An AI agent sends an email it shouldn’t have, approves a transaction it wasn’t authorized to approve, rejects qualified job candidates it shouldn’t have, or shares data with a system it should never have accessed.

Who’s accountable when an AI agent does the unexpected? With 96% of CISOs now responsible for their organization’s AI governance and risk management, the answer increasingly points to you as security leaders.

This isn’t hypothetical – 78% of CISOs are concerned about their personal liability for security incidents, up from 56% last year, according to Splunk’s The CISO Report 2026. That’s not a gradual shift. That’s a 22-point jump in 12 months.

Why AI Risks Are Different

Part of being a security leader is living with liability exposure – we’ve jokingly called it “hazard pay.” What’s new is the nature of what’s being governed. A traditional breach generally involves threat actors exploiting a vulnerability – painful, but conceptually familiar.

An AI agent is a different beast. It’s a system inside your own walls, authorized by your organization, that can take independent action without human oversight in real time. And this distinction is already showing up in court.

Legal experts note that liability in agentic AI cases will hinge on whether an organization took reasonable precautions to prevent foreseeable harm – and as AI-driven incidents become more common, “foreseeable harm” will get easier to argue, according to Reuters’ reporting on AI liability.

California has already gone further: effective from January 2026, defendants are explicitly barred from using an AI system’s autonomous operation as a legal shield – meaning “AI made the decision” is no longer a defense on its own, per analysis from The Lyon Firm.

In other words: the agent’s autonomy may increase your exposure, because it removes the human oversight that used to serve as your last line of defense and your clearest evidence of due care.

What Protects a CISO

So what does protect you? Probably not what you’re picturing. The instinct is to reach for more tools or a bigger tech stack – but tooling doesn’t hold up under legal scrutiny nearly as well as governance does. What actually protects a CISO is a defensible governance structure, built and documented before an incident, not reconstructed after one.

That structure rests on three things:

• Clear decision rights showing who's authorized to approve an agent’s deployment and at what level of autonomy
• Tested escalation pathways for catching and correcting an agent’s unexpected behavior before it compounds
• Ownership documentation – a written record showing scope and accountability were assigned, not just acknowledged verbally, before anything went wrong

The uncomfortable truth for security leaders is that the paperwork isn’t overhead sitting on top of the real security work. More often, it is security work, because it’s what determines whether your organization can demonstrate reasonable care after something goes wrong.

Tools can catch what an agent did wrong. Only governance can prove you took reasonable care in letting it act in the first place.

The Governance Gap

Most organizations cannot currently produce that kind of documentation because they don’t have full visibility into what AI systems they’re running in the first place.

Breaches that are tied to shadow AI – AI tools adopted without security’s knowledge or approval – now account for roughly one in five breaches and cost organizations $670,000 more on average than one standard incident, according to IBM’s Cost of a Data Breach Report 2026. Of the organizations breached through AI-related vulnerabilities, 97% lacked proper AI access controls at the time.

You cannot defend decisions about systems you can’t see. If your organization doesn’t know every AI system, tool, and agent operating inside it, you’re not managing risk – you’re accumulating it, one unmonitored deployment at a time.

What to Do Before You’re the Precedent

The first major lawsuit testing executive liability for autonomous AI agent actions hasn’t been decided yet, but legal analysts widely expect one soon, and very few CISOs want their governance practices picked apart in discovery.

The fix isn’t unfamiliar – it’s the same operational rigor good security programs have always required, applied to a new category of risk:

• Inventory what you have. You cannot govern an AI agent if you don’t know it exists. Start with a living inventory: what’s deployed, who deployed it, what data it can access, and who can shut it off.
• Formalize decision rights before the next deployment, not after an incident forces the conversation.
• Set autonomy thresholds requiring legal or compliance sign-off. Not every agent needs executive review, but anything touching financial transactions, customer commitments, or regulated data should trigger one before production.
• Pressure-test your escalation paths. Run a tabletop exercise that assumes an agent does something unauthorized. If the answer to “who owns the response” takes more than a minute to answer, that’s the first gap to close.
• Build an AI-specific incident response plan. Your existing IR plan assumes a human attacker. Agent-driven incidents require their own playbook, including containment steps, who has the authority to shut down an agent, and disclosure timelines specific to autonomous-system failures.
• Extend third-party accountability. Push vendors for audit rights and indemnification language on any AI agent that touches your systems or data, and confirm your directors and officers (D&O) and cyber insurance cover agent-driven incidents – some policies carve out “known risk” exclusions that leave AI-related claims uncovered.

Liability protection isn’t really about eliminating risk. It’s about credibly showing that the risk was governed responsibly. When your AI systems can act faster than your incident response process, that documentation is no longer a nice-to-have – it’s the difference between an organization that governed its AI and one that simply hoped it would behave.