AI Agents and International Law: Liability for Autonomous Decisions

Introduction

AI agent liability concerns the legal responsibility of individuals and organizations when autonomous software makes decisions, executes transactions, or causes harm without direct human intervention. Under existing legal frameworks, autonomous AI agents do not ordinarily bear independent legal responsibility. Liability instead depends on the applicable rules of contract, negligence, product liability, data protection, and other statutory obligations. These rules connect legally consequential conduct to identifiable persons or organizations, even when the immediate action is performed by software.

The difficulty becomes more pronounced when an autonomous system acts beyond what its operator anticipated. A business may authorize software to negotiate with suppliers, compare prices, and complete purchases without reviewing every transaction. If the system accepts unfavorable terms, transfers funds incorrectly, or causes financial loss to another business, separate questions arise concerning contractual authority, fault, causation, and compensation. The agent's operational independence does not necessarily place its conduct outside the legal responsibility of the organization using it.

International transactions introduce further complications. An autonomous system may be developed in the United States, deployed by a European company, and used to contract with suppliers in Asia. An injured party may then need to establish which national law governs the dispute, which court has jurisdiction, and whether a judgment can be enforced against a defendant located abroad. Different legal systems may also characterize the same conduct differently, particularly when a claim involves contractual obligations, defective software, or negligence.

International law does not presently establish a comprehensive universal civil-liability regime specifically for autonomous AI agents. Existing international instruments address particular aspects of automated contracting, while national and regional legal systems remain central to determining substantive liability. The distinction between recognizing an automated action, attributing it to a legal person, and establishing an obligation to compensate another party is fundamental to understanding how responsibility operates.

1. Autonomous Decisions and Legal Responsibility

Autonomous AI agents differ from conventional software principally in the degree of operational discretion they exercise. Traditional automation commonly follows predetermined instructions: a payment is issued when specified conditions are satisfied, or an order is submitted when inventory falls below a particular threshold. Agentic AI may pursue broader objectives by selecting intermediate actions, consulting external information, using connected applications, and adjusting its approach as circumstances change.

This distinction is functional rather than absolute. A deterministic program may conclude binding contracts without human intervention, while a sophisticated AI system may operate under restrictive approval requirements. The legally significant questions concern what the system was permitted to do, how its actions were generated, and whether those actions created obligations or risks for identifiable persons. Its technical classification does not independently determine the governing law or the allocation of responsibility.

The term agent introduces a potential misunderstanding. In computer science, it describes software capable of acting toward an objective. In private law, agency ordinarily concerns a legally recognized relationship in which one person acts on behalf of another. An AI system's ability to negotiate or communicate does not automatically establish that it possesses the legal capacities of a human agent. The applicable law must still determine whether an automated action can bind a principal and what legal consequences follow.

The distinction also explains why the concept of electronic legal personality remains separate from ordinary liability analysis. Proposals to recognize sophisticated autonomous systems as independent legal persons have appeared in debates concerning robotics and artificial intelligence. Such proposals have not established a generally applicable legal status for autonomous agents within the legal frameworks considered here. Recognizing separate personality would also raise questions concerning representation, assets, enforceable obligations, and compensation.

Ethical accountability should be distinguished from legal responsibility. International discussions of artificial intelligence ethics address transparency, fairness, oversight, and the distribution of technological risks. These concerns can influence legislation and the interpretation of legal obligations, but ethical principles do not automatically establish a civil cause of action. Liability requires an identifiable legal basis and satisfaction of the requirements imposed by the relevant legal system.

2. Allocating AI Agent Liability

An autonomous decision may result from contributions made by several organizations. A foundation-model provider supplies underlying technology, an application developer creates specialized functions, an integrator connects external services, and a deploying business determines how the completed system will operate. The disputed action may occur only after the agent encounters external information or instructions that none of these participants specifically anticipated.

Participation in this chain does not establish joint responsibility by itself. Contractual liability concerns obligations arising under enforceable agreements. Negligence depends on legally recognized duties and the defendant's conduct. Product liability may attach to specified economic operators when a defective product causes damage covered by the applicable legislation. Multiple claims may arise from the same incident, but the claimant must establish the elements of each relevant cause of action.

Direct and vicarious liability also require separate treatment. An organization may be directly responsible for its own negligent deployment practices, defective products, or misleading representations. In appropriate circumstances, it may bear vicarious responsibility for the conduct of employees or other persons within recognized legal relationships. Those doctrines cannot automatically be transferred to autonomous software merely because it performs functions previously undertaken by human workers.

2.1 Deployers, Operators, and Delegated Authority

Businesses deploying autonomous AI agents commonly determine the objectives, permissions, and operational limits of the system. An organization might allow an agent to negotiate delivery terms, issue purchase orders, and access a corporate payment account. These decisions create the circumstances in which legally consequential conduct becomes possible, even when the organization does not select each individual action.

Authority presents a particular difficulty. An agent may be technically capable of concluding a purchase that exceeds an internal spending limit. Whether the resulting transaction binds the business depends on the applicable rules of contract formation and attribution, the contractual arrangements with the counterparty, and any relevant restrictions on authority. An internal instruction does not necessarily defeat the rights of a third party who was entitled to rely on the organization's external conduct.

Responsibility also depends on what the organization knew or ought reasonably to have anticipated. Deploying an autonomous system with unrestricted access to financial accounts may create different legal risks from allowing the same system to draft correspondence for approval. Relevant considerations can include transaction limits, available safeguards, monitoring practices, and the ability to interrupt operations. Their legal significance depends on the cause of action and the applicable standard of care.

The Canadian decision in Moffatt v Air Canada, 2024 BCCRT 149, provides a limited illustration of organizational responsibility for automated representations. A customer relied on incorrect information supplied by an airline's website chatbot concerning retrospective bereavement fares. On February 14, 2024, the British Columbia Civil Resolution Tribunal found Air Canada liable for negligent misrepresentation, rejecting the argument that responsibility for the chatbot's information could be separated from responsibility for the airline's website.

The Tribunal found that Air Canada had failed to take reasonable care to ensure the accuracy of the information communicated through its chatbot. It awarded damages and associated amounts under the applicable small-claims framework. The case did not concern software independently negotiating or executing contracts, nor did it establish a general rule imposing liability for every chatbot error. Its narrower significance is that using automated technology does not necessarily relieve a business of existing duties concerning information supplied to customers.

2.2 Developers, Model Providers, and Integrators

Responsibility becomes more difficult to allocate when the alleged failure originates upstream. A developer may release software with inadequate safeguards, an integrator may connect it to sensitive applications without appropriate restrictions, or a supplier may provide inaccurate information about its capabilities. Different legal claims may arise depending on which conduct contributed to the loss, what obligations existed, and whether a legally sufficient causal connection can be established.

The distinction between general-purpose technology and a particular deployment is significant. A model provider may control underlying capabilities and certain safety features without knowing the commercial transactions subsequently undertaken by customers. Conversely, an organization deploying the model may understand the specific operational risks while possessing limited ability to modify its internal behavior. These differences can influence the assessment of reasonable precautions, foreseeable harm, and responsibility.

Singapore's Infocomm Media Development Authority examined this distribution problem in its May 2026 discussion paper, Legal Responsibility for AI Agents. Drawing on discussions within a working group involving members of Singapore's legal community, the paper identified difficulties concerning evidence, access to remedies, and the allocation of responsibility across the agentic AI value chain. It considered fault-based and strict-liability approaches without establishing new binding legal rules.

The paper's discussion illustrates a practical problem: a claimant may be able to identify the system that caused harm without knowing which participant failed to satisfy a legal obligation. The conduct of a model provider, application developer, and deploying organization must be assessed individually, even where their contributions operate together. Attribution of an automated action to a contracting person does not itself establish negligent development or a defective product.

Commercial contracts may allocate some of these risks through warranties, indemnities, limitations of liability, and obligations concerning security or monitoring. Such provisions can determine whether a deploying business has recourse against a supplier after compensating an injured party. Their effects remain subject to mandatory law, and an agreement between commercial participants does not automatically extinguish claims belonging to third parties.

3. AI Contracting and the Attribution of Agreements

Automated contracting presents a distinction between a legally effective transaction and the person bound by it. Software may exchange offers and acceptances without immediate human involvement. The absence of individual human review does not necessarily prevent contractual formation, but enforceability still depends on applicable rules concerning attribution, authority, mistake, and other contractual requirements.

Consider a European business that authorizes an autonomous purchasing agent to obtain electronic components from an overseas supplier. The agent identifies a seller, negotiates delivery dates, accepts contractual terms, and submits a purchase order. The business subsequently discovers that the software accepted an unusually high price and agreed to restrictive cancellation conditions. The dispute cannot be resolved merely by establishing that the agent acted independently.

The analysis must determine whether the transaction was properly attributed to the business, whether the accepted terms became part of a valid agreement, and whether mistake or another doctrine provides relief. A finding that a contract exists does not necessarily establish breach or damages. International commercial instruments provide relevant rules for these questions without replacing the substantive contract law governing the transaction.

3.1 The 2005 Electronic Communications Convention

The United Nations Convention on the Use of Electronic Communications in International Contracts, adopted in 2005 and in force since March 1, 2013, addresses legal obstacles associated with electronic commercial dealings. Article 12 provides that a contract formed through interaction between automated message systems, or between such a system and a natural person, cannot be denied validity or enforceability solely because no natural person reviewed the individual actions or resulting contract (United Nations, 2005).

The provision prevents the absence of contemporaneous human participation from becoming an independent reason to reject a contract. It does not determine every substantive question concerning authorization, mistake, fraud, contractual capacity, or breach. Those issues remain subject to applicable law. The Convention recognizes the legal effectiveness of certain automated dealings without conferring independent contractual personality on the software involved.

Its international scope is also limited. Under Article 1, the Convention concerns electronic communications connected with contracts between parties whose places of business are in different states, subject to its conditions concerning contracting states and other applicable rules. Article 2 excludes specified categories, including contracts concluded for personal, family, or household purposes and certain financial-market transactions. Article 3 permits parties to exclude or vary its provisions within the relevant legal limits.

Article 14 provides a qualified mechanism for withdrawing an electronic communication containing an input error made by a natural person interacting with another party's automated message system. Its operation depends on specified conditions, including the absence of an opportunity to correct the error and the required steps following discovery. It does not establish a general right to reverse an unexpected transaction independently generated by autonomous AI.

These provisions remain significant because conventional electronic contracting and agentic AI contracting share a legal problem: a transaction may occur without a human examining its precise terms. The Convention addresses one obstacle to contractual recognition, but it does not establish an international code for allocating damages when the automated system acts outside its operator's expectations.

3.2 UNCITRAL's 2024 Model Law on Automated Contracting

The United Nations Commission on International Trade Law adopted its Model Law on Automated Contracting on July 11, 2024. Unlike earlier international instruments centered on electronic communications, the Model Law expressly accommodates automated systems operating in deterministic or nondeterministic ways. It addresses the formation and performance of contracts through automated systems, including arrangements involving computer code and changing external information (UNCITRAL, 2024).

Article 5 addresses the legal recognition of automated contracting, while Article 6 concerns contracts whose terms are expressed in computer code or incorporate dynamic information. The provisions remove specified objections based solely on the use of automation or electronic techniques. They do not dispense with ordinary contractual requirements concerning agreement, validity, illegality, or enforceability.

Article 7 provides a more specific framework for attribution. Under Article 7(1), an action carried out by an automated system is attributed between contracting parties according to their agreed procedure. Where that provision does not apply, Article 7(2) establishes a default rule attributing the action to the person using the system for that purpose. Article 7(3) prevents attribution from being denied solely because the outcome was unexpected.

The final paragraph is particularly significant. Article 7(4) preserves the application of other laws governing the legal consequences of attribution. The person to whom an automated action is attributed is not necessarily liable in damages merely because the attribution rule applies. Contractual formation, breach, mistake, causation, and remedies must still be determined under the relevant legal principles.

Article 8 offers an optional provision concerning unexpected automated actions. Unless the parties agree otherwise, it would prevent a contracting party from relying on an attributed action where the person to whom it was attributed could not reasonably have expected the action and the counterparty knew, or could reasonably have known, of that lack of expectation. Its application depends on the circumstances and the precise terms enacted by the relevant jurisdiction. It does not establish a universal defense invalidating every unexpected automated transaction.

Articles 9 and 10 reinforce the relationship between automated contracting and existing law. Article 9 preserves legal rules concerning disclosure of information about the design, operation, or use of automated systems, including consequences for inadequate or inaccurate disclosure. It does not independently create a comprehensive disclosure obligation. Article 10 provides that, unless otherwise provided by law, using an automated system does not by itself relieve a party from the consequences of failing to comply with another legal rule.

The Model Law is not a universally binding treaty. Its provisions operate as domestic law only where and to the extent that a jurisdiction adopts them. States may also enact different legislative options or modify particular provisions. The accompanying UNCITRAL Guide to Enactment explains the intended distinctions between legal recognition, attribution, information requirements, and substantive liability (UNCITRAL, 2025).

For the European purchasing agent, these rules offer a coherent legislative approach without automatically determining the outcome. An agreed procedure may govern attribution, but the business's liability for an expensive purchase still depends on the governing contract law. If the counterparty recognized that the system had generated an extraordinary transaction, a jurisdiction adopting optional Article 8 might provide additional protection. Its availability cannot be presumed in a country that has not enacted the relevant rule.

3.3 Contractual Mistake and the Quoine Decision

The Singapore Court of Appeal considered the enforceability of algorithmically executed transactions in Quoine Pte Ltd v B2C2 Ltd [2020] SGCA(I) 02. The dispute arose after cryptocurrency trading algorithms executed transactions at exceptionally unusual exchange rates following operational failures on the trading platform. Quoine subsequently reversed the transactions, leading B2C2 to challenge the cancellation.

The Court considered whether valid contracts had arisen, whether Quoine possessed a contractual power to cancel the transactions, and whether mistake affected their enforceability. The majority concluded that the relevant trading contracts were valid and that Quoine was not entitled to reverse them on the grounds advanced. Its treatment of unilateral mistake focused on the legally relevant knowledge associated with the programmers responsible for the deterministic algorithms.

In applying the doctrine of unilateral mistake, the majority examined whether the programmers acted with actual or constructive knowledge of the relevant mistake when establishing the trading arrangements. It did not attribute independent human intention to the algorithms. The inquiry concerned the knowledge and conduct of identifiable persons in a transaction structured to operate automatically.

Lord Mance dissented on the unilateral-mistake issue. He considered that the extreme abnormality of the transactions and the circumstances indicating a fundamental operational error should receive greater significance in the equitable analysis. His reasoning represents a dissenting position rather than the rule established by the majority.

The Court dismissed Quoine's appeal concerning breach of contract but allowed its appeal concerning the separate breach-of-trust claim. B2C2 nevertheless remained contractually entitled to the proceeds of the disputed trades. The distinction is necessary to represent the disposition of the appeal accurately.

The judgment concerned deterministic algorithms, meaning systems operating according to predefined computational rules. It does not establish a general test for contracts concluded by nondeterministic AI agents capable of selecting actions that programmers did not specifically anticipate. Its continuing relevance lies in showing how established doctrines of contractual formation and mistake may be applied to automated transactions while leaving important questions concerning more autonomous systems unresolved.

4. Civil Liability for Harm Caused by AI Agents

Autonomous AI systems may cause harm beyond the immediate contractual relationship between a technology supplier and its customer. A purchasing agent might issue unauthorized instructions affecting another company's inventory, while software managing financial operations could disclose confidential information or transfer funds incorrectly. These incidents may generate contractual claims, non-contractual claims, or both, depending on the parties involved and the interests protected by the applicable law.

The nature of the harm determines which legal rules become relevant. Personal injury, property damage, financial loss, data protection violations, and interference with contractual rights are not interchangeable categories. Some liability regimes permit recovery for particular forms of damage while excluding others. A company suffering purely financial loss from inaccurate automated information may encounter restrictions that would not arise in a claim for physical injury caused by defective machinery.

The distinction between fault-based and strict liability is equally significant. Negligence ordinarily requires proof that the defendant failed to satisfy a legally recognized standard of care. Strict-liability regimes may impose responsibility without proving negligence, but only where their statutory conditions are satisfied. Neither approach establishes an unrestricted entitlement to compensation whenever autonomous software produces an unfavorable result.

4.1 Negligence and Third-Party Loss

Negligence requires a claimant to establish the elements recognized under the applicable legal system. In common-law jurisdictions, these generally include a duty of care, breach, causation, and legally recoverable damage. The existence and scope of a duty cannot be assumed merely because a technology provider or deploying organization participated in the events preceding the harm.

For autonomous AI agents, the applicable standard of care may depend on the system's intended functions and foreseeable risks. An organization allowing software to transfer substantial funds without meaningful authorization controls presents different concerns from one using an agent to organize non-sensitive documents. Relevant precautions may include transaction limits, restricted access, testing, supervision, and the capacity to interrupt harmful operations. Whether these measures are legally required depends on the circumstances and governing law.

Unpredictability complicates the analysis without necessarily defeating liability. A defendant may be unable to anticipate the precise sequence through which harm occurs while still recognizing the broader risk associated with granting unrestricted operational authority. Conversely, an unusual outcome does not establish negligence where the relevant standard of care was satisfied and the loss was not legally foreseeable.

The distinction between foreseeable risks and unforeseeable outcomes is particularly important for systems that select their own intermediate actions. If a deployer knows that an autonomous purchasing agent can access confidential financial records, the risk of improper disclosure may be foreseeable even though the particular sequence leading to disclosure cannot be predicted. The legal question concerns the applicable duty and whether reasonable precautions were taken against the relevant danger.

Causation presents a separate obstacle. A harmful transaction may result from a provider's software defect, an integrator's configuration error, an operator's inadequate supervision, or information supplied by an external system. The claimant must connect the legally relevant conduct to the damage under the applicable causation rules. Restrictions on recovery for pure economic loss may further limit claims against defendants who have no contractual relationship with the injured party.

4.2 Defective Software and Product Liability

Product liability provides a distinct route to compensation when legally recognized damage results from a defective product. The European Union revised its framework through Directive (EU) 2024/2853, which expressly includes software within its definition of products. Software may be treated as a standalone product or as a component integrated into another product, subject to the directive's scope and exclusions.

Article 7 defines defectiveness by reference to the safety that a person is entitled to expect or that is required under Union or national law. Relevant circumstances include the product's characteristics, reasonably foreseeable use, safety requirements, and capacity to learn or acquire new features. A commercially disadvantageous decision does not, by itself, establish that an autonomous AI system is defective.

The directive distinguishes recoverable damage from ordinary commercial loss. Under Article 6, compensation covers specified categories, including death or personal injury, qualifying damage to property, and destruction or corruption of data not used for professional purposes. Property used exclusively for professional purposes is excluded from the relevant category of property damage. Material losses flowing from covered damage may be compensable, while non-material losses depend on the applicable national rules.

The persons entitled to claim compensation are also specifically defined. Article 5(1) requires member states to ensure that a natural person who suffers damage caused by a defective product is entitled to compensation under the directive. Article 5(2) permits claims to be brought by persons who have succeeded, or have been subrogated, to the injured person's rights under applicable law or contract, as well as persons authorized by law to act on behalf of injured persons. These provisions do not establish a general right for companies to recover purely commercial losses arising from unfavorable autonomous transactions.

These restrictions are significant for businesses using autonomous purchasing or trading agents. A company that suffers a purely financial loss because software accepted an unfavorable commercial agreement cannot assume that the revised product-liability regime provides compensation. Other contractual or non-contractual claims may remain available, but their legal requirements must be established independently.

The directive also addresses evidentiary difficulties associated with technically complex products. Article 9 concerns disclosure of evidence, subject to requirements of plausibility, necessity, and proportionality. Article 10 maintains the claimant's general obligation to prove defectiveness, damage, and causation, while providing specified rebuttable presumptions. These provisions can assist injured persons without establishing automatic liability for every unexpected outcome.

The temporal scope must be distinguished from the directive's adoption date. Following the corrigendum published on May 7, 2026, the revised regime applies to products placed on the market or put into service after December 8, 2026. As of November 7, 2026, that application date had not arrived. The legal treatment of earlier products remains governed by the applicable existing framework.

The directive excludes free and open-source software developed or supplied outside the course of a commercial activity. It also preserves other applicable liability regimes, including contractual claims and non-contractual claims based on grounds other than product defectiveness. Its contribution is to modernize liability for defective products, not to establish a general compensation system for autonomous AI decisions.

5. Proving Responsibility for Autonomous Conduct

Establishing what an AI agent actually did can be more difficult than identifying the organization that deployed it. Autonomous systems may execute multiple operations through external applications, access changing information, and modify their course of action in response to intermediate results. A final transaction record may reveal that an order was placed without explaining how the system selected the supplier, interpreted instructions, or accepted particular terms.

Relevant evidence may include initial objectives, system instructions, application permissions, records of external tool use, model versions, transaction logs, human approvals, and changes to operational settings. These materials can help reconstruct the sequence of events and establish the extent of human involvement. Their evidentiary significance depends on reliability, completeness, authentication, and the procedural rules governing their production and admissibility.

Technical causation must be distinguished from legal responsibility. A system log might demonstrate that an agent transmitted a harmful instruction, but that does not establish which defendant breached a legal obligation. A claimant may still need to prove that a developer failed to implement a legally required safeguard, that an operator acted negligently, or that a defective product caused recognized damage.

Third-party interference creates additional complications. Prompt injection can occur when an autonomous agent encounters malicious instructions embedded in external material and treats them as operational directions. Unauthorized access or manipulated information may produce similar outcomes. Such interference can raise questions concerning intervening causes and the conduct of attackers, but it does not automatically release developers or deployers from responsibility for inadequate protection against foreseeable threats.

Consider the European purchasing agent that concludes an unexpectedly expensive agreement with an overseas supplier. The operator may contend that the system exceeded its instructions, while the supplier may argue that it received an apparently valid purchase order. If the excessive price resulted from malicious information inserted into a supplier database, the dispute could involve contractual attribution, possible negligence, and third-party interference. The evidence required to resolve each issue would differ.

Cross-border operation compounds these problems. Relevant records may be stored by service providers established in several jurisdictions, with access governed by different contractual, privacy, and procedural rules. The legal treatment of cross-border data flows becomes relevant when information must be transferred, disclosed, or obtained through foreign legal processes. An obligation to preserve evidence does not necessarily authorize unrestricted access to information held abroad.

The debate over strict liability reflects these practical difficulties. A strict-liability regime may reduce the burden on injured persons who cannot establish precisely where fault occurred. It may also place losses on an operator or provider that exercised reasonable care. Fault-based liability maintains a closer relationship between responsibility and wrongful conduct but may leave claimants without compensation where technical complexity prevents them from proving breach.

Neither approach supplies a universal solution. The appropriate allocation of risk depends on the activities involved, the legal interests protected, the parties' capacity to prevent harm, and the applicable rules governing compensation. Autonomous behavior complicates the evidentiary inquiry, but it does not remove the need to establish the conditions of the chosen liability regime.

6. Cross-Border AI Liability and Private International Law

Private international law becomes central when an autonomous AI agent operates across national borders. A European company may use software supplied by an American developer to contract with an Asian manufacturer. If the transaction fails, the parties may disagree about the governing law, the competent court, and the remedies available against an overseas defendant.

These questions must be distinguished. Jurisdiction concerns the authority of a court to hear the dispute. Choice of law determines which legal system governs the substantive claim. Recognition and enforcement concern the circumstances in which a judgment can produce legal consequences in another country. A court may possess jurisdiction while applying foreign law, and a successful claimant may still encounter difficulties enforcing a judgment abroad.

The location of a model, cloud server, or other technological component does not necessarily determine the applicable law. International electronic-commerce instruments recognize that technological infrastructure may be situated somewhere different from the parties' places of business. The relevant connecting factors depend on the applicable conflict-of-laws rules, the nature of the claim, and the parties' contractual arrangements.

6.1 Governing Law for Contracts and Civil Wrongs

Within the European Union, Regulation (EC) No 593/2008, known as Rome I, establishes rules concerning the law applicable to contractual obligations. Article 3 recognizes party autonomy through choice-of-law agreements, subject to applicable limitations. Article 4 establishes rules for contracts where an effective choice has not been made, while other provisions address matters including consumer protection and overriding mandatory rules.

An autonomous purchasing agent may accept contractual terms containing a choice-of-law clause. Whether that clause became binding depends on questions concerning contractual incorporation, consent, authority, and validity. The presence of a clause in an electronic transaction does not conclusively establish its enforceability. Earlier contractual arrangements may also determine how automated actions are attributed and how conflicting contractual terms are resolved.

Regulation (EC) No 864/2007, known as Rome II, addresses many non-contractual obligations. Under Article 4(1), the general rule concerning tort or delict points toward the law of the country where direct damage occurs, irrespective of the country where the event giving rise to the damage occurred or where indirect consequences arise. The Regulation contains exceptions and special rules for particular categories of obligations.

Its scope is not unlimited. Article 1(2)(g) excludes non-contractual obligations arising from violations of privacy and rights relating to personality, including defamation. Such claims cannot automatically be analyzed under Rome II's general tort rule. Other exclusions and applicable European or national provisions may also affect the legal characterization of a dispute.

The distinction between contractual and non-contractual obligations may produce different governing laws within the same incident. A deploying business might bring a contractual claim against the supplier of an autonomous system while an injured third party pursues a negligence claim against the deploying organization. The two actions may be governed by different legal systems even though they concern the same technological event.

Returning to the autonomous procurement example, the contract between the European buyer and overseas supplier might contain an effective choice of law. A separate claim against the software developer could arise under another contractual arrangement, while a third party's non-contractual claim might be governed by different connecting factors. Private international law identifies the governing legal system; it does not itself establish whether a defendant breached a duty.

6.2 Jurisdiction and International Enforcement

Regulation (EU) No 1215/2012, the Brussels I Recast Regulation, governs jurisdiction and the recognition and enforcement of judgments in civil and commercial matters within its scope. Its provisions address defendants domiciled in member states, contractual disputes, harmful events, consumer contracts, and jurisdiction agreements. The applicable rule depends on the dispute and the relevant connecting factors, not simply on the use of autonomous software.

Article 7(1) provides special jurisdictional grounds for specified contractual disputes. Article 7(2) concerns matters relating to tort, delict, or quasi-delict and refers to the place where the harmful event occurred or may occur. The Court of Justice has interpreted this connecting factor, in appropriate circumstances, to include both the place of the event giving rise to damage and the place where the initial damage occurred. These alternatives must be distinguished from the location of indirect financial consequences.

Article 25 addresses qualifying agreements conferring jurisdiction on the courts of a member state. An AI agent's acceptance of a jurisdiction clause may raise questions about whether a legally effective agreement was concluded and whether the relevant formal requirements were satisfied. The underlying principles of adjudicatory jurisdiction in international law help distinguish a state's authority to decide a dispute from its ability to enforce a judgment in foreign territory.

Outside applicable European arrangements, international conventions may assist with recognition and enforcement. The 2005 Hague Choice of Court Convention addresses qualifying exclusive choice-of-court agreements in international civil and commercial matters. The 2019 Hague Judgments Convention provides rules for recognizing and enforcing qualifying judgments between contracting states, subject to specified requirements and exclusions.

Neither convention creates a universal enforcement system. Their application depends on treaty participation, temporal conditions, the subject matter of the proceedings, and other treaty requirements. Consumer contracts and certain categories of disputes may be excluded or receive different treatment. The existence of an international judgment does not eliminate the need to identify an applicable enforcement mechanism.

Arbitration offers another possibility where the parties have concluded a valid arbitration agreement. The 1958 New York Convention establishes a widely used framework for recognizing and enforcing foreign arbitral awards, subject to its conditions and grounds for refusing recognition or enforcement. An autonomous agent's acceptance of an arbitration clause may itself be disputed where the operator denies authorizing the relevant contractual terms.

For the European purchasing company, these distinctions determine whether proceedings can be brought against the supplier, the technology provider, or both. They also affect which court can consider the dispute and how any resulting judgment may be enforced. The practical recovery of compensation depends not only on substantive liability but also on jurisdiction, procedural requirements, treaty participation, and the location of assets.

7. European AI Regulation and Individual Rights

The European Union has adopted extensive legislation governing AI systems, but regulatory compliance and civil liability perform different functions. Regulatory obligations seek to control specified risks associated with developing, placing on the market, or using AI. Civil-liability rules determine whether an injured claimant can recover compensation or obtain another private-law remedy.

The distinction affects the consequences of statutory violations. A provider may breach a regulatory obligation without every person affected by the system automatically acquiring a damages claim. Conversely, an operator may comply with applicable AI regulatory requirements while remaining liable for breach of contract, negligence, or a defective product under another legal regime.

European legislation may also apply to providers established outside the Union when the relevant territorial conditions are satisfied. Regulatory reach must nevertheless be distinguished from civil jurisdiction and the recognition of foreign judgments. The fact that an organization falls within the scope of European AI legislation does not independently determine which court may award compensation in a particular dispute.

7.1 The AI Act and Its Amended Application Schedule

Regulation (EU) 2024/1689, the Artificial Intelligence Act, establishes a risk-based regulatory framework for AI systems. Its obligations vary according to the classification, function, and role of the relevant system and operator. Providers, deployers, importers, distributors, and other participants may have distinct responsibilities. An autonomous agent is not automatically classified as high-risk merely because it can act independently.

The Act includes requirements concerning prohibited practices, transparency, general-purpose AI models, and certain high-risk uses. Among the high-risk obligations are provisions concerning risk management, technical documentation, recordkeeping, human oversight, accuracy, and cybersecurity. Their application depends on the relevant legal classification and implementation timetable. The broader framework of the EU AI Act is relevant to assessing the regulatory obligations of businesses operating autonomous systems within its scope.

Regulation (EU) 2026/1744 amended the Act's application schedule and other provisions. In particular, the application of Chapter III, Sections 1–3, was deferred to December 2, 2027, for the relevant systems classified as high-risk under Article 6(2) and Annex III, and to August 2, 2028, for systems classified under Article 6(1) and Annex I. These dates must be distinguished from provisions that had already become applicable by November 2026.

Other AI Act obligations operate according to different dates. Provisions concerning prohibited practices, general-purpose AI models, and specified transparency requirements had already entered into application, subject to the relevant exceptions and transitional arrangements. Regulation (EU) 2026/1744 also established later application dates for particular newly introduced requirements. The operative legal position cannot be determined simply by treating August 2026 as the commencement date for every obligation.

The AI Act does not establish a general system of civil compensation for damage caused by autonomous agents. Its regulatory duties may nevertheless be relevant to national proceedings where compliance, reasonable precautions, or statutory obligations are disputed. The consequences depend on the applicable cause of action and the relationship between regulatory requirements and national law.

The European Commission's proposed AI Liability Directive, which contemplated adjustments to certain non-contractual liability procedures, was withdrawn rather than enacted. It cannot be treated as an operative source of damages rights or general evidentiary presumptions. This distinction is particularly important when assessing claims involving autonomous systems, since regulatory obligations and compensatory remedies continue to operate through different legal mechanisms.

7.2 GDPR Rights and Automated Decision-Making

The General Data Protection Regulation provides a separate framework for automated decisions involving personal data. Article 22 addresses decisions based solely on automated processing, including profiling, that produce legal effects concerning an individual or similarly significantly affect that person. Its application depends on the specific requirements of the provision, not merely on whether an AI system participated in a decision.

The Court of Justice examined automated credit assessment in SCHUFA Holding (C-634/21), decided on December 7, 2023. The Court held that the automated establishment of a probability value concerning a person's ability to meet payment commitments could constitute automated individual decision-making within Article 22 where a third party drew strongly on that value when establishing, implementing, or terminating a contractual relationship.

The judgment demonstrates that the legal significance of an automated assessment cannot always be determined by identifying the organization that makes the final formal decision. Where a third party relies heavily on an automatically generated score, the scoring activity itself may fall within the protection of Article 22. This conclusion depends on the particular relationship between the score and the consequential decision.

In Dun & Bradstreet Austria (C-203/22), decided on February 27, 2025, the Court considered the right to meaningful information about the logic involved in automated decision-making under Article 15(1)(h). It clarified that the information supplied must enable the individual to understand the procedure and principles actually applied to their personal data in producing the relevant result.

The judgment also addressed the relationship between access rights, trade secrets, and the personal data of third parties. Where a controller considers information protected on those grounds, the relevant material may need to be provided to the competent supervisory authority or court for an appropriate balancing of the interests involved. The decision did not establish an unrestricted right to every technical detail of an algorithm.

These judgments are relevant to agentic AI where autonomous systems perform credit assessments or make other consequential decisions concerning individuals. Article 82 separately provides a right to compensation where the requirements of infringement, damage, and causation are satisfied. An infringement alone does not automatically establish an entitlement to damages. Nor does Article 22 govern ordinary commercial transactions merely because software makes decisions without immediate human intervention.

8. UK and US Approaches to Automated Decisions

The United Kingdom and United States illustrate how automated transactions may be recognized through established legal principles without adopting identical rules for AI liability. Both legal systems preserve the importance of contract law, negligence, and applicable statutory obligations. Their approaches nevertheless differ significantly in the treatment of automated decisions involving personal information.

In the United Kingdom, the Data (Use and Access) Act 2025 amended the legal framework governing automated decision-making. Section 80, which came into force on February 5, 2026, replaced the previous UK GDPR Article 22 structure with Articles 22A–22D. The revised provisions distinguish the definition of automated significant decisions, restrictions concerning specified personal data, and safeguards for affected individuals.

Article 22A defines a solely automated decision by reference to the absence of meaningful human involvement. A significant decision is one that produces a legal effect or a similarly significant effect on the individual. Article 22B imposes restrictions on certain significant decisions involving special categories of personal data, subject to specified conditions. Article 22C requires safeguards for qualifying solely automated significant decisions.

Those safeguards include information about the decision, opportunities to make representations, access to human intervention, and the ability to contest the decision. The revised framework permits solely automated significant decisions in a wider range of circumstances than the earlier general restriction, while preserving the applicable requirements concerning lawful processing and individual rights. These protections must be distinguished from contractual liability or a general right to compensation for unfavorable automated outcomes.

In the United States, the Electronic Signatures in Global and National Commerce Act recognizes the legal significance of electronic contracting in transactions affecting interstate or foreign commerce. Section 7001(h) provides that a contract or record cannot be denied legal effect solely because its formation, creation, or delivery involved electronic agents, provided their actions are legally attributable to the person to be bound.

The attribution condition is central. The statute does not give every electronic agent unrestricted authority to bind a business. Section 7001(b) also preserves other applicable legal requirements concerning the rights and obligations of persons, subject to the Act's provisions. The use of an electronic agent does not independently settle questions of consent, mistake, misrepresentation, contractual performance, or civil liability.

The Uniform Electronic Transactions Act, where adopted by individual states, similarly addresses electronic transactions and automated systems. Contract formation, product liability, negligence, and consumer protection remain subject to the relevant federal or state legal framework. No single federal civil-liability rule governs every harmful action performed by autonomous AI agents.

These differences can affect a business operating the same autonomous system internationally. A transaction may satisfy the formal requirements for electronic contracting while generating separate disputes concerning authority or performance under national law. Automated decisions involving individuals may also engage different privacy and procedural protections. The applicable result depends on the particular legal relationship and the jurisdiction governing the claim.

9. International Governance and State Responsibility

Public international law addresses a different aspect of autonomous AI responsibility from the private-law rules governing commercial transactions. States may incur international responsibility when conduct attributable to them breaches an applicable international obligation. Private businesses, by contrast, generally face civil liability under domestic and regional legal systems. The two forms of responsibility may concern related conduct, but they arise through distinct legal relationships.

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, opened for signature on September 5, 2024, establishes a treaty framework addressing risks associated with AI throughout its lifecycle. Its provisions concern human rights, democratic institutions, the rule of law, accountability, transparency, and remedies. It does not establish a uniform international cause of action for every injury caused by autonomous software.

Its legal status requires particular care. As of November 7, 2026, the Convention had not entered into force. The European Union deposited its instrument of approval on May 15, 2026, and Bosnia and Herzegovina ratified it on October 28, 2026. Under Article 30, entry into force requires five ratifications, acceptances, or approvals, including at least three by Council of Europe member states. The Convention's adopted provisions must consequently be distinguished from treaty obligations already operative between parties.

Article 3 establishes an important distinction between public and private activities. Under Article 3(1)(a), parties are required to apply the Convention to activities undertaken by public authorities or private actors acting on their behalf. Article 3(1)(b) addresses activities of other private actors differently, requiring parties to address relevant risks and impacts consistently with the Convention's object and purpose.

For those private-sector activities, parties must specify how they intend to implement their obligations. The Convention permits them either to apply the relevant principles and obligations or to adopt other appropriate measures. This distinction prevents the Convention from being characterized as imposing identical requirements directly on every private AI developer or commercial deployer.

The European Union's declaration concerning private actors identifies implementation through its AI regulatory framework. The Convention's eventual legal operation will depend on its entry into force, the scope of parties' obligations, their declarations, and applicable implementing measures. Its value lies in establishing an international treaty framework for public governance and rights protection rather than directly determining private compensation in every AI-related dispute.

Other international initiatives include the OECD AI Principles and UNESCO's 2021 Recommendation on the Ethics of Artificial Intelligence. These instruments address governance, accountability, human rights, and responsible development, but they are not universal treaties establishing directly enforceable civil-liability rules. Their influence may arise through national legislation, institutional policies, public procurement, and technical governance.

Where public authorities deploy autonomous systems, established rules of State Responsibility in International Law may become relevant. The International Law Commission's 2001 Articles on Responsibility of States for Internationally Wrongful Acts distinguish attribution of conduct to a state from the existence of a breach of an international obligation. These Articles are not themselves a treaty, although important provisions reflect customary international law.

Article 4 attributes the conduct of state organs to the state, while Article 5 addresses certain entities empowered to exercise elements of governmental authority. Article 8 concerns conduct performed on a state's instructions or under its direction or control in the relevant circumstances. These rules identify the legal conditions under which conduct is treated as conduct of a state; they do not independently establish the substantive obligation allegedly violated.

A government agency does not necessarily avoid international responsibility by relying on automated software to perform an official function. If conduct attributable to the state breaches an applicable international obligation, the use of an AI system does not independently remove the legal character of that conduct. Whether responsibility arises depends on the applicable primary obligation and the relevant rules of attribution and breach.

The position is different when a private company independently deploys an autonomous agent. Its conduct does not automatically become attributable to a state simply because the company is incorporated, regulated, or technologically significant within that state's territory. Additional legal conditions are required for attribution. Separate international obligations may require states to regulate or protect against certain private conduct, but their existence and scope depend on the relevant legal rules.

This distinction also limits the relevance of international human rights law to ordinary commercial disputes. Human rights obligations may become central when autonomous systems are used by public authorities or affect protected rights within the scope of applicable instruments. They do not automatically replace private-law rules governing an unfavorable purchasing agreement or an ordinary contractual breach.

International harmonization remains incomplete. UNCITRAL instruments promote consistency in automated commercial transactions, while regional legislation establishes more detailed obligations concerning AI development and deployment. Private international law connects disputes with national courts and legal systems, but it does not eliminate differences in substantive liability. The remaining challenge concerns how legal systems can provide predictable attribution, access to evidence, and enforceable remedies when autonomous decisions involve several organizations and jurisdictions.

Conclusion

Autonomous AI agents can perform legally consequential actions without acquiring independent legal responsibility for their results. Under existing legal frameworks, responsibility ordinarily remains with identifiable persons or organizations, subject to the requirements of the applicable legal regime. A deploying business may be bound by an automated contract, a developer may face liability for a defective product, and another participant may be responsible for negligent conduct. None of these conclusions follows automatically from technical control or involvement in the system's development.

International law supplies important but incomplete answers. The 2005 Electronic Communications Convention recognizes automated contractual formation within its scope, while UNCITRAL's 2024 Model Law provides a legislative approach to attribution and unexpected automated actions. Regional AI regulation, data protection law, and national civil-liability doctrines address different aspects of the same technological activity. Their rules operate under distinct conditions and through different enforcement mechanisms.

The principal difficulty is not that autonomous software necessarily operates outside the law. It is that responsibility may be distributed among actors whose obligations, knowledge, and control differ substantially. Where their activities extend across borders, jurisdiction, applicable law, evidence, and enforcement become as significant as the substantive basis of liability.

A coherent legal approach must preserve the distinction between attributing an automated action, establishing a breach of duty, proving compensable harm, and enforcing the resulting obligation. Greater technical autonomy complicates these inquiries without replacing them. Effective accountability depends on whether existing and developing legal frameworks can connect autonomous conduct to identifiable legal responsibilities and remedies that injured parties can realistically obtain.

References

British Columbia Civil Resolution Tribunal (2024) Moffatt v Air Canada, decision, 14 February 2024, 2024 BCCRT 149. Available at: https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html (Accessed: 7 November 2026).

Convention on Choice of Court Agreements (2005) concluded at The Hague on 30 June 2005, entered into force on 1 October 2015, Hague Conference on Private International Law, Convention No. 37. Available at: https://www.hcch.net/en/instruments/conventions/full-text/?cid=98 (Accessed: 7 November 2026).

Convention on the Recognition and Enforcement of Foreign Arbitral Awards (1958) adopted in New York on 10 June 1958, entered into force on 7 June 1959, United Nations Treaty Series, vol. 330, p. 3. Available at: https://uncitral.un.org/en/texts/arbitration/conventions/foreign_arbitral_awards (Accessed: 7 November 2026).

Convention on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters (2019) concluded at The Hague on 2 July 2019, entered into force on 1 September 2023, Hague Conference on Private International Law, Convention No. 41. Available at: https://www.hcch.net/en/instruments/conventions/full-text/?cid=137 (Accessed: 7 November 2026).

Corrigendum to Directive (EU) 2024/2853 (2026) Corrigendum to Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC, Official Journal of the European Union, L 2026/90364, 7 May 2026. Available at: https://eur-lex.europa.eu/eli/dir/2024/2853/corrigendum/2026-05-07/oj/eng (Accessed: 7 November 2026).

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (2024) opened for signature at Vilnius on 5 September 2024, Council of Europe Treaty Series, No. 225. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=225 (Accessed: 7 November 2026).

Council of Europe Treaty Office (2026a) Recent Changes for Treaties – October 2026 [online]. Available at: https://www.coe.int/en/web/conventions/october (Accessed: 7 November 2026).

Council of Europe Treaty Office (2026b) Reservations and Declarations for Treaty No. 225 – Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law [online]. Available at: https://www.coe.int/en-GB/web/conventions/full-list?codeNature=0&module=declarations-by-treaty&numSte=225 (Accessed: 7 November 2026).

Court of Justice of the European Union (2023) SCHUFA Holding (Scoring), Case C-634/21, judgment of 7 December 2023, ECLI:EU:C:2023:957. Available at: https://infocuria.curia.europa.eu/tabs/redirect/juris/documents.jsf?num=C-634%2F21 (Accessed: 7 November 2026).

Court of Justice of the European Union (2025) CK v Magistrat der Stadt Wien (Dun & Bradstreet Austria), Case C-203/22, judgment of 27 February 2025, ECLI:EU:C:2025:117. Available at: https://infocuria.curia.europa.eu/tabs/redirect/juris/documents.jsf?num=C-203%2F22 (Accessed: 7 November 2026).

Data (Use and Access) Act 2025 (United Kingdom) 2025 c. 18, Royal Assent 19 June 2025, section 80. Available at: https://www.legislation.gov.uk/ukpga/2025/18/section/80 (Accessed: 7 November 2026).

Directive (EU) 2024/2853 (2024) Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC, Official Journal of the European Union, L 2024/2853, 18 November 2024. Available at: https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng (Accessed: 7 November 2026).

Electronic Signatures in Global and National Commerce Act (2000) United States Public Law 106-229, 30 June 2000, codified at 15 U.S.C. §§ 7001–7031. Available at: https://uscode.house.gov/view.xhtml?edition=prelim&num=0&req=granuleid%3AUSC-prelim-title15-section7001 (Accessed: 7 November 2026).

European Commission (2025) Withdrawal of the Proposal for a Directive on Adapting Non-Contractual Civil Liability Rules to Artificial Intelligence (AI Liability Directive), legislative procedure 2022/0303/COD, withdrawal recorded on 6 October 2025 [online]. Available at: https://eur-lex.europa.eu/procedure/EN/2022_303 (Accessed: 7 November 2026).

Infocomm Media Development Authority (2026) Legal Responsibility for AI Agents: Discussion Paper. Singapore: Infocomm Media Development Authority, May 2026. Available at: https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/agents-legal-responsibility.pdf (Accessed: 7 November 2026).

International Law Commission (2001) Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, Report of the International Law Commission on the work of its fifty-third session, UN Doc. A/56/10, Yearbook of the International Law Commission, 2001, vol. II, Part Two. Available at: https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf (Accessed: 7 November 2026).

Organisation for Economic Co-operation and Development (2019) Recommendation of the Council on Artificial Intelligence, adopted 22 May 2019, amended 3 May 2024, OECD/LEGAL/0449. Available at: https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 (Accessed: 7 November 2026).

Regulation (EC) No 593/2008 (2008) Regulation (EC) No 593/2008 of the European Parliament and of the Council of 17 June 2008 on the law applicable to contractual obligations (Rome I), Official Journal of the European Union, L 177, 4 July 2008, pp. 6–16. Available at: https://eur-lex.europa.eu/eli/reg/2008/593/oj/eng (Accessed: 7 November 2026).

Regulation (EC) No 864/2007 (2007) Regulation (EC) No 864/2007 of the European Parliament and of the Council of 11 July 2007 on the law applicable to non-contractual obligations (Rome II), Official Journal of the European Union, L 199, 31 July 2007, pp. 40–49. Available at: https://eur-lex.europa.eu/eli/reg/2007/864/oj/eng (Accessed: 7 November 2026).

Regulation (EU) No 1215/2012 (2012) Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (recast), Official Journal of the European Union, L 351, 20 December 2012, pp. 1–32. Available at: https://eur-lex.europa.eu/eli/reg/2012/1215/oj/eng (Accessed: 7 November 2026).

Regulation (EU) 2016/679 (2016) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the European Union, L 119, 4 May 2016, pp. 1–88. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (Accessed: 7 November 2026).

Regulation (EU) 2024/1689 (2024) Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Official Journal of the European Union, L 2024/1689, 12 July 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (Accessed: 7 November 2026).

Regulation (EU) 2026/1744 (2026) Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), Official Journal of the European Union, L 2026/1744, 24 July 2026. Available at: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng (Accessed: 7 November 2026).

Singapore Court of Appeal (2020) Quoine Pte Ltd v B2C2 Ltd, judgment of 24 February 2020, [2020] SGCA(I) 02. Available at: https://www.elitigation.sg/gd/s/2020_SGCAI_2 (Accessed: 7 November 2026).

United Nations Commission on International Trade Law (2024) UNCITRAL Model Law on Automated Contracting, adopted 11 July 2024, Report of the United Nations Commission on International Trade Law on the work of its fifty-seventh session, UN Doc. A/79/17, Annex IV. Available at: https://uncitral.un.org/en/mlac (Accessed: 7 November 2026).

United Nations Commission on International Trade Law (2025) UNCITRAL Model Law on Automated Contracting with Guide to Enactment. Vienna: United Nations, Sales No. E.25.V.4. Available at: https://uncitral.un.org/sites/uncitral.un.org/files/2424674e-mlautomatedcontracting-rev1-ebook.pdf (Accessed: 7 November 2026).

United Nations Educational, Scientific and Cultural Organization (2021) Recommendation on the Ethics of Artificial Intelligence, adopted by the General Conference at its 41st session, Paris, 23 November 2021. Available at: https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence (Accessed: 7 November 2026).

Uniform Electronic Transactions Act (1999) adopted by the National Conference of Commissioners on Uniform State Laws, 1999. Chicago: National Conference of Commissioners on Uniform State Laws. Available at: https://www.uniformlaws.org/viewdocument/final-act-21?CommunityKey=2c04b76c-2b7d-4399-977e-d5876ba7e034 (Accessed: 7 November 2026).

United Nations Convention on the Use of Electronic Communications in International Contracts (2005) adopted in New York on 23 November 2005, entered into force on 1 March 2013, United Nations Treaty Series, vol. 2898, p. 3, No. 50525. Available at: https://uncitral.un.org/en/texts/ecommerce/conventions/electronic_communications (Accessed: 7 November 2026).