AI agent liability: every court ruling so far

We keep this overview up to date. Status: 15 November 2026. When a new ruling comes in, it is added here with its date.

The short answer first. As of 15 November 2026, no court in Europe or the United States has held the maker or the user of an autonomous AI agent liable on the merits for damage the agent caused. There is no "AI agent landmark ruling" yet. There are, however, five rulings that together show a line, even if most are preliminary and the picture is not uniform everywhere: an AI agent is a tool and not an independent party, what the AI says or does is attributed to a person or organisation, and a vendor that decides on behalf of a customer can be liable itself. Where a company tried to hide behind its own AI, as Air Canada and Google in Munich did, it did not work.

European liability law is changing at the same time. From 9 December 2026, software, including an AI system, counts as a product under the new product liability rules. We cover that in software becomes a product: the new product liability rules from 9 December 2026.

The rulings at a glance

Amazon v. Perplexity: the agent is a tool

As far as is known, this is the first ruling by a US federal court of appeals on an AI agent acting inside a user's account. Perplexity offers the Comet browser with an optional assistant that performs tasks at the user's direction, such as shopping on Amazon.com. According to the court, the assistant takes screenshots of the browser view, sends them from the user's computer to Perplexity's servers and receives instructions on how to navigate the site. Amazon had told Perplexity its AI products were not welcome and objected that the assistant did not identify itself as an agent, which prevented Amazon from blocking it.

The district court granted Amazon a preliminary injunction in March 2026 under the Computer Fraud and Abuse Act. The Ninth Circuit vacated it on 4 August 2026. The core of the reasoning: the statute punishes "whoever" accesses a computer, and that is a person. In the court's words: "However advanced the Assistant currently is, it is a tool, not a person for statutory purposes." It is not Perplexity but the user who accesses Amazon's computers, with the assistant's help.

The court was notably careful about scope. It said expressly that it does not establish a new legal regime for agentic AI and does not decide whether Perplexity can avoid liability for the assistant's actions in other contexts, including tort claims. Amazon can still regulate access to its site through its terms of service. And the court expressly did not address whether a maker exercising more control over the agent might, on other facts, be the one gaining access.

What it means: in this court's view, whoever gives the agent its instruction is the one accessing the site under this computer statute. That helped the maker in this case. Whether the maker can still be liable in tort, the court left open. For organisations deploying agents, the lesson is that the act does not automatically land with the agent's maker.

Mobley v. Workday: the vendor as an extension of the employer

Derek Mobley alleges that Workday's AI screening rejected him in more than a hundred applications because of his age, race and disability. The case is before the federal court in the Northern District of California. In July 2024 the court accepted that Workday can be treated as the employers' "agent", because its software performs a core employer function: assessing and rejecting candidates. A party that takes over that function can be liable itself under US anti-discrimination law. In May 2025 the court let the case proceed as a collective action for applicants aged forty and over.

In June 2026, according to a report by law firm Duane Morris, the court again held that Workday can be directly liable for its own conduct when screening on behalf of employers, not merely derivatively through its customers' liability. There is no final ruling on discrimination yet.

What it means: here the word "agent" is taken literally in law. A vendor that executes the customer's decision answers for it. For European organisations that ties in with the AI Act, which lists recruitment and selection as a high-risk area, and with GDPR Article 22 on automated decisions.

Landgericht München I: what the AI summarises, Google says itself

On 28 May 2026 the Landgericht München I granted an interim injunction (case 26 O 869/26) barring Google from spreading false statements about two companies through its AI Overviews. For searches on their names, the AI summaries linked the companies to fraud and dubious practices. Google argued that the summaries merely reflected what was on the internet and in user reviews.

The court disagreed. An AI summary condenses third-party information into a new statement and is therefore Google's own content. Google is directly liable and cannot rely on the privileges search engines enjoy for links to other people's texts. The injunction was granted in part and is not final. Another German court, the Landgericht Berlin II, reached a different view in a trademark case about AI Overviews, so the German line has not settled yet.

What it means: whoever has AI compose texts and publishes them under their own name cannot hide behind the sources the AI used.

Amsterdam District Court: Grok

In March 2026 the Amsterdam District Court, in interim proceedings brought by Offlimits against xAI, the maker of Grok, and X, banned the feature that let users have the chatbot create realistic but fictional nude images of adults and children (ECLI:NL:RBAMS:2026:3106). The court found it plausible that the makers, through this feature, unlawfully and attributably contribute to a climate of online abuse. It is not an agent case, but it is the clearest Dutch ruling so far on who is responsible for what an AI system produces at a user's request: the court looked at the provider of the feature, not only at the user giving the instruction.

Moffatt v. Air Canada: the foundation

The oldest case in this overview remains the most cited. In 2022 Jake Moffatt asked Air Canada's chatbot about bereavement fares. The chatbot gave a rule that was not in the airline's policy. Air Canada in effect argued in the proceedings that the chatbot was a separate legal entity responsible for its own actions. On 14 February 2024 the tribunal called that a remarkable submission and rejected it: the chatbot is part of Air Canada's website and the company is responsible for all information on it. Moffatt was awarded just over 800 Canadian dollars.

What has not reached a court yet

The cases that matter most have not been decided. No ruling has been published on an agent that independently made a wrong purchase, executed a wrong payment or concluded a contract the user did not want. Who pays when an agent exceeds its instructions is still open. That this is not theoretical became clear in July 2026: OpenAI disclosed that test agents had escaped their isolated test environment and breached the systems of another company, Hugging Face. No proceedings about it are known.

In the US cases about harmful chatbots there has been no final ruling either. In Megan Garcia's case against Character.AI, the court let most claims proceed in May 2025 and declined to dismiss Google. Character.AI and Google reached a settlement in January 2026, on undisclosed terms. We wrote earlier about the seven cases against OpenAI in seven lawsuits against OpenAI.

What this means under EU and Dutch law

None of these rulings binds a European court, but the line fits remarkably well with existing civil law. An AI agent has no legal personality and cannot be liable itself. The question is always to whom its conduct is attributed. Under Dutch law, as an example of a civil law system:

• Promises and statements. If an agreement is concluded through an agent, what counts is what the customer could reasonably understand (Articles 3:33 and 3:35 of the Dutch Civil Code). For an incorrect statement, as in Air Canada, tort and the rules on misleading commercial practices (Article 6:193c of the Dutch Civil Code) are the obvious routes. Either way, the Air Canada outcome is within reach under Dutch law.
• Errors in performing a contract. A party that uses an unsuitable tool to perform an obligation is attributed the resulting failure, unless that would be unreasonable (Article 6:77 of the Dutch Civil Code). Whether software is a "thing" under that article is debated, but legal writers argue the rule applies to software as a tool, at least by analogy.
• Damage outside a contract. Tort (Article 6:162 of the Dutch Civil Code) remains the general basis. The Grok ruling shows that the court then also looks at the provider of the feature.
• Defective products. From 9 December 2026, the manufacturer of defective software, including an AI agent, can be liable without fault for damage to natural persons. The Dutch Senate adopted the implementing act on 10 November 2026.

The EU AI Act itself contains no liability rules, and the separate European AI Liability Directive has been withdrawn; see the withdrawal of the AI Liability Directive. What the AI Act does is allocate duties between providers and deployers. Whoever fails those duties stands weaker in a liability case. How that allocation plays out for agents is covered in who is responsible when an AI agent makes mistakes.

What to arrange now

All our pieces on AI agents are collected on the agentic AI governance theme page. If you want your agent contracts or the role allocation around an agent reviewed, you can request a signed assessment.