Liability: The Deployer Pays by Default, and Your Audit Trail Is the Defense

As of June 2026, no court anywhere has decided liability for a defect in agent-written code, and outside copyright the default answer is settled anyway: the company that deployed the agent pays, out of pocket. The same seven properties that satisfy an auditor are also your claims evidence, because the question an insurer's subrogation team asks is the question a regulator and a plaintiff's counsel ask. The best-documented agent-caused production incident, the Replit database deletion, was resolved with a public apology and a refund (The Register). In the absence of case law, who pays is decided by two documents almost nobody reads at signing time: the vendor's terms of service and your insurance policy's exclusion list. Both currently point the same direction.

The only real vendor promise is about copyright

GitHub/Microsoft, Anthropic, and OpenAI all offer indemnities on generated output, and all three cover the same narrow thing: copyright infringement claims, on paid tiers, with conditions attached. Microsoft's Copilot Copyright Commitment requires the duplicate-detection filter to be enabled (Kate Downing's analysis). Anthropic's commercial terms cover copyright claims from authorized use of outputs, with carve-outs for customer modifications and combinations (Anthropic). OpenAI's Copyright Shield is the same shape, enterprise and API tiers only (Proskauer).

For everything that is not IP, bugs, data loss, outages, security holes, the terms run the other way. Replit's ToS is representative: AI-generated code "may be erroneous or incomplete," Replit "accepts no responsibility or liability for the accuracy of content," and liability is capped (replit.com/terms-of-service). In B2B practice the customer indemnifies the vendor more often than the reverse.

Your insurance is getting worse at exactly this risk

While vendors cap their exposure, the conventional insurance market is withdrawing. ISO filed three generative-AI exclusion endorsements for CGL policies, issued around January 2026, and Berkley filed an "absolute" AI exclusion for D&O, E&O, and fiduciary lines, barring claims "based upon, arising out of, or attributable to" any use, deployment, or development of AI (Policyholder Pulse). Per Business Insurance, more than 80% of such filings have been approved by state regulators (Business Insurance).

Even without an exclusion, there is the "silent AI" problem: most cyber policies trigger on a security breach, and a pure agent malfunction with no attacker may fall outside the wording entirely. Neither insurer nor insured knows in advance (HealthsystemCIO).

Affirmative cover exists but is young: Munich Re's aiSure performance warranties (Munich Re), AXA XL's generative-AI cyber endorsement, and AIUC's audit-priced policies, covered in Certified and Insured and the AIUC-1 chapter. One academic synthesis argues no single product works and you need "a layered ecosystem of complementary coverages" (arXiv

.05449).

Strict liability arrives in the EU on December 9, 2026

The revised Product Liability Directive (EU 2024/2853) treats software, including AI systems however delivered, as a product under strict liability, with member states required to transpose by December 9, 2026 (Gibson Dunn). The manufacturer who ships the product is liable for defects; how the code was authored is irrelevant to the victim's claim. Liability extends to defects introduced after release via updates or machine-learning behavior, and corrupted data is now compensable damage (Goodwin). The companion fault-based AI Liability Directive was withdrawn in 2025, leaving fault-based claims to divergent national law (IAPP).

The US has no statute. The signals point at the deployer: the UK CMA's March 2026 guidance puts consumer-law responsibility on the business deploying the agent, and Colorado's AI Act draws the same developer/deployer split (Cooley). Mobley v. Workday is the crack in the deployer-only wall: an AI vendor held potentially liable as the employer's agent. K&L Gates calls AI product liability "the next wave of litigation" (K&L Gates).

Only copyright lands on the vendor; every other failure lands on the deployer

The audit trail you already keep is your claims evidence

A subrogating insurer, a regulator, and a PLD plaintiff's counsel all open discovery with the same asks: whose change was this, what did the agent have access to, and what was the approval chain? Those answers are not paperwork you assemble after a claim. They are produced by the way the work runs. Attribution resolves every change to a distinct agent identity bound to a human, and the audit trail records the access and the approval chain as a byproduct of normal operation. The arXiv agentic-insurance paper makes telemetry and transparency a pricing precondition, so a missing per-task event log raises the premium before it fails the audit. Two practical moves follow: check your own policies for AI exclusions at renewal, and set log retention to a plaintiff's discovery window of years, not an auditor's lookback.