Category: Regulatory | Reading time: 6 min
The Law
California Assembly Bill 316 took effect January 1, 2026. It prohibits the use of AI autonomy as a defense in civil litigation.
An organization that deploys an AI agent cannot argue in a California court that the agent acted on its own and therefore the organization bears no responsibility for the outcome.
The liability lands on the deployer regardless of how autonomous the agent was, regardless of whether the deploying organization intended the agent's actions, and regardless of whether the agent behaved within its design parameters.
The Moffatt Precedent
The legal foundation for AB 316 was already being built in case law before the statute passed.
In Moffatt v. Air Canada, a court held that an organization was liable for commitments made by an autonomous chatbot even when those commitments directly contradicted the organization's internal policy.
The agent promised a bereavement fare discount. The policy said no such discount existed. The court ruled Air Canada responsible for the promise its agent made.
The principle: organizations are accountable for what their agents commit to on their behalf, regardless of whether the agent was acting within intended parameters.
United States v. Heppner
The evidentiary dimension of AI agent liability was addressed in a February 2026 ruling from the Southern District of New York.
In United States v. Heppner, the court ruled that written exchanges between a defendant and Claude are not protected by attorney-client privilege. The first ruling of its kind nationwide.
The implications extend beyond privilege. If AI interactions are discoverable in litigation, every organization needs to know exactly what their agents produced, what instructions they were operating under, and what actions they took.
The audit trail is not just a compliance requirement. It is litigation preparation.
What Deployers Now Own
Under AB 316 combined with the Moffatt precedent, California deployers own the full liability surface of their agents.
Every commitment an agent makes on behalf of the organization. Every action it takes in a customer interaction. Every decision it reaches in an automated workflow.
The legal shield of AI autonomy is gone. What remains is the organization's ability to demonstrate that the agent was operating within a defined, documented, and verifiable scope of authority when the relevant action occurred.
That demonstration requires records that most organizations do not currently maintain.
The Documentation Requirement
The practical response to AB 316 is documentation infrastructure built before litigation arises, not after.
An organization that can produce a signed record showing exactly what an agent was authorized to do, what behavioral profile it was operating under, and what specific action it took at a specific moment is in a defensible position.
An organization that can produce only a server log showing that an API call was made from an authenticated service account is not.
The difference between those two positions is the infrastructure layer that creates the record at write time, not reconstructs it from logs after the fact.
The National Direction
California tends to lead on liability and consumer protection law. AB 316 is unlikely to remain a California-only requirement.
The combination of Moffatt precedent, federal enforcement priority signaled by the June 2 Executive Order, and the global trend toward deployer liability in AI governance frameworks suggests that the elimination of the AI autonomy defense is becoming the baseline legal environment for AI agent deployment.
Organizations building deployer liability documentation into their agent infrastructure now are building for the legal environment that is coming everywhere, not just California.
Sources: California AB 316 State AI Law Analysis and Harvard Law Review on United States v. Heppner