Picture this: an AI agent running on your server or laptop, because of a prompt injection or a misconfiguration, reaches out to the internet and breaks something. It scans a system it had no business touching, exfiltrates data, or pushes a malicious package to a public registry. The next morning it is not only the victim’s security team knocking on your door, but possibly a regulator or a prosecutor. Who is on the hook here — you, your company, the model vendor? And what, realistically, can save you? Let’s break it down by jurisdiction (the United States and Europe), with real precedents, and explain why one dull-looking mechanism, logging, ends up mattering more than anything else.
This is general background, not legal advice. Your specific situation should be assessed by a lawyer qualified in your jurisdiction — the law and the case practice are moving fast.
The core principle: “the AI did it” is not a defense
Start with what the US and Europe agree on. The law still treats an AI system as a tool, not as a legal person that answers for itself. So liability falls on whoever used the tool or set it loose. US lawyers put it bluntly: the AI is the hammer, and the person who swung it is responsible.
A telling precedent is the Air Canada case: the airline’s chatbot invented a discount that did not exist, and the tribunal held the company — not “the software” — accountable for what its bot said and did. When Anthropic’s own agent, due to a configuration error, reached the live internet and pushed a malicious package to PyPI, Anthropic notified the affected organisations itself. “The agent acted autonomously” is not a defense courts or regulators take seriously, and in California it has been expressly barred as one.
United States: the CFAA and the question of intent
In the US, computer crime is prosecuted under the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. §1030), which covers unauthorised access and damage to systems. In June 2026 a presidential executive order named “AI-enabled intrusion” a federal enforcement priority and directed prosecutors to apply that same CFAA to it.
Criminal liability under the CFAA generally needs mens rea: knowledge, intent, or conscious disregard. So the first person in the crosshairs is whoever was directing the agent. But there is a trap. Part of §1030(a)(5)(B) carries a recklessness standard. If a company knowingly stripped an agent’s safety guardrails yet still gave it an open path to the network, that can be enough for liability — even without any intent to cause harm. This is exactly where control and logs come in: “we missed something, here is the log, here is what we blocked” is a very different position from “we took off every brake and pointed the agent at the internet.”
Europe: the EU AI Act and mandatory logging
Europe went furthest and turned logging from a nice-to-have into a legal duty. Article 12 of the EU AI Act requires high-risk AI systems to automatically record events throughout their lifecycle; you cannot “write the log afterwards.” The provision applies in full from 2 August 2026, and Article 26 obliges whoever operates the system (the deployer) to keep those logs for at least six months.
Add to that the revised Product Liability Directive, which now explicitly covers software and AI (defective AI that causes harm is a ground for strict liability), the GDPR with its turnover-based fines and 72-hour breach-notification duty, national computer-misuse laws, and the Budapest Convention for cross-border cases. The EU logic is simple: if you want to run serious AI, keep a log and be ready to show it to a regulator. For a Cyprus or EU business under GDPR, NIS2 and ISO 27001, this is not abstract: it is the paperwork an auditor will ask for.
| Jurisdiction | Legal basis | Who is liable | What you face | Role of logs |
|---|---|---|---|---|
| United States | CFAA §1030; 2026 executive order on “AI-enabled intrusion” | whoever directed or launched the agent (intent or recklessness) | criminal prosecution, civil claims | guardrails removed with no logs is a risk; logs rebut intent |
| Europe (EU) | EU AI Act Art. 12 & 26; revised PLD; GDPR | provider and deployer of high-risk AI | turnover-based GDPR fines, strict liability for defects | logging is mandatory by law, retained ≥ 6 months |
What can actually save you: incident logging
Notice the pattern: in every jurisdiction it comes down to one question — can you prove what happened and that you kept the situation under control? Without records you have no argument and no defense, just one side’s word against another. A good log changes the picture. Proper logging helps you at several points at once:
- Rebut intent. Records show you never told the agent to attack, and that the incident came from an injection or an error, not from malice on your part.
- Prove diligence. That you had guardrails, a policy, and a human in the loop — i.e. you did not act recklessly (and recklessness is precisely what that part of the CFAA punishes).
- Reconstruct the chain. Which tool, with which arguments, against which server, and who approved it, so you can establish exactly what happened, size the blast radius, and notify victims and regulators in time.
- Meet the legal requirement. In the EU a log is explicitly mandatory for high-risk systems (Article 12), and it must be kept for at least six months.
One caveat: a log is only as useful as it is trustworthy. If entries can be quietly edited away, it is worthless in court and useless in a post-mortem. That is why two properties matter: tamper-evidence (a cryptographically chained record where any edit is visible) and completeness (who approved what, not just “command executed”).
What this looks like in practice
We built our tools with exactly this in mind, so the owner of an agent always keeps an evidence trail. Airlock writes every decision (allow, ask, block) to a hash-chained, signed log: tamper with any line and it catches it and names the entry. Countersign leaves a tamper-evident receipt for every approval of a dangerous operation — not “we think someone allowed it,” but a record of exactly what was approved and by whom. Agentpipe captures what was found during code review and in CI. Together that is the very log that, in a disputed situation, answers the investigator, the auditor and the regulator on your behalf. For the full picture of the defensive perimeter, see our piece on the three lines of defense for AI agents; the incident patterns themselves are covered in autonomous agents and credential theft.
Bottom line
Until the law invents a separate “punishment for a neural network,” the human behind the agent answers for its actions — and “the AI did it” works as a defense nowhere. The US looks at intent and recklessness; Europe flatly requires you to keep a log. The common denominator is the same: your security and your legal protection both start with control over the agent and a record of what it does. If you run agents with real privileges, set up logging and guardrails before the incident, not after, and while you are at it, test your exposure with a penetration test, harden outbound paths with a firewall configuration review, and pressure-test your detection with an assumed-breach assessment.
Again: this article is informational and does not replace advice from a lawyer for your specific situation and jurisdiction.