AI Agents in the Workplace: Who Is Liable When Artificial Intelligence Makes Decisions or Takes Action?

AI Agents in the Workplace: Who Is Liable When Artificial Intelligence Makes Decisions or Takes Action?

Artificial intelligence is no longer simply a tool used to generate text, classify information or provide recommendations. Companies are increasingly incorporating systems capable of performing tasks autonomously: managing incidents, interacting with customers, launching internal processes, modifying databases or making decisions within predefined parameters.

This evolution raises an important legal question: when AI goes beyond making recommendations and starts taking action, who is responsible for the consequences of its decisions?

What is an AI agent and how does it differ from a traditional AI system?

An AI agent can be understood as a system designed not only to generate a response to a specific instruction, but also to pursue an objective and autonomously perform different actions in order to achieve it.

The difference is particularly clear in a business environment. A traditional system may, for example, analyse a customer complaint and recommend how to respond. An AI agent could receive that complaint, consult different internal systems, determine the appropriate response, send a communication to the customer and automatically update the relevant file.

From a legal perspective, the European Artificial Intelligence Regulation —the AI Act— defines an AI system by reference, among other elements, to its ability to operate with varying levels of autonomy and to generate outputs, recommendations or decisions capable of influencing physical or virtual environments.

The AI Act does not establish a separate legal category for so-called “AI agents”. Accordingly, each solution will need to be assessed individually, taking into account its intended purpose, the level of autonomy with which it operates and, above all, the consequences that may result from its actions.

Who is legally responsible when an AI agent makes an incorrect decision or causes damage?

One of the most important principles for any company implementing AI agents is that technological autonomy does not entail legal autonomy.

The fact that a system makes a decision without immediate human intervention does not make the AI agent legally responsible for the consequences of that decision. The AI Act allocates obligations to identifiable actors, such as the provider that develops or places the system on the market and the deployer that uses it under its authority.

Therefore, a company cannot assume that it is released from liability simply because “the AI made the decision”. It will be necessary to assess who selected the system, how it was configured, what instructions it received, which controls were in place and whether the action that caused the damage fell within its intended use.

This becomes particularly relevant where an AI agent is able to make decisions that have effects on third parties: accepting or rejecting transactions, modifying prices, managing payments, selecting candidates, making employment-related decisions or sending legally relevant communications on behalf of the company.

In such cases, in addition to the AI Act, companies will need to consider the general rules on contractual and non-contractual liability, consumer protection, data protection and any other sector-specific legislation that may apply. The use of AI does not replace or remove these obligations.

AI Act obligations applicable to AI systems with autonomous capabilities

The AI Act follows a risk-based approach. This means that the applicable obligations do not depend solely on whether a system operates autonomously, but primarily on what the system is used for and the risks associated with that use.

As of 2 August 2026, the Regulation applies generally, without prejudice to the specific timetable established for certain obligations. In addition, the provisions concerning AI literacy have applied since February 2025.

For companies, this means moving away from the idea that it is sufficient simply to acquire a technological solution and start using it. Before deploying an AI agent, companies should determine their role under the AI Act, assess the level of risk associated with the system, establish appropriate internal controls and adequately document its use.

Where a system is classified as high-risk, issues such as human oversight, record-keeping, monitoring of the system’s operation and the ability to intervene where its outputs may create risks become particularly important. The AI Act itself requires individuals responsible for human oversight to have the necessary competence, training and authority.

The practical consequence is clear: the greater the autonomy a company grants to an AI agent, the more important it becomes to define in advance what the system may do, what it may not do and when human intervention is required.

The implementation of AI agents is therefore not merely a technological decision. It also requires the development of an appropriate governance model capable of determining who controls the system, who supervises its actions and who bears responsibility when something goes wrong.