A draft proposal circulating in the US House would establish that developers bear liability when AI agents cause injury or loss. The exception carved out is narrow: users who modified the system in ways that contributed to the harm. In practical terms, an organisation deploying an unmodified AI agent for financial planning, treasury operations or audit support would be positioned to pursue the vendor if something goes wrong.
The proposal addresses a gap that has made legal and compliance teams uneasy. Until now, liability for autonomous AI has sat in a grey area. If an agent misroutes a payment, generates a flawed forecast that informs a board decision, or triggers a compliance breach, who answers for it? The draft legislation says the developer does, unless the user demonstrably broke the product.
Finance functions evaluating AI vendors will need to treat procurement as a form of risk transfer. Conversations will need to include indemnity clauses, insurance coverage and audit trails that prove the system was deployed as intended. Smaller vendors without the balance sheet to absorb liability claims may struggle to compete for enterprise mandates.
For candidates, this creates a new layer of relevance. Finance professionals who understand AI governance, who can assess vendor risk and who know how to document deployment decisions become harder to replace. The role of the controller or CFO office expands to include technology stewardship: understanding how an AI agent was configured, by whom, and with what sign-off chain.
Regulation tends to follow adoption with a lag. In the US, that gap appears to be narrowing. German and Swiss finance leaders watching from the DACH region should expect similar frameworks to emerge in the EU, and should be building the internal expertise to manage them now.
Prompted by reporting from CFO Dive.