I never expected Shaggy to show up in a law firm’s analysis of AI risk, yet here we are. Shaggy’s memorable defense was “it wasn’t me.” Meta is giving it a contractual upgrade: It was our technology, but it’s your responsibility.

The update to Meta’s commercial terms puts broad responsibility for its AI features and resulting content on business users. Whether legal has read the update or not, continued use after November 20, 2026 means agreeing to take sole “[responsibility] for and assume any and all risks associated with” Meta’s AI features.

 

That defense gets harder to laugh off as AI agents gain more autonomy. When an agent can make decisions, invoke tools, generate code, or interact with other systems, pointing at the technology after something goes wrong doesn’t answer the question that risk leaders actually care about: Who had control, and who gets stuck with the consequences?

True AI Accountability Doesn’t Exist Without Control

Coincidentally, Washington is wrestling with the same problem. A new bipartisan proposal for an AI Agent Accountability Act would extend liability under the Computer Fraud and Abuse Act to AI agent operators and developers that recklessly cause damage and, in some circumstances, developers that fail to implement reasonable safeguards. The bill is only a proposal, but directionally, it shows lawmakers waking up to the possibility that without enforceable controls, autonomy can become an accountability escape hatch.

My new report, Contracts Are The AI Guardrails With Teeth, makes the same distinction. Having AI governance policies and identifying AI risk is not enough to ensure accountability when third-party AI goes wrong — whether through model changes, system failure, or an agent that exceeds its authority. Contracts are critical to connect governance intent with risk management execution.

How To Give Your AI Guardrails Teeth

Contracts can constrain AI risk or quietly transfer it to you. The difference is what happens when something goes wrong. Before agreeing to terms on third-party AI:

  • Bound the agent’s autonomy. Identify what the agent can do, what it cannot do, and what decisions require human approval. Then define what it should do and should not do by either policy or code. The more an agent has to access data, invoke tools, initiate transactions, or act in other systems, the more explicit those boundaries need to be.
  • Demand evidence, not assurances. Require logs, material change notifications, incident reporting, and investigation support that let you determine what the agent did and why. “Trust us, we have safeguards” is not much help when you need to reconstruct an incident or prove that a control actually worked.
  • Match accountability to control. Push back on blanket risk transfers when the supplier controls the model, its safeguards, or changes that customers cannot see. You should not automatically own a risk simply because you use the technology, particularly when the supplier controls the conditions that create that risk.
  • Make remedies real. Establish remediation, suspension, termination, and meaningful financial recourse before something goes wrong. A contractual safeguard without a consequence for failing to meet it is closer to an aspiration than a control.

It comes down to one question: If this agent exceeds its bounds tomorrow, what can we contractually require the supplier to do about it, and who pays when the safeguards fail?

For a closer look, join me at Forrester’s Security & Risk Forum in Washington, DC on November 9–10. I’ll dig deeper into the contractual clauses that create transparency, accountability, and recourse across the third-party AI ecosystem.

Remember, “it wasn’t me” belongs in your playlist, not your AI accountability model.

Share