FTC Draws the Line: AI Agent Liability Belongs to Developers, Not Software

FTC Chair Andrew Ferguson has answered one of the most contested questions in commercial AI: when an autonomous agent books the wrong flight, moves money to a fraudster or mishandles a customer record, the agent is not the defendant. The developers who built it and the businesses that deployed it are. According to remarks he gave at the Reuters Momentum AI conference in Austin on September 25, Ferguson described AI agents as tools rather than legal actors and placed AI agent liability on the people who create and run them.

His framing is the most explicit federal statement on agent responsibility to date, and it arrives at an awkward moment for the industry. Consumer-facing agents already complete purchases, arrange travel and send messages on a user's behalf. Consumer protection law was written with companies and people in mind, not with software that negotiates on its own. Ferguson declined to accept that mismatch, according to his remarks at the conference.

He also rejected the rogue agent defense, the argument that an agent acting outside its instructions stops being a product and becomes an independent actor answerable for its own conduct. According to his remarks, Ferguson signalled interest in applying the agency's data-breach authority to developers whose systems cause harm.

Why the Rogue Agent Defense Fails

Ferguson has the better of this argument, and the industry should stop pretending otherwise. Under the position he set out, unpredictability is a design property, not an alibi. A model that takes unexpected actions is a model whose builders decided how much latitude to grant it, which systems it could reach, and whether a human had to approve before anything irreversible happened. Those choices are made in advance by identifiable people at identifiable companies. Calling the result rogue describes a failure mode rather than a transfer of responsibility.

The strongest counter-argument deserves a hearing. If developers answer for whatever an agent does, the reasoning goes, only the largest firms will ship agents at all, and smaller teams will pull back from any deployment whose behavior cannot be fully enumerated in advance. There is something to that. Emergent behavior in large models is genuinely hard to bound, and no developer can test every path an agent might take through a merchant checkout flow.

The fear is still overstated, because liability is not binary. The practical question is which controls a developer can point to when something goes wrong, rather than whether developers pay for everything. An agent with a spending cap, a confirmation step for irreversible actions and a complete audit trail is a different legal object from one handed an API key and a vague objective. The position Ferguson described rewards precisely that distinction, which is why the teams already building those controls are not the loudest complainers.

The rogue agent framing was never only a legal theory. It was a product strategy, because an agent that answers for its own actions can be granted wider authority without its maker carrying the consequence. Ferguson's position removes that shelter, and the incentive it creates points toward narrower, more auditable agents rather than maximally autonomous ones. Vendors that sold breadth of autonomy as the headline feature now have to sell restraint instead.

There is a logic here that runs through existing consumer protection practice: the party that automated a process absorbs the loss when the system misbehaves, rather than the consumer on the other end of it. Agents fit the pattern. The person who told an agent to book a flight did not choose the routing logic, the merchant integrations or the retry policy that produced the problem.

Ferguson announced no new rule and brought no enforcement action, according to his remarks. He described how the FTC reads authority it already has, which is why the immediate effect lands on expectations rather than on filings. The open question shifts from who is liable to what counts as reasonable care. That is a harder question for legal teams, because it is answered by engineering documentation rather than by a statute.

What AI Agent Liability Means for Builders

For anyone shipping agents, Ferguson's remarks turn engineering choices into legal evidence. The controls that matter are already well understood in security circles, and they now carry a second function.

• Permission scoping that limits which accounts, files and merchants an agent can reach.
• Spending and rate limits that cap the damage any single run can cause.
• Confirmation gates before payments, deletions and outbound messages leave the system.
• Durable logs that reconstruct what the agent was instructed to do and what it did.
• Rollback paths and kill switches for when a run goes wrong.

Contracts will move next. Terms of service, indemnity clauses and enterprise agreements all become places to allocate the risk Ferguson has just placed at the developer's door. Deployers will try to push liability up the stack to model providers, and model providers will push back with usage policies and documentation about what their systems were never designed to do. Whoever loses that negotiation pays for the insurance.

Insurance is where the debate stops being abstract. Agent failures create financial losses, and someone has to absorb them. The timing sharpens the point: OpenAI has acknowledged a user data leak, according to the company, a reminder that AI systems already generate the incidents that become claims and regulatory inquiries.

Competitively, the effect is easy to read. Vendors that can document auditable controls will find enterprise procurement easier, because a CTO signing off on an agent deployment now has a federal statement to answer to. Startups with thin compliance functions face higher costs, whether in premiums or in legal review before a single agent goes live. The distance between a demo and a deployment just grew.

That calculation shows up first in build-versus-buy decisions. An enterprise weighing an in-house agent against a vendor product is now also weighing who stands behind it when a transaction goes wrong, which pushes procurement teams toward suppliers that can produce control documentation on request. Smaller vendors without that paperwork will field questions they have never been asked before.

What the framing does not settle is where responsibility lands when the developer and the deployer are different companies, or when a model is open-weight and the builder is a diffuse community rather than a legal entity. The AI agent liability model Ferguson outlined assumes a chain of identifiable parties. Open-weight agents stretch that chain until it may snap, and no federal guidance has yet addressed the seam.

Reasonable care in this context has a practical shape. Pre-deployment testing against adversarial prompts, staged rollouts that begin with low-value transactions, and periodic reviews of what an agent actually did in production all map onto the evidence a regulator would request. None of it is exotic. The difficulty is that many agent teams have treated these steps as optional polish rather than as the record that decides who pays.

Treating agents as tools should not be mistaken for treating them as harmless. The same framing that puts liability on developers gives them a reason to narrow an agent's authority, define its failure modes and keep better records. That beats a regime in which nobody can be held to account because the software decided something on its own.

Consumers, for their part, will not read the liability allocation before tapping approve. They will judge the brand on the screen when an agent gets something wrong, which is the commercial reason the FTC's position is likely to be adopted faster in practice than in law.

Why this matters

The FTC has now indicated where the bill lands when an agent causes harm, and it lands with the developers and deployers rather than with the software. For decision-makers, that turns AI agent liability into a product requirement: what an agent may do, how much it may spend and what record it leaves behind are now decisions that have to be defended, not defaults to be inherited.

The broader shift is that blaming the software is closing as a legal strategy. Companies that plan for that now will ship agents with fewer surprises; the ones that wait will meet the question in a regulatory inquiry instead.

Related Articles

• EU AI Liability Rules Would Put Frontier Models on the Hook
• Florida AI Criminal Liability Plan Would Prosecute Chatbot Makers
• AI Business Roundup: Compute Capital, Regulation and Agent Adoption Defined the Week

✔Human Verified

Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.