Who Bears the Risk When an AI Agent Signs a Purchase Order?

A procurement agent selects a supplier, generates a purchase order, sends it through the approved workflow, and the supplier ships against it. Weeks later, the part is nonconforming, the shipment delay triggers a customer penalty, or the supplier claims the PO changed the commercial terms. The first uncomfortable question is not whether the model was intelligent. It is whether the organization can say the order was not really its act because an AI agent clicked the final button.

For supply chain teams assessing legal risk from AI use, that answer is moving in a fairly unforgiving direction. The safer assumption in Q3 2026 is that if an organization deploys an AI agent with authority to transact, reroute, approve, or commit, the law and the contract record will often look back to the organization that gave the agent room to act.

That does not mean every agent-generated act is automatically enforceable in every possible scenario, or that courts have finished mapping old doctrines onto LLM-based systems. They have not. But two pieces of legal ground matter immediately. First, the federal E-SIGN Act already recognized “electronic agents” in 2000 and treated certain contracts formed by electronic agents as having legal effect, even where no human personally reviewed the individual action at the moment it occurred.[1] Second, California AB 316, effective January 2026, prohibits defendants from asserting that AI autonomously caused the harm, cutting directly against the cleanest version of the “the AI did it” defense.[1]

Those two points should change how procurement, logistics, and legal teams read an agent demo. The interesting part is not the screen where the system compares prices. The interesting part is the authority boundary: what can the agent bind, under which conditions, with whose approval, and with what record when the dispute file opens six months later.

The purchase order is where automation becomes authority

A recommendation tool leaves a manager with the decision. An autonomous procurement agent may make the decision and trigger the downstream act: supplier selection, PO creation, release against a blanket agreement, shipment reroute, expedited freight approval, or substitution of an approved source. That shift matters because supply chain operations run on acts that other parties rely on.

If a buyer accepts an AI-generated suggestion and then sends the PO, the audit path is familiar. If the AI agent sends the PO inside preconfigured rules, the question becomes whether the organization delegated enough authority for that act to count. The E-SIGN Act is not a supply chain statute, and it was not written with modern LLM agents in mind. Still, Baker McKenzie’s June 2026 analysis points out that its definition of “electronic agent” is broad enough to cover software that acts independently to initiate or respond to electronic records or performances, and that this framework can give legal force to agent-executed transactions.[1]

That is the blind spot. Many organizations have been treating agentic AI as if it sits in the same legal bucket as analytics, scoring, or workflow suggestions. But a system that has authority to send a commercial instrument is no longer just producing insight. It is participating in contract formation, operational commitment, and reliance by third parties.

The distinction is especially important for teams moving from pilots into production. A sandbox can show whether an agent finds a cheaper approved supplier. Production shows whether the supplier, carrier, customer, finance team, and legal department all treat the agent’s output as an authorized business act. If they do, the organization should not expect the absence of a human click to be a reliable escape hatch.

For readers still sorting out what counts as a production-grade agent rather than a co-pilot, the distinction is worth making before the legal analysis. The operational risk is concentrated in systems that can act across procurement and planning workflows, not in dashboards that merely recommend. See Finding the Real Agentic AI Platforms in Supply Chain Procurement and Planning for that boundary.

Why the algorithm defense is weakening

The most tempting defense after a bad autonomous decision is also the least satisfying operationally: no person made the call, so no person can be blamed. California AB 316 is important because it attacks that move directly. As summarized by Baker McKenzie, the law bars defendants from asserting that AI autonomously caused the harm.[1]

That does not settle every supply chain dispute. It does not mean every court will apply the same reasoning to every procurement agent, every logistics rerouting tool, or every contractual chain. It also does not convert vendor fault into customer fault in every case. The narrower point is strong enough: in a major U.S. jurisdiction, the legal system is making less room for the idea that autonomous AI breaks the chain of responsibility simply because the immediate decision was made by software.

That should feel familiar to anyone who has managed delegated purchasing authority. If a junior buyer exceeds a limit, the organization does not get to end the conversation by saying, “the buyer did it.” The real inquiry is whether the person had apparent or actual authority, whether controls were reasonable, whether the counterparty relied on the act, and whether internal governance failed. AI agents create different proof problems, but the management question rhymes: who gave the authority, who constrained it, and who monitored the result?

This is where E-SIGN and AB 316 connect. E-SIGN makes it harder to treat electronic agent activity as legally weightless. AB 316 makes it harder to treat autonomous causation as a liability vacuum. Put together, they point toward a practical rule for supply chain leaders: if the system is allowed to bind the business, reroute goods, release spend, or trigger supplier obligations, the business needs a record showing that this authority was deliberately granted and properly bounded.

The hard part is not the agent; it is the handoff

Single-agent stories are already difficult enough. Multi-agent supply chains make the reconstruction problem worse. Company X’s procurement agent may query Company Y’s supplier portal agent, which may call a logistics optimization system operated by Company Z. The final action may look like one decision to the business user: supplier changed, route updated, PO released. Under the hood, it may be a chain of machine-to-machine actions with partial visibility at each boundary.

The Berkeley Technology Law Journal’s June 2026 analysis describes why multi-agent AI strains liability frameworks built around single-agent systems. In its account, one agent can hand off to another, which then calls a third system, while no single developer or deployer has full visibility across the complete decision chain.[2] That is not a prediction that courts have already resolved these cases. It is a warning that the fact pattern is plausible and that traditional doctrines may not map neatly when causation, control, and observability are distributed.

CISA’s 2026 guidance on agentic AI services, discussed in Baker McKenzie’s analysis, points in the same operational direction: autonomous actions, inter-agent interactions, and responsibility tracing across organizational boundaries create distinct risks.[1] The common theme is not that multi-agent systems are unusable. It is that a dispute file assembled after the fact will be thin if each participant only logged its own clean fragment and nobody captured the authority chain.

A procurement manager will not be helped much by a vendor slide saying the agent followed policy. In a contested transaction, the useful evidence is more specific: which policy version was active, which agent invoked it, what data it used, what exception path it skipped or followed, what message went to the counterparty, whether another agent transformed the instruction, and whether the final act remained inside the authority granted by the deploying organization.

What a defensible authority record looks like

The answer is not to require a lawyer to approve every replenishment order or every truck reroute. That would erase much of the value of autonomous systems. The answer is to decide, before deployment, which acts the agent may perform without human intervention and which acts remain reserved for people.

Bounded authority starts with verbs, not aspirations. “Support procurement decisions” is too soft. “Release purchase orders up to a defined internal threshold against approved suppliers under active master agreements” is closer to an authority grant that operations and counsel can test. The boundary should say what the agent can do, what it cannot do, and what conditions must exist before it acts.

In supply chain workflows, useful boundaries often attach to supplier status, spend level, product criticality, delivery risk, jurisdiction, customer commitment, and contract deviation. An agent may be allowed to reorder standard indirect materials from approved suppliers but blocked from changing payment terms. It may reroute a shipment around a disruption but require human approval if the reroute changes customs exposure, customer delivery promises, or carrier liability terms. The exact limits will vary, but the organization should be able to point to them without reconstructing intent from Slack messages and meeting notes.

Human approval thresholds need the same discipline. A workflow that says “escalate when needed” is not a control; it is an invitation to argue later about what the agent should have understood. Thresholds can be tied to spend, margin impact, contractual change, supplier risk, regulated product status, or downstream customer penalty exposure. The threshold should also specify who approves. A category manager, logistics coordinator, legal reviewer, and finance approver do not carry the same authority.

Audit trails are where many agent programs will either become defensible or become folklore. A useful log does not merely say “approved by AI.” It records the policy version, instruction class where appropriate, data sources consulted, supplier records used, exception flags, approvals requested, approvals received, outbound messages, system-to-system handoffs, and final transaction state. If the agent changed course because another system responded with new information, that handoff belongs in the record.

Monitoring is different from logging. Logs help reconstruct. Monitoring helps catch trouble while it is still operational rather than legal. Procurement and logistics teams should watch for repeated edge-case approvals, unusual supplier concentration, unexpected freight upgrades, agent actions near approval thresholds, and frequent failed handoffs between systems. These are the patterns that tell a business the authority boundary is either too loose, too vague, or being pushed by conditions nobody modeled well.

The vendor contract has to follow the agent stack

The organization that deploys the agent should expect to own the operational consequences of using it, but that does not mean vendor contracts are secondary. They are where visibility, cooperation, and responsibility are either preserved or lost.

A procurement AI contract should not stop at uptime, data processing, and generic indemnity language. It should address logging access, retention, incident cooperation, model or workflow changes, subcontracted systems, integration responsibilities, authority configuration, and what happens when the vendor’s agent calls another service. If the vendor cannot provide the traceability needed to explain a commercially binding act, the buying organization should treat that as a governance defect, not a technical footnote.

This is also where internal procurement discipline matters. Teams evaluating autonomous procurement use cases often focus on cycle time, savings, and exception handling. Those are legitimate reasons to deploy agents; production examples are already moving beyond theory, as discussed in Agentic AI in Procurement: Where Autonomous Agents Are Delivering Measurable Results. But the same business case should include the cost of authority controls, auditability, vendor cooperation, and legal review. Otherwise the ROI calculation quietly assumes that disputed autonomous acts will never need to be explained.

Before the dispute, assign the boring rights

The controls that matter most are not exotic. They are the same rights and records procurement teams already understand, applied to systems that act faster and across more interfaces than human buyers.

• Name the business owner for each autonomous workflow, not just the technical owner of the platform.
• Define which agent actions are recommendations, which are approvals, and which are external commitments.
• Map authority limits to existing delegation-of-authority policies and supplier contract terms.
• Require human approval for defined commercial, legal, customer, regulatory, or disruption thresholds.
• Preserve logs that show the full transaction path, including inter-agent handoffs and vendor-managed components.
• Write vendor and counterparty contracts so cooperation, evidence access, and responsibility do not depend on goodwill after a loss.

A useful test is simple: if a supplier disputed the order tomorrow, could the company show who authorized the agent to send it, what limits applied, what information the agent relied on, whether a human approval threshold was crossed, and which systems touched the decision before the PO went out? If the answer requires three vendors, two integration teams, and someone’s memory of a pilot design meeting, the risk is already being carried. It is just not yet on the dispute docket.

The law is still developing around modern LLM-based agents, especially in multi-agent settings. That uncertainty is not a reason to wait. It is a reason to keep the authority record cleaner than the technology requires. If an organization gives an AI agent operational authority in the supply chain, the defensible move is to define, log, monitor, and contract around that authority before the agent’s act becomes someone else’s damages claim.

References

1. United States: Legal Accountability for AI Agents, Baker McKenzie, June 2026.
2. Multi-Agent AI Is Outpacing the Liability Frameworks Built for Single-Agent Systems, Berkeley Technology Law Journal, June 2026.