Agentic Foreseeability and the Agentic Standard of Care: What AI Deployers Must Foresee and Which Institution Will Enforce It

Two Foresight-to-Duty Conversion papers on courts, state legislatures, Congress and insurers after California barred the autonomy defense

Actors and jurisdictions: AI deployers · Foundation model developers · OpenAI · Character Technologies · Congress · Department of Justice · California · Texas · Washington · Colorado · State attorneys general · Insurers and underwriters · European Union

Companion line: Installments IV and V of the Foresight-to-Duty Conversion Series extend The Duty to Foresee from governance gaps an institution measured and kept to harm a deployer never measured, and to the institutions that decide who answers for it.

Read the full publications: Agentic Foreseeability and the Modern Duty of Care for AI Agents · Who Sets the Agentic Standard of Care — Common Law, State Legislation and Federal Coordination

The Sentence California Took Away

On January 1, 2026, California made one sentence unavailable to every defendant in the state: the AI autonomously caused the harm. Civil Code section 1714.46 bars anyone who developed, modified or used an AI system from making that argument. The same statute leaves causation, foreseeability and comparative fault exactly where ordinary tort law put them.

Ten months later, eight states sued OpenAI. Iowa's petition pleads OpenAI's own GPT-4 Technical Report as proof the company understood since 2023 that the model "may generate undesirable content." California removed an excuse, and the lawsuits show what fills the space: the defendant's own files.

Central Finding

A deployer's duty of care for AI agents turns on what a reasonable inquiry into the deployment would have revealed and which precautions that inquiry showed to work. The standard no longer asks what a prudent person could have imagined about a single action. Existing negligence and product-liability law already imposes the duty, so the open questions are how courts will apply it to agent facts and which institution gets a reliable finding to someone who can require correction before the next release.

Scale Converts a Rare Failure Into a Recurring Exposure

A harm pathway that fails once in a million actions produces one failure a century for a human clerk making 10,000 decisions a year. An agent fleet executing 50 million actions a year produces 50 such failures annually at the same per-action odds. The plaintiff harmed by an agent fleet belongs to a population the deployer could have estimated in advance.

Expected counts guide escalation rather than fix the law. One expected harm a year, meaning the per-action failure rate times annual volume, marks a pathway for escalation to someone with authority to revoke the permission. Severe or irreversible pathways escalate at any frequency. Behavioral economics explains why the per-act frame survives inside firms: one in a million reads as safe to a product owner, and 50 a year does not.

Emergence Defeats Prediction of the Act, Not Foresight of the Harm Type

Hughes v. Lord Advocate (1963) held a defendant liable for burns from a lamp that exploded in an unforeseeable way, because burns were the foreseeable kind of harm. The rule answers the agent defense at the level that matters, because no deployer can predict the exact chain of tool calls an agent will assemble.

Permissions name the harm types in advance. Payment authority opens financial loss and messaging authority opens misrepresentation and defamation. Code execution opens damage to systems and data. Companion conversation with minors opens self-harm risk.

The permission and integration inventory therefore supplies the starting map of foreseeable harm pathways. Prompt injection and bypassed permissions can open contested pathways beyond the inventory, and a category as broad as financial loss does not by itself prove foreseeability. Deployment-specific tests connect the category to a concrete pathway a reasonable deployer should have examined.

Reasonable Inquiry Sets the Knowledge Baseline and Limits Strategic Ignorance

Constructive knowledge once depended on a human actor's experience and imagination. Inquiry into agent behavior is now routine: developers publish system cards, deployers run red-team suites and the agent insurer Klaimee underwrites through behavioral testing with more than 100 probes. A deployer is charged with what reasonably available, reliable and deployment-relevant inquiry would have shown.

Measurement carries a known perverse incentive. W. Kip Viscusi's mock-juror study in 2000 found that firms which ran a risk analysis and declined a fix drew harsher punitive awards, so a rational deployer might inquire less. Constructive knowledge limits that strategy because the deployer is charged with the inquiry whether or not it ran one.

Texas rewards the search instead. The Texas Responsible Artificial Intelligence Governance Act shields violations found through testing and good-faith audits within the act's own scheme. A safe harbor conditioned on testing alone pays for files, and a safe harbor conditioned on findings that reached someone with power to gate the agent pays for correction.

Insurers Move First, Write Narrow Terms and Create Notice

Verisk's Insurance Services Office (ISO) endorsements CG 40 47 and CG 40 48 and CG 35 08 now exclude generative AI injury from commercial liability forms. Berkley introduced an absolute AI exclusion in 2025 across directors and officers lines as well as errors and omissions and fiduciary lines. A Gallagher study counted a 978% rise in AI-related lawsuits from 2021 to 2025. Affirmative cover is arriving alongside the exclusions: the Artificial Intelligence Underwriting Company raised $15 million in July 2025 to pair its AIUC-1 standard with independent audits and liability coverage.

Underwriting communications reach a deployer at renewal, faster than any statute or ruling. An exclusion or audit condition is potential notice evidence rather than proof of foreseeability, because an exclusion can reflect capital limits or accumulation across a shared model. A deployer that receives either has more to answer for if it does not respond.

Two Clocks Decide Whether Any Institution Is Fast Enough

Every institution runs on a legal clock: a statute takes effect on a date, an agency rule completes on a schedule and a court rules when a suitable case reaches decision. Deployments run on a second clock. A new permission, a new evaluation or an incident changes what a reasonable inquiry would reveal, often several times a quarter.

Neil Komesar's comparative method from Imperfect Alternatives (1994) asks which institution's imperfection costs least for the task. Courts adapt best to agent facts but speak only after a vivid harm and suit, and repeat-player defendants resolve cases before appeal once a trial court issues an adverse reasoned ruling. Legislatures set effective dates but can reward paperwork. Insurers run closest to the deployment clock but write terms that protect their own loss ratio.

A duty to reassess the deployment after each material permission change or risk signal ties the standard to the deployment clock. Any of the four institutions can adopt it, and the first adopter sets the term the others copy or resist.

Washington and Congress Are the Near-Term Tests

Washington Representative Clyde Shavers has named AI product liability his top priority for the 2027 session. An August draft reportedly offered a rebuttable liability shield for firms that document risk testing and disclose known risks, with an 18-month regulatory sandbox, and the October account of his plans mentions neither feature. The simulation finds that Washington's technology lobby gains more by opposing the bill than by bargaining for a shield, whatever support leadership gives it, so the shield's design rests on the sponsor's own drafting choice.

Congress has so far declined to displace state law. The Senate voted 99-1 on July 1, 2025 to strip a state AI moratorium from the reconciliation bill. The FRONTIER Act (H.R. 9925) introduced on July 23, 2026 sits in committee with its chairman unwilling to say it will move. The bill lapses when the 119th Congress ends on January 3, 2027.

The bill's Section 9 savings clause preserves generally applicable law and deployment rules. The clause does not say whether a common-law claim resting on pre-release testing survives. Wyeth v. Levine (2009) warns that tort suits are the information channel preemption would remove before any federal replacement exists.

Two Decision Instruments Replace Contested Judgment With Observable Questions

The Agentic Foreseeability Assessment asks four questions about each harm pathway. Which pathways do the permissions open, and what does a reasonable inquiry show about their frequency and severity and reversibility? Which available precautions did the deployer adopt? Did each finding reach someone with power to fund a precaution or gate the permission or halt the deployment?

The Institutional Correction Test asks four parallel questions about any proposed allocation of the duty: reach to someone who can require correction; speed in deployment-clock cycles; who generates the evidence at what participation cost; and who can weaken the rule once it exists. With one actor and one act and no outside measurement, the first instrument collapses into the classical reasonable-person inquiry. Courts need not adopt any numerical threshold for either instrument to guide a decision.

What the Full Publications Add

The two papers carry nine MindCast Foresight Simulation Predictions (six primary and three secondary) with a deadline and a falsifier and a named verification source for each. The papers frame eight competing hypotheses separately before any result prints and leave six further questions open without bands. Twelve Risk Mitigation entries name an owner function and a deadline for each action. A five-institution comparison table rates courts and legislatures and agencies and Congress and insurers on correction speed and information quality and participation cost and capture.

The doctrinal line runs from MacPherson v. Buick (1916) through Palsgraf and The Wagon Mound and Hughes and Carroll Towing to Goodman and Pokora. The papers then apply Restatement (Third) of Torts section 29 and Products Liability section 2(b). The dockets include In re ChatGPT Product Liability Cases (JCCP No. 5431) and Iowa ex rel. Bird v. OpenAI; Garcia v. Character Technologies and Moffatt v. Air Canada; and Amazon v. Perplexity in the Ninth Circuit.

The statutes and bills include California Civil Code section 1714.46 and Texas HB 149; Colorado's replacement AI statute with rules due January 1, 2027; FRONTIER Act sections 8 and 9; and the revised EU Product Liability Directive due for transposition by December 9, 2026. A dated watch calendar runs from the November 3, 2026 midterms through December 31, 2029.

Read the full publications: Agentic Foreseeability and the Modern Duty of Care for AI Agents · Who Sets the Agentic Standard of Care — Common Law, State Legislation and Federal Coordination

MindCast Simulation Predictions

The combined forecast set holds nine Simulation Predictions. P marks a Primary Simulation Prediction and S a Secondary Simulation Prediction, and two secondary entries are conditional. No entry in either paper has reached its deadline.

From Agentic Foreseeability and the Modern Duty of Care for AI Agents:

• P-1 · A second U.S. state enacts a statute barring defendants from arguing that an AI system autonomously caused the harm by December 31, 2028 (33-60%). A sector-limited statute counts.

• P-2 · A U.S. court in a reasoned written ruling rejects at least in part the argument that an AI system's unpredictable output was a superseding cause or made the harm unforeseeable by December 31, 2028 (29-57%). Pleading-stage rulings count. A bare order without reasons does not.

• P-3 · A U.S. court relies in its reasoning on a defendant's own system card or model card (or its technical report or pre-deployment evaluation) as evidence that a harm was foreseeable or known by December 31, 2028 (22-44%). Recital of a complaint's allegations does not count.

• S-1 · Given a qualifying P-2 ruling, the court frames foreseeability by type of harm rather than by the specific output (62-80% given P-2).

From Who Sets the Agentic Standard of Care:

• P-1 · Congress enacts a statute expressly preempting state AI deployment rules or state tort remedies for AI harm by December 31, 2028 (1-9%). A moratorium rider on a must-pass bill carries nearly all of the probability.

• P-2 · A bill imposing or extending product liability to AI systems is introduced in the Washington Legislature by March 31, 2027 (59-90%). A disclosure-only bill does not count.

• P-3 · Congress enacts a statute preempting state frontier-model catastrophic-risk transparency, auditing or incident-reporting laws by December 31, 2028 (3-10%). The FRONTIER Act counts, and the simulation roughly doubles its chance under a Democratic House.

• S-1 · A state or federal appellate court issues a reasoned ruling on foreseeability or superseding cause for AI output or agent action by December 31, 2029 (9-15%). Resolution after adverse trial rulings narrows appellate access.

• S-2 · Given P-2, a Washington product-liability bill passes the 2027 regular session and becomes law by the gubernatorial action deadline (3-23% given P-2). Industry opposition dominates bargaining, and leadership holds bills that lack stakeholder agreement.

Read together, the two sets describe a duty shaped at trial level for years. Courts reach the foreseeability question at below even odds, frame it by harm type when they do and stay silent on appeal through 2029, while Washington moves without enacting and Congress leaves deployment and tort law alone.

Stakeholder Callouts and Mitigation

🤖 AI deployment leaders. The inventory of agent permissions and integrations is the starting map of foreseeable harm pathways, and every pathway without a documented inquiry becomes an unanswered harm type in discovery. Mitigation: map each permission to the pathways it opens by the next production release; measure frequency and severity and reversibility per pathway by December 31, 2027; route any pathway above one expected harm a year to the owner who can revoke it. Residual: pathways outside the mapped inventory stay a scope question decided after the harm.

⚖️ General counsel. Existing negligence and product rules already apply, so the uncertainty concerns application rather than existence, and the evaluation archive is the discovery scope for knowledge. Mitigation: reconcile each published system card claim with observed production behavior at every release, attach a documented response to each documented risk and keep evaluation files under the existing retention policy because pruning creates spoliation exposure. Residual: earlier cards and evaluations remain dated notice for the period before correction.

🏢 Boards. Oversight claims reach directors when material harm pathways never reached the board. Mitigation: require a quarterly harm-pathway report with frequency, severity and routing from the first quarter of 2027, and confirm each escalated pathway has a named owner with authority to gate it. Residual: a report the board receives dates the board's knowledge, so each report must arrive with a response.

🛡️ Insurers and underwriters. A ruling that relies on a defendant's own evaluations raises claim severity on unendorsed legacy forms, and coverage terms written against a named statute or test fall out of alignment when the rule changes mid-term. Mitigation: tie any AI coverage condition to a material-change trigger, write per-pathway terms conditioned on a gate that can stop the action and require the insured to name the person who receives evaluation findings and can halt the agent. Residual: correlated losses across deployers sharing one foundation model and risks no carrier will write stay outside any policy.

🏛️ Washington legislators and state attorneys general. An autonomy-defense bar without a responded-finding safe harbor pushes deployers toward inquiring less, and a shield conditioned on documented testing alone buys files rather than fixes. Mitigation: condition any shield on findings that reached someone with authority to gate the agent and produced a response before policy-committee action in 2027, add a reassessment duty tied to material permission changes and delegate its technical definition to the Department of Commerce. Residual: delegated rules take time and federal preemption litigation under Executive Order 14365 can delay enactment.

🏛️ Federal policymakers. A frontier preemption statute that courts read to reach development-based tort claims removes remedies without replacement. Mitigation: state expressly in the reintroduced bill whether common-law tort claims fall within the savings clause, and pair any preemption with a federal evidence duty that replaces what it displaces. Residual: courts may read preemption more broadly than the text.

📊 Investors. Regulatory exposure tracks the states where customers sit and the reassessment discipline each portfolio company keeps, and an AI exclusion in an issuer's insurance program marks exposure the market will not carry at current terms. Mitigation: treat disclosed AI exclusions as retained loss in valuation models at the next update, require a state-by-state liability map in diligence and request harm-pathway inventories and gating authority before the 2027 proxy season. Residual: issuers can disclose inventories without disclosing rates, so the size of the exposure stays open.

Conclusion

California took one sentence away from defendants and left every other element of the claim in place. The two papers show what a court will ask instead: which harm pathways the deployment's permissions opened, what a reasonable inquiry would have revealed about them, which precautions worked and whether anyone with authority saw the findings. Courts and legislatures and agencies and insurers each hold a piece of that question. The arrangement that corrects soonest moves findings to people who can act on them on the deployment's own release calendar.

Washington's 2027 session and the first reasoned causation ruling in San Francisco will show whether any institution gets there before the next 50 million actions run.

Working With MindCast

MindCast AI applies Predictive Behavioral Economics + Dynamic Game Theory through MindCast AI Proprietary Cognitive Digital Twin Foresight Simulations (MP CDT FS). Behavioral Economics supplies the decision rules. Game Theory supplies the payoff structure. Predictive simulations emerge from the combination.

For the questions these two papers raise, MindCast builds Cognitive Digital Twins (CDTs) of a deployer and its insurer and its regulators and the courts and legislatures that govern it. The model runs the Agentic Foreseeability Assessment against the deployer's actual permissions and the Institutional Correction Test against the rules its deployments meet. Engagements include a deployment-specific foreseeability assessment for AI deployment leaders and general counsel and boards; an underwriting simulation for insurers; a regime comparison for multistate deployers; and a pre-markup test of a safe-harbor or reassessment-duty draft for legislative staff.

MindCast offers a complimentary pilot built from public filings and backtested on a known case before any retainer. No engagement proceeds without a named decision to resolve. Contact [email protected].

Related Works

Publications

• Agentic Foreseeability and the Modern Duty of Care for AI Agents · Installment IV. Sets the foresight standard and the Agentic Foreseeability Assessment.

• Who Sets the Agentic Standard of Care — Common Law, State Legislation and Federal Coordination · Installment V. Compares the institutions that can turn that standard into correction.

Series

• Foresight-to-Duty Conversion in AI Governance, Series Introduction. Sets the series question and the commissioning offer.

• Meta Foresight-to-Duty Conversion Across Privacy, Child Safety and Scam Ads. Shows why a finding must reach an authority that can fund the fix.

• Meta and Bank of America Foresight-to-Duty Conversion: Revenue-Funded Versus Cost-Funded Deferral. Examines why deferral persists once a gap is measured.

• Consent Order Remedies at Meta, Boeing, Starling and Wells Fargo: Verified Correction Versus Recurrence. Shows why testing-only safe harbors produce documentation rather than correction.

• The Foresight-to-Duty Conversion — Measured Governance Debt Becomes Evidence When Institutions Keep the Gap They Found. Separates latent from measured governance debt.

• Bank of America $1.2 Billion Money Laundering Penalty and the Compliance System That Knew Too Much. Shows how a dated internal test becomes evidence of knowledge.

Foundational

• The Duty to Foresee, AI Deployment Readiness as Prospective Governance, and the Arrival of Agentic Duty of Care. Supplies the Agentic Hand Formula both papers build on.

• AI Governance Equilibrium. Supplies the review-capacity measures behind the authority question.

• Decision Modeling and Foresight Simulation. Describes the simulation method behind the forecasts.