Who Is Legally Liable for the Decisions Made by Agentic AI?

Agentic AI is becoming a much bigger part of the conversation around artificial intelligence. Unlike more traditional AI tools that respond to individual prompts, agentic AI can be given a goal and then take a series of actions to achieve it. This could include accessing information, interacting with other systems and making decisions with much less human involvement along the way.

That level of autonomy could make AI much more useful, but it also creates some difficult questions around data protection. If an AI agent is processing personal data, making decisions or taking actions on behalf of an organisation, who is responsible if something goes wrong?

Greater autonomy does not mean less accountability

Giving an AI system more independence does not remove an organisation's responsibilities under data protection law. If personal data is being processed, the organisation still needs to understand how and why that information is being used and be able to demonstrate that the processing is lawful.

This becomes more complicated when several organisations are involved in developing, providing and deploying an AI system. It is therefore important to establish from the outset who is acting as the controller, processor or, in some circumstances, joint controller.

The technology might be new, but organisations cannot simply pass responsibility over to the AI because a decision was made autonomously.

A DPIA should be part of the conversation

Before introducing agentic AI into processes involving personal data, organisations should consider whether a Data Protection Impact Assessment (DPIA) is required. This is particularly important where the use of AI is likely to result in a high risk to people's rights and freedoms.

A useful DPIA should go beyond describing the technology. It should look at what personal data the AI agent can access, why it needs that information, what actions it is allowed to take and what could happen if it gets something wrong. Organisations should also consider whether a person can step in when necessary and how the actions taken by the AI will be monitored.

Doing this before deployment makes it much easier to identify risks that might otherwise only become obvious once the system is already in use.

Think carefully about what the AI can access

Agentic AI becomes particularly interesting from a data protection perspective when agents are connected to other systems. An agent might need access to emails, databases, customer records or other information to complete a task, but that does not mean it should automatically have unrestricted access to everything available.

The principle of data minimisation still applies. Organisations should consider what information the agent genuinely needs and limit access accordingly. Giving an AI agent wider permissions because it is convenient could create unnecessary privacy and security risks.

Human oversight still matters

One of the attractions of agentic AI is its ability to complete tasks without someone guiding every individual step. However, there still needs to be a clear understanding of when human involvement is required.

That could mean requiring approval before certain actions are taken, setting limits on what an agent can do independently or making

Using agentic AI responsibly

None of this means organisations should avoid agentic AI. Used appropriately, it could offer significant opportunities to automate processes and make better use of existing technology.

The important point is that adoption should not move faster than governance. Organisations considering agentic AI should understand what the system is doing, assess the data protection risks before deployment, limit its access to personal information and make sure responsibility remains clearly defined.

AI might be becoming more autonomous, but accountability still sits with people and organisations.

Considering using agentic AI?

If your organisation is considering introducing agentic AI, it is important to understand the data protection and governance risks before putting it into practice. Find out how Data Privacy Simplified can help you assess the risks, put the right safeguards in place and use AI responsibly.