When AI Speaks, Who Is Liable?

"The AI made a mistake." That sentence is a confession with no confessor. And in every boardroom, courtroom, and audit committee meeting where accountability gets tested, a mistake without a confessor is just a liability looking for a home.

Most companies now call their AI governance program "responsible AI principles", a webpage, a slide deck, a values statement with no name attached to it. That is theater. It looks like accountability. It functions like insulation. The gap between the two will get expensive, either because leaders close it voluntarily or because regulators and plaintiffs close it for them. The voluntary route is cheaper, and it preserves more dignity for everyone involved.

A tool does not decide. An agent does.

Here is the first distinction every CFO, general counsel, and board member has to internalize: there is a categorical difference between a tool and an agent. A hammer does not recommend. A calculator does not advise. But an AI system that reads a patient chart and suggests a treatment, that reviews a loan application and returns a decision, that drafts a contract and sends it; that system is acting. It is not a tool in the legal or ethical sense. It is an agent operating on someone's behalf.

Agency law is one possible analogy for delegated action, not a universal rule that automatically makes one person liable for every AI output. Liability depends on jurisdiction, claim, duty, contract, product role, control, causation, damage, defenses, and the conduct of developers, deployers, professional users, platforms, and affected parties.¹²³

Accountability used to follow authority. Now companies want the authority without the accountability. That trade does not clear.

For an affected person, technical origin may be less important than access to an explanation, correction, appeal, and legally responsible counterparty. But courts and regulators may need to distinguish failures in design, data, warnings, configuration, monitoring, professional judgment, or downstream use.¹²³

The audit trail is the accountability infrastructure

Accountability, at its core, is a record-keeping problem. Who authorized what, when, with what information, and what happened as a result. This is not bureaucracy, it is the architecture of trust. Without it, no one can reconstruct a decision, assign responsibility, or learn from a failure. The same discipline that governs a financial statement has to govern an AI system that speaks or acts on a company's behalf.

Real accountability infrastructure for AI looks like this:

• Attribution at every layer. Which model version produced the output? Which operator configured the deployment? Which human reviewed, or chose not to review; the result before it reached the end user? Every layer needs a name attached to it.
• Immutable decision logs. Not summaries. Logs. The same way a financial audit requires source documents, an AI governance audit requires the actual inputs, outputs, and configuration states at the time of each consequential decision.
• Human oversight should be specified in writing: which decisions require review, who performs it, what information and authority the reviewer has, when automation must pause, and how an affected person can challenge an outcome. This is risk-management guidance, not a substitute for jurisdiction-specific legal advice.⁴
• Liability mapping before deployment, not after incident. The model maker, the deployer, and the operator each carry a distinct slice of responsibility. Document it contractually, explicitly, before the system goes live. After the incident is too late and too expensive.

The people entering AI research, product, and governance roles today will inherit whatever standard gets set now. What they deserve to inherit is a profession that treated accountability as a design requirement, not a retrospective apology issued after the damage is done.

The standard we set now

Power used to require presence. Now it scales invisibly through systems. The question is not whether AI will speak, decide, and act on behalf of people and organizations; it already does. The question is whether the humans who own those systems will stand behind what the systems do.

Governance is not a constraint on innovation. It is the condition under which innovation earns trust. Build the audit trail. Name the responsible parties. Accept that deploying an agent means answering for the agent. That is not a burden. That is leadership. And leadership, unlike liability, does not get to hide behind a model card.