A Singapore discussion paper is examining who should bear legal responsibility when an artificial intelligence agent takes an unintended action, addressing a growing gap between software that provides advice and systems that carry out transactions with limited human involvement.
Published in May 2026 by Singapore’s Infocomm Media Development Authority, the paper considers how contract, tort and agency law apply to AI agents. Developed through a working group drawn from the legal community, it examines both fault-based and strict liability and records areas where participants did not agree.
The central question is how to attribute an agent’s conduct when it does something that no person specifically instructed it to do. Agents can book services, make purchases and perform tasks on behalf of individuals or organisations. Those capabilities raise questions not only about who must compensate someone harmed by an action, but also about whether a transaction binds the person or business using the system.
An IAPP discussion of the paper features Yeong Zee Kin, chief executive of the Singapore Academy of Law, and Cheryl Seah, a director at Drew & Napier and co-chair of the working group. It addresses the questions the paper leaves unresolved and the practical issues facing organisations deploying agents. The material describes a discussion paper rather than an enacted liability regime.
The legal questions differ depending on what an agent does. Contract law concerns matters such as whether an agreement has been formed and who is bound by its terms. Tort law addresses civil wrongs, including negligence, that can give rise to compensation. Agency law deals with circumstances in which one party acts on another’s behalf. Applying those established concepts to autonomous software requires distinguishing a system’s technical ability to act from the legal authority attached to its actions.
For example, giving software access to a purchasing system does not, by itself, answer every question about responsibility for an unexpected purchase. The scope of the task, the permissions granted and the circumstances of the transaction can all be relevant to legal analysis. An action that falls outside a user’s intention may still create a dispute over contractual obligations or losses suffered by another party.
The distinction between fault-based and strict liability is another important part of the debate. A fault-based approach generally asks whether a party failed to meet an applicable standard of care. Strict liability can impose responsibility without requiring proof of negligence, although its scope depends on the particular legal rule. Choosing between those approaches affects what an injured party must establish and how risks are allocated among those developing, supplying and using a system.
For organisations, the unresolved issues make deployment controls relevant alongside technical performance. Clearly defined permissions, records of instructions and actions, and procedures for human review can help establish what a system was authorised to do and how an incident unfolded. Such measures do not themselves settle liability, but they can provide evidence needed to assess it.
The working group’s recorded disagreements leave open how responsibility should ultimately be distributed when an agent acts beyond its intended task. The paper’s focus is on testing existing legal frameworks against that problem, rather than treating an agent’s apparent independence as an answer to who bears the resulting loss.
Sources: IAPP