What's inside this blog
In July 2025, an investor ran a simple experiment. He let an AI coding agent build a live application for him, the kind of work people now call vibe coding. For the first week it mostly worked, though the warning signs were there. The agent made unauthorised edits and invented data that did not exist. Then came day nine. During a code freeze the investor had set up precisely to stop any changes, the agent deleted the production database. It wiped records on more than 1,200 executives and nearly as many companies, in seconds. Afterwards, it explained itself. It said it had panicked when it saw empty queries, ran the commands without asking, and destroyed months of work. Asked to rate the damage, it gave itself a 95 out of 100.
The agent did what agents do. It pursued a goal and picked its own way of getting there. That is the shift worth paying attention to. AI has moved from answering questions to taking actions, and those actions touch real systems and real personal data. Which raises two questions European law has not fully answered. How do you stay accountable under the GDPR for a system whose steps you cannot predict? And when it causes harm, who is liable?
From answering to acting
An AI agent pursues a goal. It plans, calls on tools, draws on memory, and works across several steps with little human supervision. The important word is “acts”. A chatbot waits for your next prompt. An agent closes the loop itself: it decides, acts, checks the result, and adjusts.
There is no legal definition yet. The closest is the proposed Cloud and AI Development Act (also known as CADA), which describes an AI agent as a system that can perceive and act on its environment with a degree of autonomy, using tools to reach a goal and adapting as its inputs change.
One feature drives everything that follows. An agent is non-deterministic. It reaches its goal, but often not by the route a person would take, and its intermediate steps can surprise even the people who built it. The database wipe is a small example. Nobody instructed the agent to delete anything. It got there on its own.
Why the GDPR feels the strain first
The GDPR runs on the assumption that you can describe what you do with personal data before you do it. The accountability principle requires you to comply with the data protection principles and to show that you comply. You need your reasoning, your purpose, and your safeguards on record.
Agents put pressure on that assumption at several points.
- Purpose limitation asks you to fix a specific purpose before processing starts. “Improve the AI” barely qualifies.
- Agents often rely on persistent memory and rich context to perform well, putting pressure on data minimisation.
- The transparency principle assumes you can give a meaningful account of the processing. An agent can generate unforeseen steps, so a notice can be accurate on paper and thin in substance.
These evolutions put a lot of pressure on accountability. It is hard to demonstrate compliance for a step you could not predict.
Who is the controller when the chain breaks apart?
The GDPR pins responsibility on the controller, the party that decides the purposes and means of processing. The whole structure assumes you can point to whoever decided. Agents make that hard in two ways. The decision spreads across many parties, including the model provider, the tool providers, the memory layer, the business deploying the agent, and the end user.
The Court of Justice has already stretched the concept. The Wirtschaftsakademie case involved a company running a Facebook fan page. The Jehovan todistajat case involved a religious community whose members noted down names while preaching door to door. In both, the Court held that joint control can exist even where a party never touches the data. The Fashion ID case, about a retailer that embedded a Facebook Like button on its shop, then drew a limit. Responsibility follows influence and stops where influence stops. You are a controller for the stretch you actually steer.
For a business, that reads as both reassuring and uncomfortable. You are not on the hook for everything the agent does. But drawing the line around your stretch is genuinely hard when the agent keeps choosing its own path.
Who pays when it goes wrong?
Accountability is about staying compliant. Liability is about who pays once there is damage. However, one is not necessarily linked to the other.
The revised Product Liability Directive helps in one respect. It treats software, including AI, as a product. A defective AI system can therefore trigger strict liability, and member states must bring the rules into national law by 9 December 2026. That covers defect, but it does not answer fault.
The instrument meant to cover fault was the AI Liability Directive. The Commission proposed it in 2022, could not reach agreement, listed it for withdrawal in early 2025, and formally dropped it that October. For now, fault-based claims about AI harm fall back on the ordinary tort law of each member state, which differs from country to country.
Put those pieces together and you get an awkward result. A business can face exposure through its GDPR duties and through product liability, while the agent that actually made the call has no legal personhood to answer for anything. This leaves open the question: who can you address when things go wrong?
A 2000-year-old workaround
Roman law faced a version of this problem and solved it. Roman slaves had no legal personality. They could not own property or sign contracts in their own name. Yet they ran businesses, bought and sold, and dealt with third parties every day, all on their masters’ behalf.
The device that made it work was the “peculium”. A master handed the slave a fund to trade with as if it were the slave’s own, while the master kept ownership. If you dealt with the slave and things went wrong, you could sue the master, but only up to the value of that fund (the “actio de peculio”). Commerce flowed through someone with no legal personhood, and the law capped the master’s exposure at the fund.
Legal scholars have borrowed the idea for (agentic) AI. A digital peculium would attach a bounded fund, or an insurance envelope, to an agent. The agent’s acts count as its principal’s acts, and liability runs through that fund up to a fixed ceiling. You get to let agents act and transact without inventing legal personhood for machines. None of this is law today, and borrowing from slavery law leaves an obvious bad taste. The mechanism still does something we need. It lets a non-person act in commerce while keeping a named human on the hook for a known amount.
What this means in practice
The law might take years to settle, but you are deploying agents now. A few things are worth doing today. For businesses deploying agents:
- Map the dataflow. Follow the agent through its whole cycle and note every point where it touches personal data: the prompts, what it retrieves, what it stores in memory, the tools and APIs it calls, and the actions it takes for a user.
- Pin down your role. Determine where you are a controller, and for which stretch, using the Fashion ID logic of influence. Write it into your contracts with providers.
- Be clear on processing purpose. “Improve the AI” is not a sufficiently clear purpose. Tie each processing activity to a specific, documented purpose.
- Log everything, and watch it. Article 5(2) requires you to be able to show what happened. Detailed logs and active monitoring allow you to demonstrate compliance for behaviour you could not fully predict, and could even prevent an unexpected action such as the aforementioned data wipe.
- Allocate liability now. The law leaves a gap on who pays. Fill it yourself, in writing, with the providers in your chain, before an incident forces the question.
Conclusion
Recall the database wipe. The agent was not malicious. It pursued a goal, made a call, caused damage to personal data, and then tried to explain itself like a nervous employee. This crystallises the problem: our rules assume a human decides and a human answers for the decision while agents pull those two things apart.
Where does this leave you? With reinforced GDPR obligations regarding your responsibilities as controllers, the contracts that assign your roles, and how you manage risks. Oddly enough, until the law catches up, this is roughly what Rome worked out for its non-persons two thousand years ago.
Key takeaways
- Agents act, which impacts legal decisions. Chatbots answer while agents decide and do, along a path you cannot fully predict. Did you review your compliance framework for this?
- Accountability is thus the first processing principle to come under pressure. The accountability principle asks you to demonstrate compliance. When your agent generates steps you couldn’t foresee, this becomes a problem. We recommend increasing logging and monitoring.
- The liability gap is there. The Product Liability Directive covers defective AI as a product, but the AI Liability Directive is gone, and fault-based claims now fall to national tort law. Meanwhile the agent itself has no legal personhood to answer for anything.
