Can Your AI Agent Bind Your Company? Agency Law, Apparent Authority, and Autonomous Tools

When an AI agent places an order, accepts terms, or makes a promise to a customer, the other side isn't asking whether you meant it. They're asking whether it was reasonable to think it was you.

A startup connects an AI agent to its inbox, its procurement portal, and its customer chat. The agent is supposed to save the team hours every week, and it does. Then one day it orders ten thousand units instead of ten. Or it tells a customer that a refund is guaranteed, a price is locked in, or a feature will ship by March. Nobody on the team approved any of it.

The founders' first instinct is that it can't be binding because nobody authorized it. The counterparty's instinct is the opposite: your system, using your credentials, on your channels, made an offer, and they relied on it. Both sides think the law is obviously on their side.

This post explains how courts and lawyers are approaching that question, the doctrines that decide it, where startups are most exposed, and what to put in place before an agent does something you didn't expect.

Why "it was just software" is a weak defense

Founders often assume that because an AI agent isn't a person, it can't create a contract or a commitment on the company's behalf. The law has been moving in the other direction for a long time.

Contracts can be formed without a human reviewing them. Federal and state electronic commerce laws, including the E-SIGN Act and the Uniform Electronic Transactions Act, recognize that a contract can be formed through the interaction of electronic agents, even when no individual reviewed the transaction. The key question is whether the action is attributable to the party being bound, and deploying the system is usually enough.

The company chose to deploy the tool. From the counterparty's perspective, an AI agent acting through your accounts and channels is an extension of your business. The decision to give it access and set it loose is the company's decision, and the law tends to place the risk of a malfunctioning tool on the party that chose to use it.

Courts abroad have already rejected the "separate entity" argument. In Moffatt v. Air Canada, a Canadian tribunal held an airline responsible for misinformation its website chatbot gave a customer about bereavement fares, and rejected the idea that the chatbot was a separate entity responsible for its own statements. It is not a U.S. decision and it is not binding here, but it shows how a tribunal can treat the argument, and it is routinely cited in discussions of AI agent liability.

This area is still developing, and U.S. courts have not resolved every question about how traditional agency doctrines apply to autonomous AI. But founders should not plan around the hope that "the AI did it" will work as a defense.

The three doctrines that decide whether you're bound

Traditional agency law asks whether someone acted with the principal's authority. The same framework is being applied to AI agents, and it has three parts.

Actual authority. This is the authority you really gave the agent, expressly or by implication. It comes from what you configured, what credentials you provided, what instructions you wrote, and what the agent could reasonably be understood to be allowed to do. If an agent has the power to place orders in a vendor portal, a court may find that placing orders was within its authority, even if the specific order was a mistake.

Apparent authority. This is the one that surprises founders most. A principal can be bound when its own conduct leads a third party to reasonably believe the agent has authority. The focus is on what the third party saw, not on what the company privately intended. Internal limits, like a policy that says the agent should never commit to pricing, generally do not protect the company if the counterparty never knew about them. Giving an agent your company email domain, your branding, access to your customer portal, or a chat interface presented as an official support channel can all contribute to the impression that it speaks for you.

Ratification. Even an unauthorized act can become binding if the company later accepts its benefits or fails to object within a reasonable time. A company that keeps the goods, takes the payment, or says nothing after learning of an unauthorized commitment may find that silence works against it.

Taken together, these doctrines mean the practical question is rarely whether the company meant to approve a particular action. It is whether the company set up the situation in a way that made the action look authorized, and what it did once it found out.

Where startups are most exposed

Customer-facing chatbots and support agents. A support agent that states a refund policy, promises a fix, quotes a price, or describes product capabilities can create representations a customer will later rely on. Mistakes in these statements can lead to contract claims, consumer protection claims, or both.

Procurement, ordering, and payment agents. Agents connected to purchasing systems and payment tools can commit real money. A transaction that the agent initiated through your accounts is hard to disown when the vendor acted in good faith.

Sales and outreach agents. An agent that negotiates, answers questions about terms, or sends proposals can make statements about pricing, delivery, exclusivity, or service levels that the sales team never approved.

Coding and operations agents with broad credentials. An agent that can deploy code, delete resources, or sign up for third-party tools can accept click-through terms on the company's behalf. Those terms can include license restrictions, data use rights, and limits on how outputs can be used. An agent that creates accounts for developer tools or APIs may be committing the company to agreements nobody read.

Agents that handle confidential information. An agent that shares documents, summarizes internal data, or pastes information into outside tools can disclose confidential information or trade secrets, which can undermine protection and breach customer confidentiality obligations.

Hiring and HR agents. Tools that screen candidates or communicate with applicants can create employment-law exposure, and the company is typically responsible for the process even when a vendor built the tool.

Why your vendor contract probably doesn't protect you

Many founders assume that if an AI agent causes a loss, the AI vendor will bear the cost. The contract usually says otherwise.

Outputs are generally provided "as is." Standard AI vendor terms disclaim accuracy and reliability, state that outputs should not be relied on without verification, and often extend that language to actions taken by agents built on the platform.

Liability is typically capped at fees paid. A cap measured in a few months of subscription fees is small compared with the cost of an unauthorized order, a lost customer, or a regulatory claim.

Indemnities are narrow. Where vendors offer indemnification, it often covers specific categories such as certain IP claims, and not the business consequences of an agent's decisions.

Your own terms may not shield you either. A disclaimer in your terms of service or at the edge of a chat widget stating that chatbot statements are not binding may help in some situations, but it is unlikely to override a specific promise made to a particular customer, and consumer protection laws limit what disclaimers can accomplish.

The result is that the risk often stays with the company that deployed the agent, which is why the decisions about what the agent can do matter more than the fine print about who is responsible afterward.

How investors and acquirers will look at this

Autonomous agents are becoming a standard diligence topic for the same reason AI-generated code did: they create questions about ownership, control, and undisclosed liability.

Investors and their counsel will increasingly ask what actions the company's agents can take without human approval, what credentials and spending limits they have, how actions are logged, whether there have been incidents or unauthorized commitments, and what the company's policy is for reviewing agent behavior. A company that can answer clearly looks like it has operational control. A company that cannot looks like it has exposure it has not measured.

There is also a representation issue. Financing and acquisition documents typically include statements that the company is in compliance with its material contracts and has no undisclosed liabilities. An agent that has quietly accepted terms, made commitments, or breached agreements can make those statements inaccurate.

What to put in place before something goes wrong

Map what each agent can actually do. List every system the agent can access, every action it can take, and what the worst realistic outcome is. Sort the actions into tiers: read-only, drafting for human review, acting with approval, and acting autonomously. Autonomy should be earned by the low-risk tiers, not granted by default.

Apply least privilege to credentials. Give agents the minimum access needed. Use separate accounts, spending limits, transaction caps, and allowlists of approved counterparties and tools. Avoid giving an agent broad administrative credentials.

Require human approval for the things that create legal obligations. Contracts, payments above a defined threshold, acceptance of third-party terms, refunds or concessions, statements about legal rights, and the sharing of confidential information should have a person in the loop. Make the review meaningful. Rubber-stamping dozens of requests a day does not give you the protection of oversight.

Communicate the agent's limits to the people it deals with. Because apparent authority turns on what third parties reasonably believe, limits that only exist internally do little. Where appropriate, make clear that the agent is an automated system, state what it cannot commit to, and direct counterparties to a human for binding terms. Some jurisdictions also require disclosure that a user is interacting with AI, so check the rules for your markets.

Keep logs you can actually use. Records of what the agent was asked, what it did, which credentials it used, and who approved what are essential for resolving disputes, responding to incidents, and answering diligence questions. Build in the ability to pause or revoke an agent's access quickly.

Write an agent authority policy. A short internal document stating what agents are permitted to do, who is responsible for each one, how incidents are reported, and how mistakes are handled gives the company something to point to and gives the team a shared standard.

Revisit your contracts and insurance. For vendors, look at liability caps, indemnities, security commitments, and data terms, particularly for agents that touch money or sensitive data, and negotiate where the use case justifies it. For customers, make sure your terms address automated interactions sensibly. Ask your insurance broker whether existing policies cover losses caused by autonomous tools, because some policies exclude or limit AI-related claims.

Respond quickly when an agent gets it wrong. If you discover an unauthorized commitment, act promptly. Notify the counterparty, state that the action was not authorized, and avoid conduct that looks like acceptance. Delay and silence are how ratification arguments are built.

Frequently asked questions

Is an AI agent a legal person that can be held responsible instead of us?

No. AI agents are not recognized as legal persons in the United States, so liability falls on the humans and companies behind them, typically the company that deployed the agent and, depending on the contract and the facts, possibly the vendor that built it. Courts tend to treat the agent as a tool or instrument of its user.

Can we avoid liability by saying in our terms that the chatbot's statements aren't binding?

It can help, but it is not a reliable shield. A disclaimer may carry weight where the customer clearly saw it and the statement was general. It is less likely to defeat a specific, reasonable reliance on a concrete promise, and consumer protection laws limit how far disclaimers can go.

What if the agent was manipulated by a prompt injection or a bad actor?

The answer is fact-specific and not settled. A counterparty's reasonable belief, the company's security practices, and whether the counterparty was itself acting in good faith all matter. Because a company's failure to secure an agent can weigh against it, treating security as part of authority management is the safer approach.

Can we recover from the AI vendor if the agent causes a loss?

It depends on the contract. Most standard terms disclaim responsibility for outputs and cap liability at a modest amount, which limits recovery. Claims based on negligence or product liability theories are developing and uncertain. For EU-facing businesses, the revised EU Product Liability Directive extends strict liability to software, with member state implementation due in December 2026, which may change the analysis for some claims.

Does having a human in the loop eliminate the risk?

It reduces it, especially for high-risk actions, but only if the review is real. Approval workflows that are routine, rushed, or poorly documented may not provide much protection, and they can create a record that the company knew what the agent was doing.

Do we have to tell people they're talking to an AI?

In some places, yes. Several jurisdictions have disclosure requirements for certain automated interactions, and others are considering them. Even where it isn't required, disclosure can support the argument that the counterparty understood the limits of what the system could commit to.

Is this different for internal agents that never talk to customers?

The exposure changes, but it doesn't disappear. Internal agents can still place orders, accept terms, move money, delete data, and disclose confidential information, all of which can create obligations or losses. The same authority mapping and approval practices apply.

AI agents are useful because they act, and the law will treat what they do as something the company has to answer for. The founders who stay out of trouble are not the ones who avoid agents. They are the ones who decide in advance what each agent is allowed to do, who has to approve what, and what the company will say when something goes wrong. If you are deploying AI agents and want to confirm your authority limits, contracts, and diligence story hold up, contact Ana Law to schedule a strategy session.