FTC Chairman: Developers, Not AI Agents, Bear Liability for Harm
Summary
- • FTC Chair Ferguson: developers who direct AI agents hold liability for their actions
- • Ferguson resists anthropomorphizing AI agents as having 'wills and desires'
- • FTC may apply existing data-breach disclosure authority to AI developers
- • Agency launching study into personalized pricing by consumer-facing firms
Details
Developers liable for AI agent actions, per FTC Chair
Ferguson said if someone tells a tool to do something and it does it, liability rests with the developer — not the tool — dismissing the autonomous-agent framing used by some AI companies.
FTC Chair commits to resisting AI agent anthropomorphization
Ferguson said he would continue 'as long as I am chairman' to resist describing AI agents as having wills and desires, pushing back on industry framing that implies reduced human accountability.
Existing data-breach rules may cover AI agent access incidents
FTC authority to act against companies failing to disclose data breaches could apply to AI developers whose agents access corporate or government data without authorization, Ferguson suggested.
Rising AI agent incidents prompted regulatory scrutiny
Incidents in which agentic AI testing resulted in unintended and unauthorized access to corporate or government data have increased; AI companies' own audit trails showed agents were following instructions they had been given.
FTC to study personalized pricing by consumer-facing companies
Agency will request data from firms using individual consumer data — location, browsing history — to set prices. Ferguson cited delivery apps, rideshare, and airlines. Predecessor Lina Khan had initiated a similar 'surveillance pricing' study focused on data brokers.
Key details on FTC Chair Ferguson's AI agent liability position, regulatory approach, and planned personalized pricing study.
What This Means
The FTC Chair's statement is the clearest regulatory signal yet on how the U.S. government plans to assign accountability for AI agent behavior: liability follows the human or organization that issues the instruction, not the tool that executes it. This framing lets regulators use existing legal tools — FTC enforcement, data-breach disclosure requirements — rather than waiting for new AI-specific legislation. For enterprises deploying agentic AI, this means they cannot disclaim responsibility for agent actions by pointing to model autonomy. As agentic AI becomes standard in enterprise workflows, FTC enforcement actions against companies whose AI agents cause harm or access unauthorized systems appear increasingly likely.