AI Agent Liability: Who Is Responsible When Things Go Wrong?

Who is liable if an AI agent causes harm?

The short answer is: you. Or rather, the firm or professional who chose to deploy the agent, defined its permissions and embedded it in their processes. As Agenda Digitale explains, the shift from outputs to actions moves the centre of gravity of liability: it is no longer a matter of assessing whether a piece of text was correct, but of establishing whether an action was authorised, proportionate and traceable.

Under current Italian law — and even more so under the framework of the EU AI Act — high-risk AI systems require human oversight. But 'oversight' does not mean watching from the sidelines: it means having written procedures, action logs, explicit limits and a named responsible person. If the agent acts beyond the boundaries you set, the judge's question will be: how do you demonstrate that those limits existed and were being enforced?

For a professional firm this question carries additional weight: an accountant, lawyer or employment consultant is also answerable on disciplinary grounds. An AI agent that sends a confidential document to the wrong client is not merely a technical error — it may constitute a breach of professional secrecy with disciplinary consequences. Agent governance is therefore, in every respect, part of the governance of the firm itself.

CEO fraud and voice deepfakes: the risk nobody sees coming

In February 2026, Fideuram fell victim to a fraud totalling approximately €95 million, with €36 million still unrecovered. The fraudsters used WhatsApp messages that appeared to come from Intesa Sanpaolo CEO Carlo Messina, combined with an AI-cloned voice imitating that of a well-known business lawyer. The combination of urgency, perceived authority and a familiar voice persuaded the right people to authorise the transfers.

This is not an isolated case. As Key4biz reports, AI-powered CEO fraud has already struck Massimo Moratti (nearly €1 million, later recovered), Maire Tecnimont (€18 million transferred to Chinese banks), Sisal (€5.5 million), and came close to hitting Ferrari and advertising group WPP. In the Arup case in Hong Kong, an employee joined a video call featuring real-time deepfake avatars of colleagues and the CFO, and transferred $25 million as a result.

The connection to AI agents is direct: if you have an agent managing emails, authorising payments or accessing business systems, a fraudulent instruction — delivered by voice, text or WhatsApp — can become the trigger for an automated action. The agent has no critical judgement about the intentions behind a command: it simply executes. This means that defending against CEO fraud can no longer rely on recognising a voice or trusting a sender; it must become procedural and independent of the AI itself.

What Italian Law 132/2025 changes for traceability and evidence

Italian Law 132/2025 introduces traceability requirements that directly affect anyone using AI agents in a professional or business context. The underlying principle is that an automated system that produces legal effects must leave verifiable traces: who gave the instruction, at what moment, with which parameters, and what action followed. Without this documentary chain, it is impossible in any dispute to separate the agent's legitimate action from an error or fraud.

For professional firms, this intersects with existing obligations — document retention, the duty to inform clients about the use of AI (already required by professional codes of conduct and reinforced by Italian Law 132/2025, as we examined in our article on Italian Law 132/2025 and client disclosure) — and GDPR compliance. An AI agent activity log is not just good practice: it is becoming an implicit compliance requirement.

The practical consequence is that anyone who deploys an AI agent today without a structured logging and evidence-retention system faces a double risk: the risk of the incident itself, and the risk of being unable to mount a defence even when the incident is not their fault. Preventive documentation is the first line of defence — not a bureaucratic box-ticking exercise to be done after the event.

What to document before deploying an AI agent

• ✓
  Written usage policyDefines what the agent can and cannot do, with which data, and to which recipients.
• ✓
  Permission scopeMinimum necessary access: no permissions beyond what is strictly required for the assigned task.
• ✓
  Retained action logsEvery agent action is recorded with a timestamp, parameters and output, and retained for the period required by law.
• ✓
  Named internal ownerA named individual is responsible for supervising the agent and knows how to intervene if an anomaly occurs.
• ✓
  Human verification procedures for high-risk actionsBank transfers, sending confidential documents, communications to third parties: all require explicit human confirmation via a channel outside the AI system.
• ✓
  Updated client disclosureClients are informed that part of the service is delivered with the support of automated systems, as required by Italian Law 132/2025.
• ✕
  Incident response planA clear plan covering what to do in the first hours if the agent takes an unauthorised action or becomes a vehicle for fraud.

How to build a control framework that holds up in litigation

A control framework for AI agents is not a technical firewall: it is a set of rules, procedures and documentary records that allow you to answer the question a judge, the Italian Data Protection Authority (Garante) or a client will ask: 'How do you demonstrate that the agent acted within the limits you had set?' The answer must exist before the incident — not be constructed after it.

The starting point is the principle of least privilege: the agent receives only the permissions strictly necessary for the task it is performing. If it manages incoming emails, it does not need access to the accounting system. If it processes tax documents, it does not need to send communications to clients on its own initiative. Every unnecessary permission is an additional attack surface.

The second element is the separation between the AI channel and the verification channel. CEO fraud works because it exploits urgency and trust in the channel: a familiar voice, a message that looks authentic. The defence is not technological but procedural: for any action that exceeds a defined threshold — financial, confidentiality-related or impact-related — confirmation must arrive through a different, independent channel, using a passphrase or code agreed in advance. The Ferrari case is instructive: the manager who asked the fake Vigna to name a book title stopped the fraud with a simple question.

The third element is periodic review. Agent logs must be read, not merely retained. A monthly review of anomalous actions — out-of-hours instructions, unusual recipients, unexpected data volumes — is the most effective way to catch a problem before it becomes irreversible. For anyone managing an operational CRM with automated workflows, this kind of review can be integrated directly into system reports.

The concrete risks for an SME or firm with no AI governance

The temptation to deploy an AI agent without first structuring governance is understandable: the tools are accessible, results are immediate, and procedures feel like a slowdown. But the data from the NordVPN National Privacy Test 2026 paint a worrying picture: only 43% of Italians recognise an AI-generated scam and just 25% can identify a deepfake. This means that the majority of employees, collaborators and even firm owners are unable to recognise a fraudulent instruction that looks authentic.

For an SME or professional firm, the concrete risks operate at three levels. The first is operational risk: a poorly configured agent that sends the wrong document to the wrong client, executes an out-of-context action, or gets stuck in a loop on a critical deadline. The second is fraud risk: a fraudulent instruction — delivered by voice, text or email — that the agent carries out because it falls within its defined scope and it has no means to question it. The third is legal and reputational risk: the inability to demonstrate, after the incident, that the agent had defined limits and that those limits were being enforced.

Anyone who has already read our article on AI agent risks in professional firms knows that the problem is not AI itself, but the way in which it is integrated into processes. A well-governed AI agent reduces operational risk compared with manual processes, because it is traceable and consistent. An AI agent without governance amplifies it, because it acts autonomously on foundations that nobody has ever committed to writing.

Why email and communications management is the first control point

If there is one area where AI agent governance has an immediate impact for a professional firm or SME, it is inbound communications management. Emails, certified electronic mail (PEC), messages: these are the primary vector for CEO fraud, the channel through which fraudulent instructions arrive, and often the first system to be automated with an AI agent.

An agent managing an email inbox must have clear rules about what it can do on its own and what it must bring to a human's attention before acting. A draft response prepared by the agent and approved by the principal is a sound governance model: the efficiency of automation combined with human control over sensitive content. This is very different from an agent that sends independently, with nobody seeing what has gone out and to whom.

Equally, call transcription and summarisation — with client attribution and structured retention — automatically builds part of the audit trail you need for compliance: who asked what, when, and what response was given. This is not just operational efficiency: it is documentary traceability that counts in litigation too.

Communications and AI agents: what must remain under human control

• ✓
  Instructions involving payments or bank transfersAny financial instruction must go through verification on an independent channel, using a pre-agreed code.
• ✓
  Sending confidential documents to third partiesThe agent prepares; a human approves before sending. No confidential document sent autonomously.
• ✓
  Responses to new contacts or prospective clientsThe agent can handle the first response, but qualification and sensitive information require human oversight.
• ✕
  Urgent communications from authority figuresThe more urgent and authoritative the instruction, the more it must be verified. Urgency is a warning sign, not a reason to act faster.
• ✕
  Updates to sensitive data in business systemsChanges to client personal, tax or bank details must be confirmed by a human operator.