Abstract
Legal liability frameworks for AI were built around a single agent acting under a single human’s or developer’s authorization, but multi-agent architectures — where an orchestrating agent decomposes a task and delegates subtasks to specialized agents built by different companies, chosen autonomously at runtime — break the assumptions underlying product liability, respondeat superior, and joint tortfeasor doctrine, and closing the gap requires mandatory interaction logging, standardized agent identity, and explicit cross-provider liability rules rather than doctrine alone.
The core problem
- Multi-agent systems involve “a primary AI agent that receives a user’s request, breaks it into subtasks, and delegates those subtasks to specialized AI agents, often built by entirely different companies.”
- This differs from the single-agent model in two ways: no human explicitly approves the specific combination of agents that ends up executing the task, and agents autonomously select and coordinate with agents across different developers’ systems at runtime.
Legal frameworks built for single agents
- California AB 316 (effective Jan. 1, 2026) blocks defendants from claiming “the AI did it” by making parties who “developed, modified, or used” an AI system responsible — but this presumes an identifiable single developer.
- EU AI Act structures obligations around a provider–deployer framework, which creates accountability gaps once autonomous agents operate beyond their original design parameters.
- Agency law scholarship applying authority, ratification, and apparent authority assumes a single principal directing a single agent, an assumption that breaks under multi-agent composition.
Three doctrines that break down
- Product liability / component parts doctrine: assumes components are static and predetermined, but AI agents are dynamically selected at runtime by orchestrating agents — leaving unclear whether an orchestrating agent’s developer is the “assembler” of a product incorporating third-party components it never specified.
- Respondeat superior: requires identifying “a principal who authorized the agent’s specific actions”; when delegation chains cross provider boundaries autonomously, that authorization chain fractures and multiple companies’ systems interact without clear liability assignment under AB 316.
- Joint tortfeasor frameworks: theoretically applicable, but establishing each developer’s causal contribution requires “interaction-level traceability” that multi-agent systems currently lack — without records of instructions and data passing between agents at each handoff, identifying which agent caused the harm becomes practically impossible.
The traceability gap
- Traceability is identified as the fundamental factor distinguishing multi-agent AI from other complex liability scenarios: “agent-to-agent interactions are typically opaque, unlogged, and difficult to reconstruct after the fact.”
- Parallel drawn to automated trading and decentralized finance, where “attribution failures after cascading harms have repeatedly demonstrated that accountability requires built-in traceability at the infrastructure level, not post-hoc reconstruction.”
Existing infrastructure initiatives
- NIST AI Agent Standards Initiative (Feb. 2026): prioritizes agent identity and authentication, and published a concept paper on adapting existing identity management standards to multi-agent environments.
- OpenTelemetry Project: published semantic conventions standardizing “agent actions, tool calls, and decision points” tracing across execution chains, providing distributed tracing infrastructure that liability analysis would require.
- Protocol frameworks: Anthropic’s Model Context Protocol, Google’s Agent-to-Agent (A2A) protocol, and the W3C AI Agent Protocol Community Group’s interoperability standards.
- Singapore’s Model AI Governance Framework (Jan. 2026): the first government framework specifically targeting agentic systems.
- None of these mechanisms can connect a harmful action to the responsible developer without agent identity as a foundational layer — the missing piece is a legal mandate requiring their implementation.
Proposed policy interventions
- Mandatory interaction logging: each agent-to-agent handoff should record which agent acted, the instructions it received, the outputs it produced, and the developer identity behind it, establishing an evidentiary foundation for joint tortfeasor analysis.
- Standardized agent identity: each agent in a delegation chain needs a verifiable identity standard attributing it to a specific developer, since even perfect logging cannot connect a harmful action to a responsible party without this.
- Explicit cross-provider liability rules: legislators should clarify how liability is allocated across multiple developers whose agents compose without direct human authorization, through mechanisms such as joint and several liability, proportional fault, or rebuttable presumptions favoring orchestrating agent developers.
Conclusion
- Single-agent liability models already establish that humans cannot disclaim responsibility by pointing to AI autonomy, but multi-agent systems require infrastructure beyond that principle: interaction logging, identity standards linking agents to developers, and fault-apportionment rules addressing delegation chains that no human directly authorized.