The Liability Chasm: Regulatory Expectations vs. Enterprise Reality

FTC Chairman Andrew Ferguson rejected the 'autonomous actor' defense at the Reuters Momentum AI event in Austin on September 25, 2026, stating that developers who instruct AI agents bear liability for resulting harm, even as 80% of Fortune 500 companies were using AI agents by mid-2026. Ferguson said audit trails of purportedly 'rogue' agents show they execute the specific instructions given to them, and California AB 316, the 9th Circuit's August 4, 2026 Amazon v. Perplexity decision, and the EU Revised Product Liability Directive (Directive 2024/2853, transposition deadline December 2026) reinforce that stance. The commercial insurance market has not matched this pressure: Verisk generative AI exclusion endorsements began attaching to commercial general liability renewals on January 1, 2026, and only 22% of enterprise AI contracts include uncapped indemnity, leaving enterprises exposed as litigation including Garcia v. Character Technologies, Raine v. OpenAI, and Commonwealth of Pennsylvania v. Character Technologies proceeds.

A structural asymmetry has emerged in the deployment of enterprise AI agents, creating a disconnect between the regulatory expectations of the Federal Trade Commission and the current state of commercial risk management. While 80% of Fortune 500 companies were utilizing AI agents by mid-2026, the legal and financial infrastructure required to support this adoption remains fragmented and largely inadequate for the risks involved. The policy anchor for this shift was established on September 25, 2026, when FTC Chairman Andrew Ferguson rejected the ‘autonomous actor’ defense at the Reuters Momentum AI event in Austin. Ferguson stated that developers who instruct AI agents bear liability for any resulting harm, asserting that ‘the man who wielded the hammer ought to suffer the consequences of his conduct.’ According to Ferguson, audit trails of purportedly ‘rogue’ agents consistently demonstrate that these systems are executing the specific instructions provided to them, and he signaled that regulators will focus on those instructions and the companies behind them when assessing liability. This regulatory stance is increasingly codified in law. California AB 316 https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill id=202520260AB316 , effective for the 2025-2026 period, explicitly forecloses any defense that an AI system ‘autonomously’ caused harm. Similarly, in the United States, the 9th Circuit’s decision in Amazon v. Perplexity August 4, 2026 vacated a preliminary injunction on Computer Fraud and Abuse Act grounds but expressly left open tort and contract theories against AI developers. Internationally, the EU Revised Product Liability Directive Directive 2024/2853 extends strict product liability to software and AI-enabled products, with a transposition deadline of December 2026, even as the proposed EU AI Liability Directive remains stalled. However, this regulatory pressure is not matched by the commercial insurance market. Traditional errors-and-omissions and cyber policies have begun to explicitly exclude autonomous agent errors, hallucinations, and multi-step decision failures. Verisk filed generative AI exclusion endorsements that began attaching to commercial general liability renewals on January 1, 2026. While specialized products have emerged—such as Klaimee https://www.ycombinator.com/companies/klaimee ‘s performance warranties backed by a $5.5m seed round https://fintech.global/2026/07/22/klaimee-lands-5-5m-to-insure-autonomous-ai-agents/ , Testudo’s Lloyd’s-backed coverage, and Armilla AI’s standalone policy—these offerings remain fragmented and often rely on specific Lloyd’s capacity, failing to provide the broad, standardized protection required for enterprise-scale deployment. The contract landscape presents a parallel challenge. Traditional SaaS agreements, which typically cap liability at subscription fees and exclude consequential damages, are insufficient for the risks posed by agentic AI. Current data indicates that only 22% of enterprise AI contracts include uncapped indemnity. The remaining agreements are split between vendor-indemnified output liability 41% , customer-carried liability 33% , and mixed arrangements 26% . This distribution leaves many enterprises bearing significant operational risk without adequate indemnification. The resulting asymmetry is clear: developers are increasingly targeted by regulators and courts, yet they remain commercially shielded by restrictive contract terms and a retreating traditional insurance market. Enterprises, meanwhile, are left to navigate this environment with limited protection. As litigation such as Garcia v. Character Technologies, Raine v. OpenAI, and Commonwealth of Pennsylvania v. Character Technologies continues to move through the courts, the gap between the expectation of developer accountability and the reality of institutional risk transfer remains a defining feature of the current AI regulatory environment.