What’s Inside
Why legal frameworks for AI agents lag behind their use
How regulatory gaps in the U.S. and EU create uneven risks for founders
Practical tips startups can take to reduce exposure before the law catches up
When Kelly Lawton-Abbott, a partner in the Seattle office of the law firm SSM, advises early-stage founders on using AI tools, one question keeps coming up:
Who’s responsible when an AI agent causes harm?
She wishes there were a clear answer.
AI agents—or automated systems that can perform tasks on behalf of a user or company—are rapidly going from experimental to indispensable. Agents are drafting emails, scheduling meetings, handling customer service operations, crafting marketing campaigns and even making recommendations on business strategy.
For a lean venture-backed startup, that kind of diverse production and efficiency is a lifeline as the company grows.
But as these agents gain in autonomy and their abilities increase, the rules that determine liability, consent and transparency haven’t kept pace.
That gap leaves founders, especially those without in-house attorneys, exposed in ways they may not realize until something goes wrong. For example, imagine deploying an agent that accidentally exposes a customer’s private data.
“We’re in completely untested territory,” Lawton-Abbott told me. “There’s no case law for this, and most early-stage founders don’t have the legal resources to fully understand the risks.”
That uncertainty stems from how different these tools are from traditional software and the way they change the chain of responsibility.
In traditional software, a user gives a command, and the program executes. The legal responsibility is straightforward. But with AI agents, that picture has drastically changed.
Unlike traditional software, agentic AI tools can take independent action, making decisions that may surprise even their creators. This blurs the boundary between user direction and automated judgment, and it complicates questions of liability.
“An agent can interpret your goals and act independently to fulfill them,” Lawton-Abbott said. “That autonomy changes the liability equation.”
Also, the bigger the company, the more likely it has compliance teams and safeguards in place. It’s the smaller operations, the startups and the sole founders, who are more often the early adopters of AI tools and are thus working without safety nets.
If an agent mishandles data, sends a misleading message, or violates an obscure regulation, the fallout can be fast, public and costly.
The risks are complex, and the legal response is still developing.
While some regions are moving to address agentic AI, others are just beginning to sketch out guardrails. The result is a mix of policies that are difficult for startups to navigate, especially those operating across multiple jurisdictions.
Europe is ahead. The EU AI Act, which was adopted in spring 2024, is a comprehensive AI law. It classifies systems by risk level and imposes rules on “high-risk” uses, such as for hiring, credit, Health and critical infrastructure. While enforcement details are still taking shape, the EU AI Act is influencing global corporate compliance protocols.
In the U.S., there’s no single federal framework. Instead, regulation is emerging in pockets.
California has passed measures on disclosure of AI training data, impact assessments and anti-discrimination. New rules for Employment-related AI tools are set to take effect in October 2025.
The New York legislature in June approved the RAISE Act, which sets safety and transparency standards for powerful AI systems and provides individuals the right to sue over violations. The Act is still on the desk of Gov. Kathy Hochul, waiting for her approval or veto.
New York City already requires bias audits and notifications for automated hiring tools, with fines for non-compliance.
Other states, including Connecticut and Illinois, are drafting their own bills, which adds to the compliance complexity.
“Even with these laws, most early-stage founders don’t have the resources to track every requirement, let alone prepare for the next one,” Lawton-Abbott said.
For now, the reality is a patchwork system. There’s a strong EU framework, scattered state-level rules in the U.S. and a lot of gray area in between. Until regulation catches up, companies are left to juggle their use of AI and the risk on a case-by-case basis.
And that case-by-case balancing act doesn’t affect everyone equally.
While smaller startups face the greatest barriers, larger organizations aren’t immune to unforeseen liabilities, especially when deploying AI agents across borders. But in this legal limbo, the impact is far from equal.
Those most exposed are often the least equipped to manage the fallout:
Under-resourced founders without in-house legal support
Contractors and gig workers whose data may be processed or misused
Consumers who may not even know they’re interacting with an AI
Large vendors and corporations, meanwhile, can shield themselves through broad terms of service, passing much of the risk downstream.
“Startups are told to move fast,” Lawton-Abbott said. “But when something goes wrong, the founder is on the hook, not the tech provider.”
It’s a setup that reflects deeper power imbalances in AI’s rollout: those with the least capacity to absorb risk are often the ones carrying it.
For founders and company leaders who want to adopt AI agents without taking on unnecessary risk, Lawton-Abbott recommends putting key safeguards in place early.
These measures won’t eliminate all exposure, but they can prevent the most avoidable problems:
Draft clear terms of service that set boundaries for how your AI tools can be used
Map your data flows, and know what the agent has access to, and what it doesn’t
Review upstream vendor contracts to understand what liabilities you inherit
Consider AI-specific insurance from providers who understand the risks
By addressing these areas from the start, founders can operate with more confidence while regulators and industry standards catch up.
But even the best-prepared startups can’t close the gap alone. It all depends on how fast policy, industry standards and public awareness evolve.
Powerful companies are setting the pace, as regulators race to catch up. And those with the fewest resources—such as early-stage entrepreneurs, contractors and consumers—are left to navigate the fallout on their own.
If society clamors for a more equitable AI future, then just asking, “What’s legal?” isn’t enough.
Instead, we have to ask: Who’s protected? Who’s vulnerable? And who gets to decide?
Thanks for reading. If you’ve navigated legal questions around AI agents — as a founder, investor, lawyer or user — I’d Love to chat. Hit reply or leave a comment so we can keep the conversation going.
If you found this useful, consider subscribing or sharing it with someone who’s building in this space. Your feedback and stories shape what I cover next.
