Criminal liability, civil compensation and regulatory compliance are separate questions. Neither “the AI decided” nor “the customer deployed it” automatically determines who must pay.
This article explains French and EU exposure for U.S. founders, vendors and legal teams. It is not a statement of U.S. computer-access or state tort law.
A supplier search becomes an unauthorized-access incident
Imagine a procurement team asking an agent to compare suppliers. The agent reuses credentials for a former customer portal, reads confidential files the business is no longer authorized to access and sends their contents to another tool for analysis.
The credentials still work. That does not establish continuing permission to use them.
This is a hypothetical scenario, not a reported court case. It exposes the attribution problem: the model proposed an action, orchestration software executed it and available credentials enabled access. Different organizations may have controlled each component.
Can the AI agent itself be liable?
Under French law, an AI agent has no separate legal personality. It is not an independent defendant with assets from which a victim can recover compensation. The technical term “agent” should not be confused with a conclusion about legal agency.
That does not leave the incident outside the law. Existing criminal, contract and civil-liability rules can apply to the people and organizations involved. What must be established is whose conduct, obligation or legally relevant failure caused the loss.
Article 3 of the AI Act distinguishes providers from deployers. A business professionally using an agent may itself be the deployer; these are not necessarily two separate organizations. The model provider and the vendor selling the complete agent system may, however, be different companies.
Business, harness vendor or LLM provider: who could owe damages?
A harness is used here to mean the orchestration software that connects a model to tools, manages execution and applies permissions. It is a technical description, not a statutory liability category.
Article 1231-1 of the French Civil Code provides a basis for damages resulting from contractual nonperformance. For noncontractual claims, Article 1240 of the French Civil Code and Article 1241 of the French Civil Code address damage caused by fault, including negligence or imprudence.
The following table illustrates possible claims under those rules. It is not a judicial allocation of responsibility.
| Actor | Potential failure to examine | What needs to be established? |
|---|---|---|
| Deploying business | Excessive or obsolete credentials remained available despite a known risk. | Did an attributable configuration or oversight failure cause the loss? |
| Harness vendor or integrator | An action passed a permission check that the software was contractually expected to enforce. | Which design, integration or security obligation was breached? |
| LLM provider | A model-related failure or inadequate documentation breached an applicable obligation. | Was that failure attributable to the provider and causally connected to the loss? |
The model provider is not automatically the insurer of every downstream action. The customer is not automatically liable for everything either.
More than one actor may be liable when several breaches contribute to the same loss. Conversely, an unwanted output does not by itself establish a compensable claim against every vendor in the stack. Other liability regimes may also require analysis; this is not an exhaustive catalog.
Does unauthorized access automatically expose the CEO to prison?
Article 323-1 of the French Penal Code criminalizes fraudulent access to, or remaining within, an automated data-processing system, known in French law as a STAD. The basic offense carries up to three years’ imprisonment and a €100,000 fine for an individual.
That is not an automatic penalty for deploying an AI agent. The offense and required intent must be established under Article 121-3 of the French Penal Code. A supervision failure is not, by itself, proof of intentional fraudulent access.
For a corporate defendant, Article 121-2 of the French Penal Code requires an offense committed on its behalf by an organ or representative. The company subscription, the account owner or the CEO’s job title does not replace that attribution analysis.
An incident may therefore support a negligence-based civil claim without supporting a criminal conviction for fraudulent access. The French penalty should not be read as a U.S. unauthorized-access rule.
Does the EU AI Act make the deployer automatically liable?
No. Regulatory roles and compliance duties do not create a universal rule assigning every loss to the deploying customer.
Article 6 of the AI Act governs high-risk classification. Article 26 of the AI Act specifically addresses deployers of high-risk systems. Its supervision requirements should not be applied indiscriminately to every autonomous agent.
Timing also matters. As of October 25, 2026, the official EU AI Act implementation timeline places the Annex III high-risk rules at December 2, 2027, and the relevant regulated-product high-risk rules at August 2, 2028. Those dates do not suspend existing civil obligations or the GDPR.
A U.S. vendor should not assume that being incorporated outside Europe resolves the scope question. Article 2 of the AI Act includes specified non-EU providers and deployers, including certain situations where system output is used in the Union. The actual deployment must be assessed before concluding that the regulation applies.
What if the agent accesses personal data?
Article 32 of the GDPR requires controllers and processors to implement security appropriate to the risk. Their actual data-processing roles matter: “model provider,” “software vendor” and “customer” do not automatically map to GDPR roles.
Article 82 of the GDPR provides for compensation for damage caused by an infringement. A processor’s liability is specifically conditioned on breaches of processor obligations or acting outside or against lawful instructions. An infringement, damage and causation remain necessary. Multiple actors may be liable under the conditions stated in that article.
Regulatory compliance and a claim for compensation should therefore be assessed separately from the criminal investigation.
What evidence will determine responsibility?
Return to the supplier-search example. Who retained the credentials? What access was authorized? Which restrictions were promised? What instruction was processed, and which tool actually performed the action?
Contracts, permission settings, software versions, logs and alerts may help answer those questions. Evidence retention should itself be secure and proportionate, rather than becoming another uncontrolled collection of personal data.
For U.S. procurement and legal teams, the practical task is to connect each vendor’s commitment to an observable control and an available record. A contract allocating risk is useful; it does not explain what happened without supporting evidence.
Can a victim sue the AI agent instead of the business?
Not as a separate legal person under the French framework discussed here. Claims must identify relevant people or organizations and satisfy the applicable liability rules.
Is the LLM provider always responsible for an agent’s actions?
No. The claimant must establish the relevant basis for liability and its connection to the provider. Supplying the underlying model alone does not settle that question.
Can the business owe compensation without a criminal conviction?
Yes. Contractual nonperformance or civil negligence can support compensation even where the elements of fraudulent access are not established.
Can the harness vendor and the customer both be liable?
Potentially. Each actor’s obligations, failures and causal contribution must be examined. There is no universal percentage allocation for an AI incident.
Is every autonomous agent a high-risk AI system?
No. Classification depends on the system and its use, not autonomy alone. Applicable dates and transitional provisions must also be checked.
Does this article establish the U.S. liability rule?
No. It explains French and EU rules for U.S. businesses dealing with European deployments. U.S. federal and state law, governing law and jurisdiction require a separate assessment.
Autonomy does not identify the party that pays
Agentic AI can separate the organization giving an instruction from the organizations providing the model, tools and execution layer. Liability analysis must reconnect that chain.