The Short Answer
When an AI agent gets clinical or legal work wrong, product liability assumes a defect, professional liability assumes a licensed human, and agency law reaches non-human agents only partway. States are splitting: prohibit or license. On ibl.ai you own all the code and the data.
Agents are already inside licensed workflows. They draft contracts, prepare filings, and reason across clinical documents. The interesting question stopped being whether that is allowed and became who answers for it.
Why don't the existing liability doctrines fit an AI agent?
Because each was built around an assumption an agent breaks.
Product liability asks whether a product was defective — a manufacturing flaw, a design flaw, a failure to warn. A model that behaved exactly as designed, on an input nobody anticipated, is awkward to call defective. The harm arrives without the defect the doctrine is looking for.
Professional liability asks whether a licensed practitioner met the standard of care of their profession. The agent is not licensed and has no profession. Liability can attach to the supervising clinician or attorney, which is where it usually lands today, but that is a fallback rather than a fit.
Agency law goes furthest, and further than most commentary allows. UETA's "electronic agent" provisions and E-SIGN already attribute an electronic agent's actions to whoever deployed it — expressly including contracts formed with no human aware of the terms. So an agent that signs something binds its deployer.
What that machinery does not settle is the harder case: an agent acting outside any parameter its deployer foresaw, in a domain where the underlying act requires a licence. Attribution answers "whose act was it"; it does not answer "was the act competent".
None of these is useless. All three are being stretched, and stretching is what produces years of inconsistent outcomes.
What are US states actually doing about it?
Splitting into two camps — and the split is the story.
Prohibition. At least seven states now prohibit AI from delivering therapy: Illinois and Nevada in 2025, joined in 2026 by Colorado, Maine, Rhode Island, Tennessee and Vermont.
Any count here needs its taxonomy attached, because the line between prohibiting the service and prohibiting the claim is where trackers disagree.
California AB 489, Idaho and Nebraska bar a chatbot from representing itself as a licensed provider without banning the underlying service, and are usually counted separately. A bare number in this area is wrong within a legislative session.
Nevada's AB 406 shows how the two blend: it bars AI systems from providing services constituting the practice of professional mental or behavioural healthcare, and separately bars representing that an AI system is a therapist or provider.
Clinicians may still use AI for administrative functions — conditioned on independent review of the output.
Note the scope, because it is routinely overstated: these are prohibitions on AI therapy, not bans on healthcare AI generally. Documentation, coding and administrative automation are untouched.
Triage is not a safe example, though — Illinois and Rhode Island both bar AI from detecting emotions or mental states and from therapeutic decision-making.
Licensure. The Cicero Institute proposes the opposite: treat advanced AI "not as a dangerous product to be feared, but as a clinical service to be licensed," through an AI Augmented & Autonomous Service Provider designation. Instead of asking whether an agent may practise, the state licenses the service and attaches obligations to the licence.
| Approach | Who is accountable | What it leaves unresolved |
|---|---|---|
| Prohibition IL, NV, CO, ME, RI, TN, VT — AI therapy | Nobody, because the conduct is barred | Everything adjacent to therapy, and every other clinical use |
| Licensure Cicero's proposed AAASP | The licence holder | Who holds it — vendor, deployer, or the institution |
| Status quo | The supervising human, by default | Whether supervision was realistic at machine speed and volume |
Has the market waited for any of this?
No. The tooling shipped first, which is the normal order.
Anthropic's claude-for-legal suite has been public on GitHub since 12 May 2026 — 12 plugins covering individual practice areas, more than 90 specialised agents for recurring workflows, and around twenty MCP connectors.
It is Apache 2.0, so a firm can modify it, integrate it into closed products, and deploy it on its own instance with its own key. Anthropic is explicit that outputs require attorney review.
Be precise about what that licence buys, because it is easy to overstate. The repository offers two paths: install the plugins into Claude Cowork or Claude Code, or deploy through the Claude Managed Agents API behind your own workflow engine — which runs on Anthropic's servers.
The Apache-2.0 artefacts are plugin and skill definitions, not a self-hosted runtime.
So the configuration is yours to modify and version. Where the agent actually executes, and therefore where the logs live, is still a deployment decision — and it is the decision that determines what you can produce when something goes wrong.
Public companies have noticed. The share of S&P 500 companies disclosing AI as a risk went from 12% in 2023 to 83% in 2025, per The Conference Board.
As of September 2026 the SEC has no standalone AI disclosure rule — a rulemaking petition (File No. 4-882) was filed in February 2026 — but existing anti-fraud provisions apply in full, and "AI washing" is an active enforcement theory.
What should a firm or health system actually do now?
Stop waiting for the doctrine and start being able to answer the questions a court will ask.
Whatever framework settles, every version of it requires the same evidence: what the agent did, on whose instruction, against which policy, reviewed by whom.
An organisation that cannot reconstruct that has a problem under prohibition, under licensure and under the status quo alike.
Four things worth having before the law arrives:
- An immutable record of agent actions — not a chat transcript, an audit trail with the tools invoked and the data touched.
- A named human in the loop, recorded at the point of review rather than asserted in a policy document.
- Boundaries the agent cannot exceed, enforced by the runtime rather than the prompt.
- The ability to produce all of it without asking a vendor for an export.
Why does ownership decide the fourth one?
Because an accountability chain that runs through someone else's infrastructure is a chain you can describe only as far as your contract reaches.
On ibl.ai you own all the code and the data. The platform runs under a perpetual licence inside your own perimeter.
The audit trail, the review records and the policy configuration are yours to produce — in a deposition, a regulator's request, or a licensure filing — without a third party's cooperation.
It is model-agnostic, which matters for a regulated deployment: an open-weight model can run entirely inside the firm's own network, so privileged or clinical material never leaves it.
Pricing is usage-based with no per-seat pricing, and you can deploy anywhere: your cloud, your VPC, on-premise, or fully air-gapped.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
The doctrine will take years. The record-keeping will not, and it is the part that is useful under every outcome.
Sources: the seven-state count from Transparency Coalition and Becker's; Nevada AB 406 from Wilson Sonsini; the licensure proposal from the Cicero Institute's AI Clinical Services Act, whose model bill has been introduced elsewhere as the AI Medical Services Act; Anthropic's legal suite from its repository and launch coverage; AI risk disclosure from The Conference Board.
Related: Kenya's Draft AI Policy Spreads Liability Across the Chain — one jurisdiction's attempt to name every party in the chain rather than pick one.