AI agent liability UK: who pays when an agent gets it wrong

AI agent liability UK comes down to one practical point: the agent cannot take the blame, so the business that deploys it carries the risk. If your agent sends a wrong email, issues a refund or changes a customer record, the question a court will ask is not whether the software was clever enough. It is whether you set it up, supervised it and relied on it reasonably.

AI agent liability UK: who is responsible in practice

An AI system has no legal personality under UK law. It cannot be sued, prosecuted, owe a duty of care or take on a contract, according to A&L Goodbody LLP. That leaves people and organisations. Pinsent Masons says it is highly likely that a developer and or deployer would be liable for harm caused by an AI acting autonomously, unless the kind of act in question was unforeseeable (Pinsent Masons).

That means 'the AI got it wrong' is a weak defence. A&L Goodbody's view is that courts focus on whether the business acted reasonably in deploying, supervising and relying on the AI. So the real question is what you did before and after the agent went live.

What 'reasonable' looks like for a small business

You do not need a compliance department. You do need four things written down:

• Who owns each agent, and who can switch it off.
• What the agent is allowed to do, in plain terms.
• Which actions need a person to approve them first.
• How you find out when something has gone wrong, and who fixes it.

If you can show those four things, you are in a far better position than an owner who turned on a tool and hoped for the best.

Who sits where in an agent's life

Build

Developer designs and trains the agent

Deploy

Your business sets its authority and supervision

Rely

Customers and staff act on what it says

How existing UK law applies to AI agents

UK law does not have a separate AI liability regime for small businesses yet. The existing rules still apply. In broad terms, three areas matter.

Contract. Your business is bound by what its agent agrees to within the authority you gave it. A customer who accepts a quote from your chatbot may expect you to honour it.

Negligence. If your agent causes foreseeable harm to someone you owe a duty to, such as a customer whose data is exposed or whose money goes to the wrong account, you may be liable for failing to take reasonable care.

Statute. Consumer protection and data protection law both apply. GOV.UK puts it plainly: you are responsible for what an AI agent does in the same way you are responsible for what an employee does, even if a third party designed or provides the agent (GOV.UK).

Cooley's legal statement makes the same underlying point from a different angle. Under English law, AI cannot be held liable in its own right. Liability attaches to a legal person who has voluntarily assumed responsibility, or on whom the law imposes it (Cooley). For an owner, that person is you.

Can an AI agent make a contract for your business?

An agent cannot sign anything as an independent party. But that does not mean it cannot bind you. In general terms, a business that gives an agent authority to act for it will usually be bound by what the agent does within that authority. Authority can also be implied from how the business presents the agent to customers.

So the practical move is to define the agent's authority in writing before it talks to anyone. For example:

• It can confirm standard prices from your price list, and nothing else.
• It can book a call, but it cannot accept a bespoke order or a discount.
• It can offer a refund only under a stated policy, and anything above that goes to a person.
• Any agreement that uses your terms of business must show those terms before the customer commits.

If an agent can accept orders or take deposits, treat every acceptance as a contract event. Put a human in the loop for anything non-standard, and make sure the customer sees a clear confirmation that states what was agreed. This is also where a solicitor should check your standard terms, because the wording decides what your customer can rely on.

Consumer law duties when AI agents deal with customers

If an agent talks to customers, consumer law applies to what it says and does. GOV.UK's guidance on complying with consumer law when using AI agents is the place to start, and it treats the agent's conduct as your conduct (GOV.UK).

The stakes are real. The same guidance notes that businesses could face fines of up to 10% of worldwide turnover for breaking consumer protection law. An agent that makes a misleading claim about a product, quotes the wrong price or hides a cancellation right is a compliance problem, not just a bad chat.

Two habits cost little and reduce risk. First, make the agent say what it is and that a person can take over. Second, load the agent with your real policies and test it against the questions customers actually ask, including the awkward ones about refunds, delivery times and cancellations. Whether you need specific disclosures for your sector is a question for a solicitor, not a guess.

Practical controls: human sign-off on high-stakes actions

The fastest way to cut liability is to stop the agent from doing high-stakes things alone. You do not need to approve every message. You need to approve the actions that can cost money, expose data or bind you.

Action	Why it is risky	Control to set
Taking a payment or issuing a refund	Money leaves the business, often hard to reverse	Human approval above a limit you set; no card details stored in chat
Changing bank details or payee records	Classic route for fraud	Always human approval; verify by a second channel
Editing or deleting customer records	Data loss or unlawful processing	Read-only by default; deletes need approval; keep a backup
Sending outbound emails to customers	Wrong price, wrong claim or wrong recipient	Templates only for first sends; sampling review each week
Accepting an order or contract	Creates a binding commitment	Standard products only; anything custom goes to a person
Exporting or sharing personal data	Data protection breach	Named user, logged, approval required

Set the thresholds by looking at what a single mistake would cost you, not by what feels comfortable. A refund that is cheap to undo can run automatically. A payment to a new account should never run automatically. Review the thresholds every month for the first three months, because agents tend to find edge cases you did not plan for.

Logging and monitoring: what records to keep

If something goes wrong, your logs are your defence. Without them you cannot show that you supervised the agent or that you acted reasonably once you knew about a problem. Keep a record that answers five questions for every consequential action:

• What did the agent receive as input?
• What did it decide, and what did it do?
• Which version of its instructions and policies was it running?
• Who approved it, if approval was needed, and when?
• Was the outcome checked, and did anyone reverse it?

Two other points matter. Keep logs only as long as you need them, and no longer. Logs of customer conversations are personal data, so your data protection duties apply to them too. Our guide on AI data protection for UK small businesses covers the first steps. Also check that you can actually export the logs. Some tools keep them in a dashboard you cannot download, and that becomes a problem the day a customer disputes a charge.

Monitoring means someone looks at the logs on a schedule. Pick a named person, a weekly slot and a short list of checks: refunds issued, emails sent, records changed, and any customer complaint that mentions the agent. A log nobody reads is not much of a control.

Contract terms to agree with AI vendors

Your vendor's contract decides who pays in practice. A&L Goodbody says businesses procuring AI should look at performance and accuracy warranties, indemnities for third-party claims, liability caps and exclusions, data protection obligations, and provisions on human oversight and monitoring (A&L Goodbody LLP).

The trap is the gap between what your customer can claim and what your vendor will pay. A customer may claim against you for a wrong refund or a leaked record. If the vendor's liability cap is small, or the contract excludes the kind of loss you suffered, the difference lands on you. Read the cap, the exclusions and the indemnity together. Ask whether the vendor will give you access to logs, how fast they must tell you about an incident, and what happens to your data when you leave.

For a fuller picture of what to ask a supplier before you sign, read our guide on how to brief an AI agency. The same questions apply to any build partner.

When to get a solicitor involved (not legal advice)

This article is general information, not legal advice. It does not tell you how a court would decide your case, and the law in this area is still developing. Get a solicitor involved before you do any of the following:

• Let an agent take payments, issue refunds above a small value or accept binding orders.
• Process health, financial, children's or other sensitive personal data through an agent.
• Operate in a regulated sector, such as law, financial services, healthcare or property.
• Sign a vendor contract with a liability cap you do not understand.
• Receive a customer complaint or claim that mentions an AI agent.

A solicitor can review your standard terms, your vendor contract and your disclosure wording. That is usually a far smaller bill than defending a dispute after the fact.

Where to start

1. Write down the owner, the permitted actions and the off switch for every agent you run.
2. Put human approval on payments, record changes, data exports and any binding commitment.
3. Turn on logging for every consequential action and name the person who reviews it each week.
4. Read your vendor's liability cap, exclusions and indemnity before you renew.
5. Book a solicitor review of your customer-facing terms and disclosure wording.

If you want a view on where agents fit in your business and which actions should stay with people, our AI systems and automation service is a sensible place to look, and our piece on whether agentic AI is worth it for a small business helps you decide whether to start at all. Get a free AI plan at /go/free-ai-plan, which maps the tasks an agent could take on and the controls each one needs. Or book a call at /book and we will talk through your setup, including where a solicitor should look before anything goes live.

Sources

• A&L Goodbody LLP
• Pinsent Masons
• Cooley
• GOV.UK