't address that at the data layer, there's really no way to address that further downstream," she said. The data layer is what a system learns from: the images, text and recordings a company feeds into training.
Copyright law gives an owner the exclusive right to copy a work and to build new works from it, with exceptions such as fair use.
In the U.S., the Copyright Act of 1976 sets that rule. Protection starts the moment an author fixes original work in durable form, and it covers copying, adapting, distributing, performing and displaying it publicly.
Fair use, the exception at Section 107, allows certain uses of copyrighted work without the owner's permission, the kind of work, how much was taken and the damage to the market for the original. It is decided case by case.
The exception widened for three decades as courts asked whether a use was transformative, the test that cleared Google’s copying of Java code in 2021. The Supreme Court pulled it back in 2023, ruling that a commercial use serving the same purpose as the original is not transformative.
Two years later, Judge William Alsup ruled that training a model on lawfully purchased books is fair use, and that keeping pirated copies is not.
Harder problem: Data already collected
Harder problem: Data already collected
For a result to carry protection, a person has to supply the creative choices, and typing a prompt generally falls short of that. Old training data is the hardest case. Companies assembled datasets years ago without recording which permissions came with them, and blocking an output today leaves the original collection where it was.
Xiang pointed to her own team's answer. Sony AI published the Fair Human-Centric Image Benchmark in the journal Nature in December 2025, drawing on 10,318 images of 1,981 people across 81 countries and regions, every one of whom agreed to be included and can withdraw that agreement.
That consent is what makes the dataset useful to a company. Sony can show a regulator how it tests its systems and where the test material came from.
The remaining problem is engineering. Somebody has to write those rights in a form software can read and act on.
Privacy problems also start upstream
Personal information creates a related constraint that also predates the agent. A company can block an application from showing someone’s data, but that does not undo the collection that put the information into a dataset in the first place.
Biometric information is the clearest example. California’s privacy law treats biometric information used to identify a person as sensitive personal information, alongside categories including precise geolocation and genetic data, and gives consumers rights over how covered businesses collect and use their information.
The United States still has no comprehensive federal data privacy law. California’s automated-decision rules begin applying to significant decisions in 2027. In Europe, the General Data Protection Regulation already limits certain solely automated decisions, while the EU AI Act will add requirements for high-risk uses including employment and biometrics beginning in December 2027.
The arrival of AI retired none of the older obligations. Companies still have to know why they collected information, limit what they take and understand where it goes, said Ron Whitworth, chief privacy officer at Truist, a bank holding company. A breach involving AI can still trigger the notification and remediation duties that apply to other technology incidents.
What changes is visibility. AI systems can make or contribute to decisions about people without the same level of control or visibility companies had with conventional systems, Whitworth said. His definition of an AI incident begins when a use case produces results outside expectations, particularly when those results could affect a consumer or employee.
For regulated companies, the standard is evidentiary. Records have to show that the controls a company designed are the controls actually running, and businesses should be able to prove that “what you design is exactly what is happening,” Whitworth said.
Agent-to-agent work breaks the identity trail
Tracking responsibility gets harder when the software stops answering and starts acting. A single agent action can still be traced to the employee who requested it, said Nicky Pike, Americas field chief technology officer at Coder, a developer environment company.
The trail becomes less reliable when that agent creates subagents, additional AI processes that handle parts of the original task. Each handoff creates another place where the connection between an action and the person who originally authorized it can be lost.
Pike pointed to the Model Context Protocol, a standard connecting AI applications to outside tools and data. Some implementations use static keys, reusable credentials that provide access without necessarily identifying which person, agent or subagent initiated each request.
Agents also frequently operate with permissions inherited from the employee directing them, potentially giving the software access to many of the same files, applications and systems available to that worker.
“We’re giving AI way too much authority,” Pike said.
Asked whether any product can preserve that chain of delegated authority end to end, Pike said he had not seen the problem solved. Capabilities are changing every few months, he said, while companies are still working out how to preserve identity as one agent creates another.
The problem extends beyond one company when agents begin interacting with agents operated by other organizations. Panelists called for interoperability standards, shared rules that could establish how agents identify themselves, communicate what they are authorized to do and interact across company boundaries.
Written rules alone cannot provide those controls. Pike said agents need isolated environments where companies can observe their activity, restrict what they reach and shut the environment down when necessary.
An agent “is not going to read your policy,” he said.
Wrong answers, wrong actions
Greater authority also compresses the time to respond. A hallucinated recommendation in a code review can wait for a developer to review the proposed change, Pike said. An agent that deletes data or burns through a month of computing budget over a weekend has to be detected and stopped while it is still running.
Moving company data somewhere unauthorized is a third case. Pike described that as a security incident, one that should trigger the same monitoring, containment and response procedures security teams already practice for other forms of data loss.
The response steps themselves are familiar to security and technology teams. They already have procedures for containing an incident, determining whether people or data were affected, repairing the damage and changing the system to prevent a repeat, Levitt said.
What changes is how quickly that response has to begin. An agent can delete information, consume company resources or transfer data outside the organization before a person has reviewed what it did.
Where liability lands
Most AI failures will produce some legal exposure, said Gauri Manglik, vice president and head of legal, privacy and AI governance at GoFundMe, the online fundraising platform. The size of it depends on the safeguards a company can document from before deployment.
Two uses carry the most risk. A misrepresentation inside AI-generated content is one, and automated decision-making in hiring or access to financial services is the other.
Those are the cases that justify a separate review track, Manglik said. Whether a company ran red team testing - adversarial testing before release - and whether its training data suited the use are the questions that will be asked afterward.
Responsibility gets harder to assign as autonomy grows. Manglik pointed to principal-agent law, the centuries-old rule that a principal is liable for acts its agent takes on actual or apparent authority, and said an agent that spends $10,000 still binds the human it acted for.
That holds only while agent identities stay tied to human ones. Once a subagent acts for a subagent, the chain has no person at the end of it.