Is My AI Agent Legal? A Practical Checklist for 2026

In brief: An AI agent is legal when what it does, where it operates, and who it affects fit the rules that apply to that specific use. No agent is legal or illegal in general.

To check yours, describe exactly what it does, then test it against ten questions covering regulated activity, decisions, data, disclosure, oversight, vendors, geography, and change.

‍

Why is there no simple yes or no answer?

There is no single "AI agent law" to pass or fail. An agent is judged by the activity it performs, so the same technology can be low-risk in one product and heavily regulated in another.

A support agent that answers shipping questions faces a short list of obligations. An agent that triages insurance claims, screens job applicants or approves credit touches licensing, anti-discrimination, consumer protection and record-keeping rules, often in more than one state or country.

The rules also move. The EU has pushed back its high-risk AI deadlines to December 2027 and August 2028, and Colorado replaced its first-in-the-nation AI Act with a narrower law that is reported to apply from 1 January 2027. A checklist you ran last year may already be out of date.

What are the 10 questions to ask before launching an AI agent?

Write down your answers. A written answer is the start of the evidence a customer, auditor or regulator will ask for later.

What exactly does the agent do? List every action it can take, not the marketing description. Include tools, systems and data it can reach.
Does it perform a regulated activity? Adjusting claims, giving financial or health guidance, screening applicants, collecting debts and similar work can trigger licensing, registration or conduct rules.
Does it make or influence decisions about people? Hiring, lending, insurance, housing, healthcare and education decisions attract the strictest anti-discrimination and explanation rules.
Where do its users and affected people live? Rules attach to where people are, not only where your company sits. List every state and country.
What data does it touch? Personal, health, financial and children's data each bring their own privacy, security and retention duties.
Do people know they are dealing with an AI? Many rules require disclosure, and some require a way to reach a human.
Where is the human in the loop? Decide which outputs a person must review, which actions need approval, and how someone can override or stop the agent.
Can it spend money, settle claims or commit your company? Payment authority and settlement recommendations raise the stakes sharply.
What do your vendors and models contribute? Third-party models and tools do not transfer your obligations. Check contracts, data flows and who is responsible for what.
Can you prove it? For each applicable rule, you need a control, a test and a record showing the control works.

Which changes make an AI agent legally riskier?

Reassess before you ship if any of these are true or about to become true:

The agent can approve, deny, price or pay something.
It recommends settlements, terminations, diagnoses or credit terms.
It moves into a new state, country or customer segment.
It gains new tools, data sources or autonomy.
It switches to a new underlying model or vendor.
A law, regulator bulletin or enterprise customer policy changes in your market.

A small feature change can alter which rules apply. Treat each of these as a trigger for a fresh review, not a footnote.

Have companies actually been fined over their AI systems?

Yes. These companies were held to ordinary employment, privacy, consumer-protection and advertising law, and the AI system did not change who was responsible.

Year	Company	What went wrong	Penalty	Proof
2025	DoNotPay (US)	“Robot lawyer” claims not backed by testing	US$193,000 and a ban on unsupported claims	FTC press release
2024	OpenAI (Italy)	Training-data and transparency breaches under EU privacy law	€15 million (OpenAI said it would appeal)	Euronews report
2024	Air Canada	Website chatbot gave wrong fare information	CA$650.88 plus interest and fees; airline held responsible	American Bar Association summary
2023	iTutorGroup (US)	Software auto-rejected older applicants	US$365,000 and five years of monitoring	EEOC press release

These are enforcement outcomes under existing laws, not necessarily “AI-specific fines.”

The company that deploys the system generally answers for it and the EU AI Act sets fines of up to €35 million or 7% of worldwide turnover for banned practices under Article 99.

‍

Not sure where your agent stands?

If you cannot confidently answer these ten questions, the next step is not more marketing copy it is a structured assessment of the agent’s actions, data flows, decision points, and jurisdictions.

ismyagentlegal.com gives you a preliminary assessment of your AI agent. Tell us what it does, and you get the legal instruments and obligations that may apply, the facts to verify and the likely gaps, so you can find them before a regulator or customer does. It is a starting point for your team and counsel, not legal advice.

What should I do after the checklist?

A list of questions is only the first step. The goal is for every applicable requirement to end in a clear state: done and verified, assigned to someone, escalated for professional judgment, or documented as not applicable with a reason.

Assess. Turn your answers into a source-linked list of obligations, with the reasoning for why each applies and the open questions.
Implement. Convert each obligation into a control the agent actually follows, such as a disclosure message, an approval step or a log, plus a test.
Review. Assemble the evidence and decisions so legal, security and customer reviewers can see what was done and what is still open.
Maintain. Reassess when the agent, the market or the law changes, and keep the evidence current.

Software can speed up research and tracking, but it does not replace qualified counsel. Questions that need professional judgment, such as whether a regulation covers your product, should go to a lawyer.

‍

Frequently asked questions

Is there one law that governs all AI agents?

No. In the US there is no single federal AI statute for agents. Obligations come from sector rules, state laws, consumer protection and privacy law, and from the EU AI Act if you serve EU users.

Do I need a lawyer to answer "is my AI agent legal?"

You can do the first pass yourself by describing what the agent does and mapping it to the rules that might apply. For any question that turns on how a law is interpreted, you need qualified counsel.

Does using a third-party model make the vendor responsible?

Not fully. A vendor's terms may cover its own part, but the company that deploys the agent usually keeps its own duties to customers and regulators.

How often should I recheck an agent's legal status?

Whenever the agent gains new capabilities or data, moves into a new jurisdiction, or a relevant rule changes. Fast-moving areas such as state AI laws justify a scheduled review at least quarterly.

Can an agent be legal in one state and not in another?

Yes. Licensing, disclosure and automated decision rules differ by state, so an agent that works in one market may need changes in another.

How can I find out if my AI agent is legal?

Go to ismyagentlegal.com and describe what your agent does. You receive a preliminary assessment listing the legal instruments and obligations that may apply, the facts to verify and the likely gaps. It is a starting point for your team and counsel, not a legal opinion.

What is Carver Agents and how does it help?

Carver Agents is an autonomous legal completion service for AI agents. It identifies which obligations apply, turns them into engineering controls and tests, prepares evidence for legal and customer reviews, and reassesses as your agent and the law change. It works with your existing counsel and engineers, and it does not guarantee approval or replace professional legal advice.

‍

See what a legal assessment would find for your agent

Tell us what your agent does and we will prepare a preliminary, source-linked assessment: the obligations that may apply, the questions to verify, likely gaps and the changes that would trigger a reassessment. Book a 20-minute walkthrough at ismyagentlegal.com or write to support@carveragents.ai.

This article is general information, not legal advice. Whether a law applies to your agent depends on facts that need verification and, where appropriate, review by qualified counsel. Laws and deadlines change; check current status before relying on any date. Last reviewed 21 October 2026.

Sources