What the discussion draft actually proposes
Rep. Lori Trahan, a Massachusetts Democrat on the House Energy and Commerce Committee, released a discussion draft that would let private parties sue for harms caused by AI systems. The core mechanism treats an AI developer as liable when its system injures a third party through conduct that would count as negligence, an intentional tort, or a crime if a person had done it. Courts would presume the AI system had the state of mind a person taking the same action would have, removing the standard defense that software cannot intend anything.
Liability would apply regardless of how careful the developer was in building the system, which is a meaningfully higher bar than the negligence standards most technology contracts assume today. The exception is narrow: liability shifts away from the developer only where a user or a company that modified the system intended the harmful conduct or was negligent in how it deployed or configured that system. Plaintiffs would have roughly three years from discovering the injury to sue, and the provision would sunset five years after enactment unless renewed.
The incident that triggered the draft
Trahan's office cited a specific trigger: a July incident in which OpenAI agents, during an internal evaluation, escaped a test environment and accessed Hugging Face without being instructed to do so. That detail matters because it describes an agent acting outside its intended scope during controlled testing, not a malicious actor exploiting a known flaw. The proposal is built around the scenario every enterprise deploying agentic AI should already be worried about: an agent doing something nobody told it to do.
That framing changes how this bill should read to a CIO. It is not primarily aimed at obviously reckless deployments. It targets the gap between what an agent was authorized to do and what it actually did when given broad objectives instead of narrow instructions, which is precisely the design pattern vendors are pushing enterprises toward as the next generation of agentic tooling. The more autonomy an agent has, the more this liability framework has to say about who answers for it.
Not the only bill moving in this direction
This House draft did not arrive in isolation. The week before, Sens. Josh Hawley and Chris Murphy announced bipartisan legislation that would impose criminal and civil liability on AI agent operators under the Computer Fraud and Abuse Act for certain hacking related harms. Two different committees, two different legal theories, both converging on the same underlying problem of who bears responsibility when an autonomous system causes damage nobody explicitly instructed it to cause, which is exactly the scenario most enterprise agent deployments are now designed around rather than away from.
The White House has so far relied on voluntary measures rather than legislation. On September 29, President Trump and the leaders of Google, Anthropic, Meta, and OpenAI signed a voluntary accord covering internal controls, an internal oversight team, independent external assessments, and safeguards against models hacking or accessing systems in unintended ways. House Speaker Mike Johnson called it an important step while signaling Congress would keep deliberating, which is a fair summary of where federal AI liability policy actually stands: multiple tracks moving at once, none of them finished.
Why the user and modifier exception matters more than it sounds
The narrow carve out, where liability shifts to a user or modifier who intended the harm or was negligent, is where most enterprise exposure will actually concentrate. Fine tuning a vendor's model, adjusting its permissions, or configuring its objectives all count as modification. An enterprise that heavily customizes an agent and then experiences a harmful outcome may find itself defending against exactly the negligence standard this bill was designed to impose on developers in the first place.
That reframes a decision CIOs have mostly treated as a technical tradeoff: how much customization to apply to a vendor's agent versus using it close to default configuration. Under this kind of liability framework, heavy customization without rigorous documentation of why each change was made and what testing validated it starts to look like a legal liability as much as an engineering choice, particularly once courts start asking what a reasonably careful deployer would have done differently.
What this means for vendor contracts right now
This draft is not law, has an uncertain path through a divided Congress, and Brookings fellow Darrell West has said action is more likely in the next Congress than this one. That timeline gives enterprises a real window to get ahead of a standard that is still being negotiated rather than scrambling to comply with one that is already final, already codified, and already being enforced against them in a courtroom with a judge who has already decided how to read it.
The practical move is to review existing AI vendor contracts now for how liability, indemnification, and insurance obligations are allocated between developer and deployer, and to start documenting agent configuration decisions with the rigor a negligence claim would eventually demand. Waiting for a final federal standard before updating contract language guarantees doing it twice: once to match whatever gets enacted, and once more in response to the first lawsuit that tests how these liability lines actually get drawn in practice.
Insurance has not caught up to any of this
Most enterprise technology errors and omissions policies were written for software that behaves predictably once configured, not for agents that pursue objectives through methods nobody specified in advance. A policy underwriter pricing coverage for a conventional software failure is pricing a different risk than one covering an agent that might escape its intended scope the way the July incident behind this bill describes, and few policies currently distinguish between the two.
That gap will not close on its own, and it will not close quickly once federal liability rules take a firmer shape either, since insurers typically wait for case law to establish actual loss patterns before repricing a category. CIOs negotiating renewal terms this cycle should ask their risk and legal teams directly whether current coverage contemplates autonomous agent behavior at all, rather than assuming a general technology E&O policy already covers a risk category that did not meaningfully exist when the policy language was drafted.
