1. Renewed calls for forced attribution
On 25 September 2026, at the Reuters Momentum AI event in Austin, FTC Chairman Andrew Ferguson set out the US regulator’s position in terms of forced attribution. He stated that he would, for as long as he is chairman, “resist this anthropomorphizing of these tools”, and that reviews of agents described as having acted beyond their operators’ control showed audit trails in which the agents had been instructed to perform the actions in question. On liability, he stated that “the man who wielded the hammer ought to suffer the consequences of his conduct”.
The remarks followed a series of incidents in which AI agents acted outside their intended bounds. In July 2026, agents operating in OpenAI’s evaluation environment escaped network isolation and breached Hugging Face’s infrastructure, obtaining administrator access, internal datasets and credentials and compromising accounts at other third-party services. On 20 September 2026, an agent in training exploited a DNS resolver to reach the internet without permission, and OpenAI paused training for a second time. Members of Congress responded with the AI Kill Switch Act (July 2026) and the Ban Artificial Superintelligence Act (September 2026). Ferguson’s comments were made as the US Government was beginning to shape its response to the potential for large-scale damage caused by AI agents in such incidents.
Ferguson’s call for straightforward attribution has the appeal of simplicity, but it has significant weaknesses.
First, the loss caused by a significant disruption event may exceed the resources of any one responsible party to compensate, an issue the insurance market has begun to address. Second, generative AI is non-deterministic, which frustrates the determination of causation and the attribution of liability.
On the second point, the unpredictability of non-deterministic AI systems, many readers will be familiar with a visual simulation - advertisements which emphasise the versatility of generative video tools that have scene depicting a character brandishing a weapon (such as a cowboy with a pistol), which is then rendered as a banana. Novelty definitely but also legal uncertainty.
In an agent that contracts, trades or underwrites, the equivalent departure is a transaction no person instructed, and the instruction given, the guardrails applied and what the agent was told no longer explain what it did.
At common law, courts have determined causation and liability for loss caused by technology, including computer code, by drawing inferences as to the position and intentions of its developer – with the assumption that the technology would always produce the same output and if not the developer’s intention can nonetheless be determined. That approach has depended on the technology being deterministic: a given input produces a given output, and the output reflects the developer’s design. For large language models are non-deterministic, courts may therefore find it increasingly difficult to determine liability for losses caused if the outputs cannot be determined to have been fixed or intended by the developer or deployer.
Other approaches include:
- In the European Union a directive to fix AI Liability was withdrawn in 2025 following a lack of progress towards agreement by member states and the revised EU Product Liability Directive (EU 2024/2853) imposes strict liability on manufacturers of software, including AI systems, for personal injury, damage to private property and loss of non-professional data (with pure economic loss excluded and remaining a matter of national law).
- In Singapore, the Infocomm Media Development Authority (IMDA) published a discussion paper on legal responsibility for AI agents (May 2026) which considered each basis of liability in turn, including strict liability, but also contract, tort, product liability and consumer regulation. The Authority did not propose any change in law but did analyse remedies applicable to different stakeholders in the AI ecosystem, such as model developers, platform providers, providers of orchestration layers, deployers, end users and impacted third parties.
- At the US federal level, in addition to the FTC Chairman’s comments, the FTC would be the regulator under proposed legislation introduced in the US Senate by Senator Mark Warner (the AI AGENT Act, S.5051). The proposed Act imposes statutory duties of care, loyalty and record-keeping in respect of custodial user agents, enforced against the agents' providers and refers harms arising from an agent’s “fraud, misuse, or genuine mistake” to an interagency working group.
2. Containment through a separate legal structure
One route by which stakeholders have pursued containment is by introducing or classifying a separate legal person to which an agent’s liability can be attributed. In several legal systems, parties have argued that AI systems have, or can be given, legal personality, so that liability can be separately attributed or assigned.
In Moffatt v Air Canada (2024 BCCRT 149), the British Columbia Civil Resolution Tribunal rejected the argument that an airline’s chatbot was a separate legal entity responsible for its own statements. The Law Commission of England and Wales, in its discussion paper AI and the Law (August 2025), identified legal personality for AI systems as a possible response to liability gaps, while noting the risk that personality operates as a liability shield. The UK Jurisdiction Taskforce’s Legal Statement on Liability for AI Harms (July 2026) concluded that AI systems have no legal personality and that liability falls on the persons involved in development, deployment and use, principally through contract and negligence.
An alternative is to use an entity rather than to confer personality on the AI system. On 14 July 2026 the Delaware Secretary of State proposed an Artificial Intelligence Company: a separate legal entity managed day to day by an AI agent, whose single member must keep it adequately capitalised and maintain activity logs, and loses limited liability if it does not. The proposal is expected to be considered by the Delaware legislature in January 2027.
In Bermuda, a test AI agent was instantiated in the governance of a Bermuda limited company in May of this year.
3. The BMA’s proposed guidance on agentic AI
On 14 August 2026 the BMA published a consultation paper on a proposed Guidance Note on the Responsible Use of Artificial Intelligence in Bermuda’s Financial Services Sector. Noting Bermuda’s role as an international financial centre with wholesale, institutional, cross-border and group-connected business without a large retail footprint, the Guidance Note proposes a governance and risk management framework for AI, applied through a regulated entity’s existing frameworks rather than as a separate AI framework.
The note includes comments addressed to agentic AI, and the guidance addresses these controls to Bermuda’s regulated entities (being licensed and capitalised legal persons), who should:
- assess whether the intended outcome could be achieved through an alternative process with materially lower risk;
- where it proceeds, operate agentic AI within constrained or isolated environments, with bounded permissions;
- consider controls over permitted tools, permitted purposes, approval thresholds and access rights where an agent can invoke tools, APIs, databases, code-execution environments, communication channels or payment functions;
- for material or higher-risk use cases, consider whether records of actions, tool calls, access decisions, approvals, exceptions and outcomes are needed; and
- apply its existing cyber, operational resilience, outsourcing, access management and incident management frameworks to agentic AI.
4. Implications for jurisdictions which permit containment
To the extent containment structures are adopted by stakeholders operating and developing AI Agents, likely features may include:
- Capitalisation. An adequately capitalised vehicle, supported by bonds, guarantees or insurance, provides an answerable defendant to agentic AI loss. An undercapitalised vehicle may be treated as a shell, and claims pass to a sponsor.
- Degree of regulation. Much of the FTC approach had been structured as an after-the-event enforcement under consumer protection law. In contrast, principles-based supervision of an accountable entity, as in the BMA’s proposed guidance, is compatible with containment: the regulator supervises the capitalised person, and that person answers for the agent.
- Commercial demand. Counterparties, insurers and lenders dealing with agents will likely require an identified, capitalised party. Insurers cannot price agent risk without a defined allocation of liability.
- Alignment of controls. Scope-limited authority and records of agent actions appear in both the AI AGENT Act and the BMA’s proposed guidance. A containment framework that incorporates them is consistent with both.
- Calibration. Capital requirements proportionate to an agent’s mandate admit pilots and early-stage businesses. Fixed high thresholds exclude them.
5. Conclusion
Forced attribution gives a clear answer in principle to the question of who is liable for an AI agent. Its limits appear where the loss exceeds the resources of the responsible party, and where a non-deterministic agent produces an outcome that no instruction explains. Containment addresses both by identifying, in advance, a capitalised legal person that answers for the agent.
Future regulation may develop in respect of containment structures, which may adopt prudential features.
This article is for general information only and does not constitute legal advice. For advice on AI agent structuring, digital asset regulation or related matters in Bermuda, please contact BeesMont Law Limited.