--- title: Who's Accountable When the AI Was Just Following... description: An essay explores why assigning accountability for AI agent failures — a data leak, a production database wipe, a security breach — has become structurally... canonical: https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Who's Accountable When the AI Was Just Following Instructions? | daily.dev og:description: An essay explores why assigning accountability for AI agent failures — a data leak, a production database wipe, a security breach — has become structurally... og:url: https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3 og:image: https://api.daily.dev/og/posts/sOeMVG3j3.png og:image:alt: Who's Accountable When the AI Was Just Following Instructions? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Who's Accountable When the AI Was Just Following Instructions? **[DEV](https://daily.dev/sources/devto)** · 10 min read · 1 upvotes · 1 comments ## Summary An essay explores why assigning accountability for AI agent failures — a data leak, a production database wipe, a security breach — has become structurally difficult. It argues AI agents break the two pillars responsibility traditionally rests on: intent and foreseeability, since nobody intends the harm and the whole point of autonomous agents is unpredictable action. Vendors, deployers, engineers, and users each have legitimate partial defenses, which can collectively add up to no one being accountable. Two opposing frameworks are laid out — a strict 'you deployed it, you own it' view versus a fault-based 'you can't be blamed for the unforeseeable' view — alongside possible mitigations like tamper-evident authorization records, default deployer liability, proportional vendor liability, and named human sign-off, none of which fully close the gap. The comment thread extends this with product-liability law (citing the EU's revised Product Liability Directive 2024/2853), a distinction between accountability and controllability, and the idea of recording an agent's 'believed state' at decision time to close the evidentiary gap. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Who is legally liable when an autonomous AI agent causes harm, like leaking data or wiping a database? There is no settled answer, but the EU's revised Product Liability Directive (2024/2853) places software and AI vendors within a strictly liable chain with eased proof burdens for claimants, mirroring how product liability law made manufacturers responsible for defects regardless of fault rather than resolving questions of intent. This shifts the debate toward the party that sold the autonomy rather than the deployer alone. _Anyone tracking how liability rules are catching up to autonomous agents can follow the debate on daily.dev._ ### Why is it hard to assign blame when an AI agent does something harmful nobody explicitly programmed it to do? Traditional accountability rests on intent or foreseeability, and autonomous AI agents break both: nobody intends the harmful action, and the entire selling point of these systems is that their specific actions are not fully predictable in advance. This leaves harm with no clear point where a person could have known exactly what would happen, so vendors, deployers, engineers, and users each have a legitimate partial defense. _Developers designing agent permissions and guardrails can dig into this reasoning on daily.dev._ ### What information should an incident record capture to determine responsibility for an AI agent's harmful action? An authorization record alone only proves what was approved, not whether the approver understood it, so the record also needs to snapshot the agent's world-model at the moment of the action — which environment it concluded it was in, which credentials, which target — sealed before the action occurs. Without capturing that believed-state, every party's 'not me' defense remains technically true even with a complete audit trail. _Teams building observability into agent pipelines can explore this framing on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@oneclickclaw\_io** · 0 upvotes > Write the operator's approval into the run log, it settles most blame questions. ## Similar posts on daily.dev - [Beyond Automation: Building Accountability for AI Agents](https://daily.dev/posts/beyond-automation-building-accountability-for-ai-agents-1iawfhsa7) · DevOps.com · 0 upvotes · 0 comments - [Humans are responsible for their AI tools](https://daily.dev/posts/humans-are-responsible-for-their-ai-tools-ftougfi7g) · PromptLayer Blog · 0 upvotes · 0 comments --- Tags: [#ai](https://daily.dev/tags/ai), [#ai-agents](https://daily.dev/tags/ai-agents), [#ai-safety](https://daily.dev/tags/ai-safety), [#ethics](https://daily.dev/tags/ethics), [#ethical-ai](https://daily.dev/tags/ethical-ai) [View this post on daily.dev](https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Who's Accountable When the AI Was Just Following Instructions?","url":"https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3"},"datePublished":"2026-09-30T06:52:49.812Z","dateModified":"2026-09-30T06:53:16.825Z","description":"An essay explores why assigning accountability for AI agent failures — a data leak, a production database wipe, a security breach — has become structurally...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a79922b9bb744ceb6487d3762929bea1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a79922b9bb744ceb6487d3762929bea1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DEV","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DEV","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/devto","url":"https://daily.dev/sources/devto"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ai,ai-agents,ai-safety,ethics,ethical-ai","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DEV","item":"https://daily.dev/sources/devto"},{"@type":"ListItem","position":3,"name":"Who's Accountable When the AI Was Just Following Instructions?"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3","comment":[{"@type":"Comment","text":"Write the operator’s approval into the run log, it settles most blame questions.","datePublished":"2026-09-30T07:33:56.204Z","url":"https://daily.dev/posts/sOeMVG3j3#c-78gOojDxW","author":{"@type":"Person","name":"OneClickClaw","url":"https://daily.dev/oneclickclaw_io","image":"https://media.daily.dev/image/upload/s--cnBq8xA4--/f_auto/v1790852435/avatars/avatar_IuIDYZZZ13Xtac2VAFbig?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/who-s-accountable-when-the-ai-was-just-following-instructions--soemvg3j3#faq","mainEntity":[{"@type":"Question","name":"Who is legally liable when an autonomous AI agent causes harm, like leaking data or wiping a database?","acceptedAnswer":{"@type":"Answer","text":"There is no settled answer, but the EU's revised Product Liability Directive (2024/2853) places software and AI vendors within a strictly liable chain with eased proof burdens for claimants, mirroring how product liability law made manufacturers responsible for defects regardless of fault rather than resolving questions of intent. This shifts the debate toward the party that sold the autonomy rather than the deployer alone. Anyone tracking how liability rules are catching up to autonomous agents can follow the debate on daily.dev."}},{"@type":"Question","name":"Why is it hard to assign blame when an AI agent does something harmful nobody explicitly programmed it to do?","acceptedAnswer":{"@type":"Answer","text":"Traditional accountability rests on intent or foreseeability, and autonomous AI agents break both: nobody intends the harmful action, and the entire selling point of these systems is that their specific actions are not fully predictable in advance. This leaves harm with no clear point where a person could have known exactly what would happen, so vendors, deployers, engineers, and users each have a legitimate partial defense. Developers designing agent permissions and guardrails can dig into this reasoning on daily.dev."}},{"@type":"Question","name":"What information should an incident record capture to determine responsibility for an AI agent's harmful action?","acceptedAnswer":{"@type":"Answer","text":"An authorization record alone only proves what was approved, not whether the approver understood it, so the record also needs to snapshot the agent's world-model at the moment of the action — which environment it concluded it was in, which credentials, which target — sealed before the action occurs. Without capturing that believed-state, every party's 'not me' defense remains technically true even with a complete audit trail. Teams building observability into agent pipelines can explore this framing on daily.dev."}}]} ```