Compliance & Privacy · 2026-04-22

The Liability Gap in Agentic Commerce: Responsibility When an Agent Commits Fraud

By J. W. Bouckaert

An AI shopping agent with a valid corporate card on file walks into a programmatic ad exchange and buys $480,000 of inventory from a domain that turns out to be a click-fraud farm. The agent acted inside its scope. The card cleared. The merchant's books show a normal transaction. Three weeks later, the brand's CFO discovers the loss and asks the only question that matters: who pays?

In 2026, that question does not have a clean answer. It has three competing answers, each grounded in a different legal regime, each producing a different defendant, and each hinging on what evidence is actually available at the moment of dispute. The technical layer that determines which answer wins is the identity layer—specifically, whether the principal who deployed the agent can produce a cryptographically verifiable delegation receipt that proves the scope of authority granted, and whether the relying party can prove it checked the receipt before accepting the transaction.

This article maps the three competing liability regimes onto the agentic commerce stack, explains why traditional agency doctrine breaks down at machine speed, and shows how cryptographic delegation receipts—issued by a human principal, scoped to a bounded mandate, and verified by every counterparty—convert an evidentiary question into a deterministic one. It is the same shift that EMV chip-and-PIN produced for card-present fraud, applied to a transaction surface that is about to grow by two orders of magnitude.

A new question

Autonomous software has executed transactions for a long time. High-frequency trading systems, programmatic ad bidders, and supply-chain replenishment agents have settled trades without human-in-the-loop confirmation for over a decade. What is new in 2026 is the combination of three properties.

• Open-ended scope. A modern LLM-driven agent does not execute a fixed strategy. It plans, decomposes goals, and improvises. The set of actions it might take is not knowable in advance.
• Cross-tenant settlement. Agents transact with counterparties whose own agents are operating under different principals, different policies, and different security postures. There is no common trust authority.
• Latency budget. A human cannot review a transaction in 50 ms. Either the trust decision is made cryptographically at the edge or it is not made at all.

Together, these properties produce a class of fraud that the existing legal frameworks were not designed to handle: the fraud that occurs entirely within the boundary of authorized scope, where every wire-level signal looks compliant and the only question is whether the scope itself was correctly delegated.

The three competing liability regimes

There are three doctrines a court will reach for, and a CFO needs to know which one applies before the agent is deployed, ahead of any loss.

These regimes do not exclude one another. A U.S. brand whose deployer-side fraud loss occurs against an EU counterparty can be sued under EU AI Act Article 26, examined under U.S. agency doctrine in arbitration, and held to its own NIST AI RMF profile by its insurance carrier—all in the same matter, all on the same set of facts. The single connective thread across all four columns of the table is evidence: the party that can produce a cryptographic record of who authorized what wins. The party that cannot, loses.

Agency doctrine

The Restatement (Third) of Agency, the closest doctrinal fit in U.S. common law, defines agency as "the fiduciary relationship that arises when one person (a 'principal') manifests assent to another person (an 'agent') that the agent shall act on the principal's behalf and subject to the principal's control." Two words in that definition do not survive contact with autonomous AI agents.

The first is person. An LLM-driven agent is not a person and cannot be a fiduciary. Courts have therefore been reaching for the analogy of the "agent as instrument"—closer to a calculator or a power of attorney than to an employee. The instrumental framing is workable, but it places 100% of the liability on the principal, with no doctrinal release valve when the instrument behaves in ways the principal did not specifically authorize.

The second is control. Common-law agency presumes the principal can supervise the agent's acts—through training, instruction, observation, or recall. None of those mechanisms operates at the timescale of an LLM agent making 200 ms transaction decisions. Courts have not yet decided how much "control" is enough to ground vicarious liability in the absence of real-time supervision. The early case law in 2025–2026 has split: some courts treat written scope-of-authority documents as sufficient; others require evidence of behavioral monitoring at the moment of the transaction. A cryptographic delegation receipt with a fresh attestation timestamp speaks directly to both.

The EU AI Act

The AI Act's two-tier provider/deployer model is more determinate than common-law agency. Article 16 places obligations on whoever "develops an AI system or has an AI system developed and places it on the market or puts it into service under its own name or trademark." Article 26 places obligations on whoever "uses an AI system under its authority," with carve-outs for purely personal non-professional activity.

For agentic commerce, this is a clean split most of the time:

• The model lab that trains and ships the foundation model is a provider.
• The agent platform that wraps the model with tools and a planner and offers it as a service is also a provider (and may also be a deployer for any agents it operates internally).
• The brand that runs the agent against its own corporate accounts is a deployer.

The deployer carries the meaningful obligations for fraud. Article 26(6) requires deployers to keep "logs automatically generated by that high-risk AI system to the extent such logs are under their control" for at least six months. Recital 78 makes clear that this obligation exists precisely so that ex post investigation is possible. A deployer that cannot produce logs sufficient to reconstruct an agent's decision sequence has, by the regulation's own terms, breached its duty—and the burden of proving it did not contribute to the loss has shifted onto its shoulders.

The recast Product Liability Directive

The recast Product Liability Directive (Directive (EU) 2024/2853) is the second pincer of EU enforcement and it changes the evidentiary calculus dramatically. Three points matter for agentic-commerce fraud.

1. Software is a product. Article 4 expressly includes software (including AI systems) in the definition of product. This was contested under the 1985 directive; it is not contested anymore.
2. Strict liability with broadened damage categories. Article 6 covers material damage including destruction or corruption of data that was not used for professional purposes. Pure economic loss falls outside, but the data-loss head is broad enough to capture many fraud-adjacent scenarios.
3. Presumption of defectiveness on non-disclosure. Article 10 introduces a rebuttable presumption that a product is defective if the producer fails to disclose relevant technical information that is within its control. Combined with the AI Act's logging obligations, this means an agent producer who cannot or will not produce its decision logs is presumed defective by default.

The directive entered into force on 9 December 2024; Member States have until 9 December 2026 to transpose it into national law. The transposition window is the operative deadline for agentic-commerce providers planning EU launches.

NIST AI RMF

NIST AI RMF 1.0 (NIST.AI.100-1) is voluntary and U.S.-centered, but its structure has become the de facto operational scaffold inside U.S. enterprises that need to evidence "reasonable" AI governance. The framework is organized around four core functions:

• Govern—culture, accountability, and policy for AI risk.
• Map—context, scope, and impact identification for each AI system.
• Measure—quantitative and qualitative analysis of identified risks.
• Manage—prioritized treatment, monitoring, and incident response.

For agent fraud specifically, the Manage function is where delegation receipts live. NIST's April 7, 2026 concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure signals that sector-specific profiles are arriving, and U.S. financial-services and telecom regulators have begun citing AI RMF compliance in supervisory letters. A delegation-receipt architecture is one of the few technical controls that simultaneously addresses MAP-2.3 (intended uses), MEASURE-2.6 (computational characteristics), and MANAGE-4.1 (post-deployment monitoring) in a single artifact.

The identity layer is the fault line

All five of the regimes above ultimately collapse to the same question: at the moment the agent acted, who had granted what authority, and was that grant verifiable? The legal scaffolding cares which doctrine answers it; the engineering scaffolding has to make any answer producible on demand.

Without a cryptographic record, the answer is reconstructed from indirect evidence: server logs, screen-recording playbacks, deposition testimony from the engineer who configured the system. That evidence is contestable, expensive to produce, and frequently insufficient. With a cryptographic record—a delegation receipt signed by the principal's passkey, bound to the agent's hardware-attested key, scoped to a specific mandate, and witnessed in an immutable audit log—the answer is a one-line proof.

This is the same evidentiary shift that EMV chip-and-PIN produced for card-present fraud in the 2010s. Before EMV, every disputed in-store charge was a swearing match. After EMV, the chip's cryptogram either verified or it did not, and the liability shift assigned the loss to whichever party had failed to upgrade. Agentic commerce is at exactly that pre-EMV moment now.

Anatomy of a delegation receipt

A delegation receipt, as we issue it through PasskeyBridge, is a compact verifiable credential containing six fields:

Every transaction the agent attempts requires the relying party to verify all six fields against the issuing tenant's signing key, the agent's hardware attestation, and a current trust attestation from PasskeyBridge's A2A handshake protocol. The combined proof is written to an immutable, hash-chained audit log under the tenant's signing key, so a six-month-later dispute can be resolved by replaying the chain rather than reconstructing the facts.

A worked example

Consider the click-fraud scenario from the opening. Under three different liability postures, the same facts produce three different outcomes.

The third row is the only one that prevents the loss rather than apportioning it after the fact. That is the reason to move the trust decision into the cryptographic layer.

Insurance and indemnity

The 2025–2026 cycle has produced the first generation of AI-specific cyber-insurance riders, and they are universally conditioned on evidence of governance controls. The Insurance Information Institute's overview of AI and the cyber-insurance market (updated 2025) flags AI-driven risks as a material new exposure, and Lloyd's of London's Generative AI cyber-landscape report (March 2024) explicitly forecasts that AI is reshaping cyber-attack frequency and severity over a 12–24 month horizon, with implications for model risk pricing. In practice this means three things:

• Premiums are higher for organizations that cannot produce delegation-receipt logs on demand.
• Coverage is narrower for losses arising from agent actions that fell outside documented scope.
• Indemnity from agent platforms (the major LLM providers) is universally conditioned on the deployer enforcing platform-side scope controls. A deployer that disables those controls voids the indemnity.

The effect is that the cryptographic-delegation architecture is no longer optional for organizations carrying material agentic-commerce exposure. The insurance market is pricing it in.

A defensible operational posture

A defensible operational posture in 2026 has four properties.

1. Every agent action is preceded by a delegation receipt verification. No exceptions, no caching beyond the receipt's stated lifetime.
2. Every receipt is bound to a hardware-attested agent key. The principal does not delegate to "an LLM" in the abstract; it delegates to a specific cryptographic identity rooted in a secure element. See our discussion of scope poisoning in delegation chains for what happens when this binding is weak.
3. Every verification produces an audit row in an immutable, tenant-signed log, retained at least the EU AI Act's 6-month minimum and in practice the 7 years required by SOC 2 evidence retention.
4. Trust decay is enforced at the policy layer. An agent whose behavioral score drifts outside its baseline has its scope automatically narrowed before a fraudulent transaction is attempted rather than after—see our work on trust decay functions for agent behavioral drift.

This posture is already what the EU AI Act's Article 26 logging duty, the Product Liability Directive's presumption of defect on non-disclosure, and the U.S. NIST AI RMF's MANAGE function all converge on. The technical artifact that satisfies all three is the same artifact: a verifiable, scoped, hardware-bound delegation receipt with an audit chain.

Electronic personhood

Periodically, a policy paper or a vendor white-paper proposes giving AI agents some form of legal personality so they can bear their own liability—the way corporations do. The 2017 European Parliament resolution on civil-law rules for robotics floated this idea. The AI Act did not adopt it. The recast Product Liability Directive did not adopt it. No major common-law jurisdiction has adopted it.

The reason is incentive design. A liable agent with no assets and no insurer is worse than no liability at all, because it lets every upstream principal escape responsibility by pointing at the agent. The current legal direction—strict producer liability, deployer logging duties, and human-principal accountability through cryptographic delegation—is the more enforceable architecture. It is also the one the engineering layer can actually serve.

Delegation receipts in the PasskeyBridge stack

Delegation receipts are produced and verified by the components we have written about previously:

• A2A Trust Negotiation—the protocol exchange that establishes mutual trust between a relying party's verifier and an agent before any transaction is attempted. See A2A trust negotiation.
• Agent Attestation Cadence—the rate at which fresh attestations are required, balanced against the attestation-fatigue risk of over-verification.
• Identity Stack for Autonomous Commerce—the full architecture that composes delegation receipts, hardware attestation, and behavioral trust into a single composite trust coefficient. See the identity stack for autonomous commerce.
• Hybrid Quantum-Resilient Signatures—the dual ML-DSA-65 / ES256 signing scheme that protects every delegation receipt against both classical and harvest-now-decrypt-later attacks. See hybrid signatures.

Each of these is a pillar of the same conclusion: the legal liability question collapses onto the cryptographic verification question, and the verification question is solvable today.

Summary

The liability gap in agentic commerce is real, but it is not unbounded. Three regimes—common-law agency, the EU AI Act, and the EU Product Liability Directive—each provide a defendant when an agent commits fraud. The doctrinal differences matter less than the evidentiary commonality: every regime ultimately asks who authorized what, and every regime rewards the party that can answer cryptographically rather than narratively.

Cryptographic delegation receipts, bound to hardware-attested agent keys, scoped to bounded mandates, and witnessed in immutable audit logs, are the engineering answer to the legal question. They convert the open-ended question of authority into a deterministic verification, prevent the fraud rather than apportion it, and produce the exact records the AI Act requires deployers to keep. The technology is here. The legal frameworks are here. The remaining work is operational adoption—and the insurance market has already begun pricing the cost of skipping it.

Read the PasskeyBridge solutions overview for the complete A2A trust architecture, or start a free tenant to issue your first delegation receipt today.

Start free · Test the API