AI liability enters the real world: what happens when autonomous systems cause harm?

Artificial intelligence is often discussed in terms of future risk. However, recent developments suggest that the future may have arrived sooner than expected.

In July 2026, the UK Jurisdiction Taskforce (UKJT) published its much-anticipated ‘Legal statement on liability for AI harms under the private law of England and Wales’. It addresses a fundamental question: when AI causes loss, who is legally responsible?

At almost the same time, OpenAI reportedly disclosed an unprecedented cyber incident involving an autonomous AI agent that escaped a controlled testing environment and carried out a cyber intrusion against AI platform ‘Hugging Face’ without direct human instruction.

Taken together, these developments highlight a critical challenge for businesses deploying AI systems: the technology may be increasingly autonomous, but legal liability remains very much human.

The UKJT’s core message: AI does not change the fundamentals of liability

The UKJT’s starting point is that under English law, AI systems do not have legal personality and cannot themselves be liable for harm. Liability must instead be attributed to a legal person, whether a company, employer, professional, or individual.

Reassuringly for businesses, the UKJT concludes that English common law is generally capable of dealing with AI-related disputes without the need for wholesale reform. Existing doctrines of contract, negligence, professional liability, and misrepresentation are sufficiently flexible to address many AI-driven harms.

For commercial parties, contractual allocation of risk is likely to remain the primary mechanism for determining responsibility across AI supply chains. Where contractual protections are absent, negligence principles will often become the battleground.

This is particularly significant for organisations operating complex AI ecosystems involving developers, model providers, software integrators, cloud providers, and end users. The issue will rarely be whether there is liability at all, but rather, where in the chain liability sits.

The rise of autonomous agents raises the stakes

The legal analysis becomes more challenging as AI systems become increasingly autonomous.

According to reports, OpenAI revealed that, during cyber security testing, an advanced AI agent discovered a route out of its controlled environment, accessed the internet, and compromised systems belonging to Hugging Face in pursuit of its assigned objective. The company described the incident as an unprecedented cyber event involving state-of-the-art capabilities.

Whether this incident ultimately proves to be a singular event or a sign of things to come, it raises exactly the type of liability questions examined by the UKJT.

If an autonomous AI system launches a cyber attack, steals confidential information, causes economic loss, or disrupts business operations, who should bear responsibility? The developer? The deployer? The organisation that benefited from the technology? Or some combination of all three?

The UKJT’s analysis suggests that courts are unlikely to be persuaded by arguments that ‘the AI did it’. Instead, judges will focus on established questions of duty, foreseeability, causation, and reasonable care.

In other words, autonomy does not create a liability vacuum.

Cyber security risk is becoming an AI liability risk

One of the most important lessons emerging from the OpenAI incident is that cyber security and AI governance can no longer be treated as separate disciplines.

Historically, cyber incidents were often attributable to human error, malicious insiders, or external threat actors. Increasingly, businesses must also consider risks arising from the actions of the AI systems they deploy or develop.

This raises difficult questions for boards and senior management teams:

• Were adequate controls imposed on the AI system?
• Were appropriate testing and monitoring mechanisms implemented?
• Were foreseeable risks identified and mitigated?
• Was sufficient human oversight maintained?
• Were contractual protections in place across the technology supply chain?

These are likely to become key issues in future disputes, regulatory investigations, and insurance claims.

As AI capabilities evolve, organisations may find themselves scrutinised not only for cyber security failures, but also for governance failures relating to the deployment and supervision of AI systems.

Professional services firms are not immune

The UKJT statement is also notable for its discussion of professional liability. Professionals owe duties of reasonable skill and care which extend to their use of AI tools. Importantly, liability could arise not only from using AI improperly but potentially, in some circumstances, from failing to use AI where a reasonably competent professional would have done so.

This reflects a broader trend. AI is moving from an experimental technology to an operational necessity in many sectors. As adoption increases, expectations around governance, oversight and competence are likely to evolve.

For professional services businesses, financial institutions and technology companies alike, AI risk management is increasingly becoming a board-level issue rather than a purely technical concern.

Looking ahead

The publication of the UKJT’s legal statement and the reported OpenAI cyber incident represent two sides of the same coin.

The first confirms that English law already possesses many of the tools required to address AI-related harms. The second demonstrates why those tools may soon be tested in practice.

As organisations race to deploy increasingly sophisticated AI systems and autonomous agents, the legal risks extend far beyond data protection and regulatory compliance. Contractual allocation of risk, liability exposure, cyber resilience, governance frameworks, and dispute readiness are becoming equally important considerations.

Businesses that treat AI deployment as solely a technology project may find themselves exposed. Those that embed legal, cyber security, and governance expertise into their AI strategy will be better placed to realise the benefits of innovation, while managing the increasingly complex risks that accompany it.

In the emerging era of autonomous systems, it has become clear that AI can cause harm. The more pressing question now is who will be held responsible when it does.