Your AI Agents Are About to Start Hiring Subcontractors. Who’s Liable When One Fails?

In 2022 a man named Jake Moffatt asked Air Canada’s website chatbot about bereavement fares after his grandmother died. The bot told him he could book now and claim the discount within 90 days. That was wrong, the real policy didn’t work that way, and when he claimed the refund Air Canada refused. He took them to a tribunal, and the airline’s defence is the part worth remembering. Air Canada argued, in writing, that the chatbot was “a separate legal entity that is responsible for its own actions.” The tribunal called that a remarkable submission and ordered the airline to pay. As the member put it, the chatbot is part of Air Canada’s website, and the company is responsible for what its website tells people. Full stop.

I keep that case close because it’s the simplest possible version of a problem that is about to get enormously more complicated. One company, one bot, one customer, and even then the “it wasn’t us, it was the machine” defence collapsed on contact. Now picture the same question when it isn’t one bot, but a chain of them.

The chain is the new attack surface for accountability

Here’s where things are heading, and a recent framework from DeepMind on what they call intelligent delegation lays it out clearly. As AI agents get more capable, they stop just answering and start delegating. Your agent takes a task, decides it can’t do all of it, and hands a piece to another agent. That agent hands a piece to a third. The researchers write it as a chain, A delegates to B, B sub-delegates to C, and so on down a line you may never see the end of.

Each hand-off is fast, cheap, and invisible. And every link is a place where a subtle mismatch between what you wanted and what gets done can creep in, then propagate downstream before anyone notices. The paper’s blunt phrase for the result is an “accountability vacuum”: the distance between the human who set the intent and the agent that produced the harm grows so large that, when something goes wrong, there’s no obvious place to point.

This is not a new problem to anyone who has managed a supply chain. You hire a contractor, they subcontract, the subcontractor subcontracts, and four layers down someone uses the wrong material. The difference is speed and visibility. Human subcontracting leaves a paper trail and takes weeks. Agentic subcontracting happens in seconds, across parties you never chose, with no invoice to trace.

“The agent did it on its own” is already a losing argument

If your instinct is that the liability stops with whoever’s agent went rogue, the law is moving fast in the opposite direction, and toward you.

Air Canada was 2024. Since then the ground has hardened. A California statute that took effect at the start of 2026 forecloses the defence that an AI acted autonomously and therefore no one is responsible. Across multiple jurisdictions a “reasonable oversight” standard is emerging: the organisation that deployed the agent is liable for what it does unless it can prove it had real monitoring, auditing, and controls in place. Read that twice, because it inverts the burden. You don’t get to say “the agent surprised us.” You have to show you were watching.

Google’s DeepMind Intelligent AI Delegation paper states the principle the law is catching up to: in a delegation chain, responsibility is transitive. Agents, in the paper’s words, cannot absolve themselves of accountability by blaming their subcontractors. If your agent A delegated to B, and B’s sub-delegate C caused the loss, you don’t get to shrug at C. You’re accountable to whoever you served; you take the hit and you chase B; B chases C. The liability flows up the chain to you, not down the chain away from you.

The trap is being kept in the loop only to take the blame

There’s a subtler risk in here that should bother any security leader, and the paper names it precisely: the “moral crumple zone.” That’s a setup where a human is kept nominally in charge of a process, retains the accountability for it, but has no real ability to understand or control what the chain of agents is actually doing. They’re not overseeing anything. They’re positioned to absorb liability when it fails, a crumple zone in a crash, there to take the impact.

If you’ve watched a long automated workflow get a human “approver” bolted on at the end, someone clicking yes on outputs they can’t realistically verify, you’ve seen the shape of it. That person isn’t a control. They’re a liability sponge, and dressing them up as oversight is worse than having no human there at all, because it manufactures the appearance of accountability while removing its substance.

What I’d put in place before I let an agent sub-delegate

The fix the framework proposes is not “ban delegation,” it’s to engineer the accountability back in before the chain forms. Three things are worth your attention now, while these systems are still young enough to govern.

• Demand a liability firebreak. The paper’s idea is simple and sharp: at defined points in the chain, an agent must either assume full, non-transitive liability for everything downstream of it, effectively insuring you against its sub-agents, or stop and come back to a human for fresh authority. No silent sub-delegation into the dark. Before you adopt an agentic tool, ask the vendor which of those two it does when it hands work to another agent. If the answer is neither, you’ve found your exposure.
• Keep immutable provenance. When it goes wrong, and at machine scale across long chains, some of it will, the one thing that saves you is being able to reconstruct who delegated what to whom. A complete, tamper-evident record of the chain isn’t bureaucracy; under a “reasonable oversight” standard it’s the evidence that you were watching. This is the same chain-of-custody discipline your field already lives by, pointed at autonomous actors.
• Give your human overseers real authority, or don’t put them there. If a person is accountable for a chain, they need the ability to see into it, interrogate it, and halt it, not just a button at the end. A checkpoint that can only say yes is a crumple zone. Either resource the oversight properly or stop pretending it exists.

Air Canada lost a few hundred dollars and a news cycle over a single bot that told one customer the wrong thing. The bill scales with the chain. When your agents are routinely hiring subcontractors you’ve never met, at a speed no human can follow, “the agent did it on its own” won’t save you any more than it saved them. The only thing that will is having decided, in advance, exactly where the liability stops, and making sure a real person, with real authority, is standing there when it does.