AI systems no longer just answer questions. They book travel, move money, negotiate terms, and take actions in the world with less human supervision at each step. When one of those actions causes harm, an obvious responsibility question follows: can the developer, deployer, or user point to the system's autonomy and say the machine acted on its own? A thoughtful new white paper from Stanford's Center for Legal Informatics (CodeX) explains why autonomy should not, by itself, create a responsibility gap, and it hands civil litigators a cleaner way to frame the problem. Credit belongs to its authors, Vanderbilt law professor Daniel Gervais and Stanford CodeX fellow John Nay, for refusing the easy binary.

Why Machine Autonomy Does Not End the Inquiry

The authors' core argument is deceptively simple. The autonomy question, they contend, dissolves "once legal intent is understood functionally rather than metaphysically." Courts have never needed to peer inside a defendant's mind to find intent. They infer it from conduct, impute it to corporations that have no minds at all, and sometimes construct it when a policy goal requires. Contract law binds persons to the objective meaning of words, criminal and corporate law can attribute the knowledge and intent of human actors to organizations, and agency law makes an employer answer for an employee under respondeat superior. Against that backdrop, Gervais and Nay name their subject the phantom agent:

"AI systems increasingly function as agents in the practical sense: they initiate actions, pursue goals, and interact with the world in ways that affect legal rights. Yet they remain phantoms in the legal order: present in effect, absent as subjects of responsibility."

What Gervais and Nay suggest

The paper reframes AI systems as non-personal agents whose conduct may be attributable to identifiable human or institutional actors, potentially including developers, deployers, integrators, and users. To keep that analysis disciplined, the authors separate three concepts that debates about "AI personhood" tend to blur together: status, attribution, and governance. Status asks whether an entity is a legal person with rights and moral standing, which they are content to reserve for human beings and entities designated by law as persons. Attribution asks how the law assigns intent and responsibility, and it "can operate without status." Governance covers the practical machinery of liability, regulation, and insurance. The result is that an AI system's behavior can be legally consequential without the system ever becoming a legal person. They put it plainly: "The AI is the means of attribution, not its target."

A Proposed Framework for Artificial Intentionality 

The question a court actually faces is not whether an agent is autonomous in the philosophical sense, but when its conduct should be treated as intentional for a specific doctrine. Gervais and Nay propose a five-factor approach for evaluating when AI-generated conduct should be treated as intentional for a particular purpose: the system's autonomy and initiative (the gap between what a human directed and what the system did); its goal persistence (whether it pushed toward an objective across obstacles); its inducement of reliance (whether it was designed to earn trust or emotional engagement); its opacity (whether its behavior can be meaningfully explained or reconstructed, including by the parties that designed or deployed it); and its deployment context (including whether the system operates in a high-risk setting or interacts with vulnerable users). These are not yet elements of a recognized legal test. They nevertheless provide a useful framework for developing allegations and defenses, structuring discovery, selecting experts, and assessing how a particular system’s design and deployment may matter under existing doctrine.

An Early Litigation Example 

In Garcia v. Character Technologies, Inc., 785 F. Supp. 3d 1157 (M.D. Fla. 2025), a wrongful-death action arising from a 14-year-old’s use of a Character.AI chatbot, the court granted the defendants’ motions to dismiss in part and denied them in part. At the pleading stage, the court allowed several claims to proceed based on allegations concerning product design, anthropomorphic features, foreseeability, and the defendants’ respective roles. The court did not adopt a general doctrine of artificial intentionality or resolve the merits. Its order nevertheless illustrates the authors’ broader point: existing tort and product-liability doctrines can evaluate alleged harm involving an AI system without first deciding that the system is conscious or a legal person.

Other legal and policy developments reflect a similar focus on human and institutional responsibility. California's AB 316, signed October 13, 2025, and codified at Civil Code § 1714.46, provides that a defendant who “developed, modified, or used” AI may not defend a civil action on the ground that the AI autonomously caused the plaintiff’s harm. The statute is narrow, however. It preserves other affirmative defenses and evidence concerning causation, foreseeability, and comparative fault, and it does not create strict liability for AI-related harm. A Canadian administrative tribunal expressed a related intuition in Moffatt v. Air Canada, rejecting an airline's argument that its website chatbot was a separate entity responsible for its own statements. The decision is not binding in the United States and arose from a straightforward consumer-misrepresentation dispute, but it illustrates the practical difficulty of distancing an organization from a chatbot it deploys. Singapore's Infocomm Media Development Authority has mapped the same allocation-of-responsibility problem from a private-law perspective. The paper does not prescribe a single answer, but it similarly treats the relevant question as how responsibility should be distributed among developers, tool and platform providers, deployers, users, and other actors when an autonomous agent causes harm. Together, these developments suggest that autonomy is unlikely to operate as a complete answer to liability, even as causation, foreseeability, fault, and responsibility across the value chain remain contested

What This Means for Plaintiffs and Defendants

For plaintiffs, system autonomy may become part of the evidentiary story rather than an automatic roadblock. The gap between the authority granted, the safeguards adopted, and the action ultimately taken may bear on design, supervision, foreseeability, and causation. For defendants, pointing to the machine’s autonomy is less useful than showing how authority was limited, what controls were in place, whether the particular conduct was foreseeable, and whether another actor altered or misused the system. Guardrails, access controls, approval gates, logging, escalation protocols, testing records, and evidence of the configuration in place at the relevant time can help distinguish a reasonably supervised deployment from an unmanaged one.

Gervais and Nay are candid that reaching for AI personhood is the wrong instinct. It is, they write, "a blunt instrument" (Section 10.3), while existing agency and attribution doctrines "do the practical work that personhood proposals are designed to do, and do it without importing the symbolic and normative freight that personhood carries with it."

That reframing is the paper's lasting gift. As the authors put the stakes, "The question, then, is not whether machines can intend. It is whether the law can continue to assign responsibility for the benefit, order, and wellbeing of humans in a world where intention is no longer exclusively human."

What This Means in Practice 

• Autonomy is not a complete defense. California now says so expressly, while preserving traditional disputes over causation, foreseeability, comparative fault, and other defenses.
• Use the five factors as an analytical framework, not an established test. Autonomy and initiative, goal persistence, inducement of reliance, opacity, and deployment context can help organize claims and defenses, discovery, expert analysis, and governance review.
• Make governance evidence available. Preserve the records needed to show authority limits, permissions, testing, monitoring, approval gates, escalation pathways, and the configuration in place when the relevant action occurred, subject to applicable privilege, privacy, security, and retention requirements. Documentation will not resolve every liability question, but it may determine whether an organization can demonstrate the controls it says were in place.

• Keep responsibility tied to human and institutional actors. Existing agency, tort, product-liability, contract, and attribution doctrines provide a more practical starting point than treating AI systems as legal persons.

For questions about AI agent liability and governance, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.

"The question, then, is not whether machines can intend. It is whether the law can continue to assign responsibility for the benefit, order, and wellbeing of humans in a world where intention is no longer exclusively human."