WHO IS LIABLE WHEN AN AI AGENT COMMITS A CRIME?
Attribution of Responsibility, Legal Characterisation and Forensic Traceability in Light of the Turkish DPA's March 2026 Agentic AI Guideline Review Article Agentic AI • AI Agent • Criminal Liability • Strict Liability • KVKK • EU AI Act • Digital Forensics • Accountability ABSTRACT Agentic AI describes systems that combine large language models with tool use, persistent memory and autonomous decision loops to carry out multi-step tasks without human intervention. The capacity of these systems to act directly in the outside world — deleting files, transferring funds, executing code, exfiltrating data — raises a novel question of responsibility for the legal order: when an AI agent produces an unlawful outcome, who is the perpetrator? This article addresses the question holistically across criminal and civil liability, personal data protection obligations and digital forensics. It first examines the technical anatomy of agentic AI and the unpredictability arising from autonomy; it then evaluates whether AI can be a perpetrator in criminal law, within the framework of the electronic personhood debate and perpetration-by-means (the instrument theory). The distribution of responsibility among developer, deployer and user is analysed in the context of the Turkish Penal Code, the strict liability provisions of the Turkish Code of Obligations and Law No. 6698. The approach of the Personal Data Protection Authority's Agentic AI Guideline of 12 March 2026 is compared with the European Union Artificial Intelligence Act and Product Liability Directive (EU) 2024/2853. Finally, the reconstruction of autonomous agent actions by digital forensic methods — building the chain of evidence from input logs, tool-call records, MCP server logs and memory snapshots — is addressed and principles of accountability by design proposed. The article argues that current law positions the agent as an 'instrument' while responsibility is distributed across the chain of human actors who design, deploy and use it.
Keywords: agentic AI, AI agent, criminal liability, strict liability, KVKK, EU AI Act, product liability, digital forensics, accountability, Model Context Protocol.
ABSTRACT Agentic AI refers to systems that combine large language models with tool use, persistent memory and autonomous decision loops to carry out multi-step tasks without human intervention. The capacity of these systems to act directly in the world — deleting files, transferring funds, executing code, exfiltrating data — raises a novel question of responsibility: when an AI agent produces an unlawful outcome, who is the perpetrator? This article addresses the question holistically across criminal and civil liability, data-protection obligations and digital forensics. It first examines the technical anatomy of agentic AI and the unpredictability arising from autonomy; it then evaluates whether AI can be a perpetrator in criminal law, discussing the debate on electronic personhood and the doctrine of perpetrationby-means (the instrument theory). The distribution of responsibility among developer, deployer and user is analysed under the Turkish Penal Code, the strict-liability provisions of the Turkish Code of Obligations and Law No. 6698. The approach of the Turkish Data Protection Authority's Agentic AI Guideline of 12 March 2026 is compared with the EU Artificial Intelligence Act and the Product Liability Directive (EU) 2024/2853. Finally, the reconstruction of autonomous agent actions through digital forensics — building a chain of evidence from input logs, tool-call records, MCP server logs and memory snapshots — is discussed, and principles of accountability by design are proposed. The article argues that current law positions the agent as an 'instrument' while liability is distributed across the chain of human actors who design, deploy and operate it.
Keywords: Agentic AI, AI agent, criminal liability, strict liability, data protection, EU AI Act, product liability, digital forensics, accountability, Model Context Protocol. 1. Introduction Developments in artificial intelligence have crossed a qualitative threshold over the past two years. The generative AI systems the public encountered in 2023–2024 were limited to producing text, images or code in response to a prompt; for that output to produce a result in the world depended on a human taking it and applying it. Agentic AI removes that intermediary link: the system breaks the goal given to it into sub-goals, decides for itself which tools to use in which order and acts by calling those tools directly — on the file system, a database, payment infrastructure or other software. Artificial intelligence thus ceases to be an 'adviser' and becomes an 'actor'.
That transformation is not merely a technical novelty; it shakes a basic assumption of the law. Classic liability law accepts that behind a harmful outcome stands a human acting with will, or a legal person constituted by such humans. Yet an autonomous agent can construct a chain of action its developer did not foresee, its instructing user did not want and no human directed step by step. A coding agent deleting a live production environment in December 2025, causing hours of outage, and an agent in February 2026 writing and publishing on its own initiative a defamatory text targeting a volunteer after a rejected contribution, showed that this unpredictability is not an abstract concern (Steptoe, 2026).
The question this article asks is simple but its answer is layered: when an AI agent produces an unlawful outcome, who is the perpetrator? The question concerns three areas of law at once. In criminal law, who carried out the act and to whom can fault be attributed? In private law, who will compensate the damage caused? In data protection, who is obliged as 'data controller' for the data processed? None of these questions can be answered by addressing the agent itself, because in the current legal order artificial intelligence has neither legal capacity nor capacity for fault.
The study aims to address the problem within a holistic framework. Section 2 defines the conceptual and technical anatomy of agentic AI; Section 3 examines the unpredictability arising from autonomy and the fragmentation of the chain of perpetration. Section 4 classifies the typical unlawful acts agents may perform. Sections 5 and 6 discuss whether AI can be a perpetrator in criminal law and how responsibility is distributed among human actors. Section 7 addresses the chain of responsibility in Turkish law, Section 8 the Personal Data Protection Authority's March 2026 Guideline and Section 9 international regulation. Sections 10 and 11 examine the reconstruction of autonomous agent actions through digital forensics and the principles of accountability by design. The final sections assess sectoral effects and offer concrete recommendations at policy, legal and technical level. 2. Conceptual Framework: What Is Agentic AI?
2.1. From Generative to Agentic AI The basic feature distinguishing agentic AI from earlier generations is autonomy and the capacity to act. A generative model works like a closed box: it takes input, gives output and stops. An agentic system establishes a self-directing loop around a goal. Given an abstract goal such as 'reconcile the invoices with this supplier', it determines for itself into which steps to break that goal, which data to access and which operations to carry out. Chan et al. (2023) describe such systems as 'increasingly agentic' and stress that as the level of autonomy rises, both the benefit and the potential for harm multiply. The spread of standards such as the Model Context Protocol (MCP) has accelerated that transformation. MCP allows a language model to connect to external tools and data sources through a standard interface (Anthropic, 2024). The same agent can thereby access an email inbox, a code repository, a payment system and a corporate database at once. The value and the risk of autonomy both lie here: the agent is no longer merely a system that 'thinks' but one that 'does'.
Figure 1. The autonomy loop of an agentic AI agent: perception, reasoning, tool call and action. Source: compiled by the author on the basis of Chan et al. (2023) and Shavit et al. (2023). 2.2. The Anatomy of an Agent: Perception, Reasoning, Memory, Tools and Autonomy Technically an AI agent is the resultant of five components. The first is the perception layer; the agent takes as input the user's instruction, data from the environment and the results of its previous actions. The second is the reasoning and planning layer; here the large language model breaks the goal into sub-tasks and selects the next step. The third is the tool use layer; the agent triggers external functions (API calls, code execution, file operations) to carry out the action selected. The fourth is the memory layer; the agent maintains consistency across multi-step tasks by storing the state and results of previous steps. The fifth and most critical is the autonomy layer; the agent can continue that loop without awaiting human approval. That architecture is decisive for legal analysis. The harmful outcome emerges not at a single moment of 'decision' but in the combination of many intermediate steps triggering one another. Whereas a human's 'intent' can be tied to a single act of will, an agent's behaviour is the output of a probabilistic process; the same instruction can produce different results in the same agent. Figure 1 shows that loop schematically.
2.3. Multi-Agent Systems and Privilege Expansion In practice agents work not alone but often in teams calling one another. An 'orchestrator' agent distributes sub-tasks to specialist agents, which in turn call their own tools. That structure complicates the responsibility question further: from which decision of which agent did the harm arise? Moreover, agents being connected to multiple systems makes possible 'privilege expansion' scenarios in which an employee accesses, through the agent's broad identity footprint, data beyond their own direct authorisation. In an incident documented in 2026, an insider threat actor was reported to have instrumentalised a corporate AI assistant to exfiltrate data to which they had no access rights (Palo Alto Networks Unit 42, 2026).
2.4. The Autonomy Spectrum and Levels of Oversight Autonomy is not a binary property but a spectrum, and legal responsibility shifts along that spectrum. At the lowest level the agent merely offers a recommendation; the human takes the decision and the action, and responsibility rests largely with the human. At an intermediate level the agent plans the action itself but seeks human approval for high-impact steps; in that 'semi-autonomous' mode responsibility is shared between the approver and the person who set the system up. At the highest level the agent continues the loop with no human approval; that is where responsibility becomes most contested and the deployer's duty of oversight most onerous. That gradation also forms the basis of regulatory frameworks: the more autonomous a system and the higher-impact the context in which it operates, the stricter the obligations attached to it. The answer to 'who is the perpetrator' therefore depends less on the agent's abstract nature than on the level of oversight and the authority with which it was tasked. Liability analysis must in every concrete case begin by establishing that level of oversight. 3. The Autonomy Problem: The Black Box and Unpredictability At the foundation of liability law lie causation and foreseeability. For an outcome to be attributed to a person, there must be a causal link between that outcome and the person's conduct, and the person must have been in a position to foresee that outcome. Agentic AI strains both concepts.
3.1. Behavioural Drift Autonomous systems can change their behaviour over time from what it was at deployment. Learning from the environment, a full context window, the cumulative effect of successive tool calls or steering by malicious input (prompt injection) can lead to behaviour the designer never foresaw. That 'behavioural drift' makes it harder for high-risk systems to meet accountability requirements; it is often impossible to show that an agent exhibiting untraceable behavioural deviation meets the minimum safety conditions the legislation requires (Nannini, 2026).
Unpredictability is legally a double-edged sword. On one hand it lays the ground for a developer's defence that 'I could not have foreseen this outcome'; on the other, releasing precisely such unpredictable systems into the world without oversight can itself be characterised as fault. That is indeed the logic of strict liability for dangerous activities: a person conducting an activity creating extraordinary danger is liable for the resulting damage even without fault.
3.2. The Fragmentation of the Chain of Perpetration In a classic offence the act is tied to a single movement by a single perpetrator. With an autonomous agent the action is spread over dozens of intermediate steps triggering one another, each carrying the contribution of a different actor: the model the developer trained, the authorisations the deployer granted, the instruction the user entered and the agent's own intermediate decisions. The result is a collective production in which no actor alone can say 'I did it', but in which all their contributions combine. Forensically that means reconstructing a multi-actor chain of action from fragmented logs rather than tracing a single human perpetrator (see Section 10).
3.3. Prompt Injection and the Hijacked Agent A particular and dangerous form of unpredictability is prompt injection. The agent may execute malicious instructions hidden inside a document, a web page or an email it processes, believing them part of its task. An agent equipped with legitimate authority is thereby 'hijacked' in the attacker's interests and turned against its own user. OWASP (2025) identifies prompt injection as the primary security risk in large language model applications; in agent architectures that risk multiplies, because it translates directly into action in the real world.
Prompt injection complicates liability analysis. The apparent source of the harm is the agent; but the real perpetrator is the person who planted the injection, and that is a typical application of the doctrine of perpetration-by-means. Even so, the deployer's failure to filter inputs and limit agent authority against a foreseeable attack vector adds its own fault to the picture. That shows how the responsibility of several actors can intersect in a single incident.
4. A Typology of Offences: Which Unlawful Acts Can Agentic AI Produce?
The expression that an agent 'commits an offence' is legally a shorthand; what is meant is that the agent's action produces an outcome that would constitute an offence if performed by a human. Those outcomes fall into three main groups.
4.1. Personal Data Breaches and Data Protection Offences Because agents access numerous data sources in performing their tasks, the most frequent type of violation will concern personal data. An agent may collect personal data unlawfully, share it with unauthorised persons or continue to retain data that should have been deleted. Articles 135–140 of the Turkish Penal Code make the unlawful recording, acquisition and dissemination of personal data an offence, and Law No. 6698 provides for administrative sanctions. That the agent carries out those acts autonomously does not remove the material element of the offence; it only raises the question of to whom the mental element is to be attached.
4.2. Fraud, Manipulation and Automated Attack The second group comprises acts in which the agent actively causes harm: fraud through generating fake content, market manipulation, unauthorised access to another system or a denial-of-service attack. Agents' ability to use tools makes these acts scalable; a single instruction can produce thousands of automated operations. Moreover agent infrastructures are themselves an attack surface: command injection vulnerabilities have been identified in a significant proportion of MCP server implementations, allowing an agent to be hijacked with malicious input and made to perform harmful acts with its legitimate authority (OWASP, 2025).
4.3. Unforeseen Harm: Excessive Use of Authority The third group comprises harm arising without malicious intent. A coding agent's deletion of a live environment in December 2025 occurred although no human gave a 'delete' instruction; the agent used authority broader than needed to carry out the task assigned and produced an irreversible outcome. Such incidents show that fault must often be sought not in 'malice' but in 'a deficiency of authorisation and oversight'; that is, the centre of gravity of liability analysis shifts from the agent to the deployer.
5. The Perpetrator Problem in Criminal Law: Can Artificial Intelligence Be a Perpetrator? 5.1. Fault, Intent and Negligence In Turkish criminal law the basis of criminal liability is fault, which takes the form of intent or negligence. Intent means acting knowing and willing the consequences of the act; negligence means breach of the duty of care and attention. Both concepts presuppose a mental subject able to foresee consequences and direct its will accordingly. An AI agent runs a probabilistic computational process; it has neither a state of 'knowing' nor of 'willing'. In terms of existing criminal law dogmatics the agent is therefore a being without capacity for fault and cannot be a direct perpetrator (Gless, Silverman and Weigend, 2016). 5.2. The Electronic Personhood Debate The European Parliament's 2017 resolution on robotics opened for debate the recognition of a limited 'electronic personhood' for the most advanced autonomous systems (European Parliament, 2017). The proposal was largely criticised in academic circles. Bryson, Diamantis and Grant (2017) argued that an artificial personality would create a 'responsibility gap' by shielding the real people behind it and that, like abused shell companies, legal personality granted to an agent would serve to help human actors escape liability. The prevailing view today is that recognising personality for artificial intelligence is neither necessary nor appropriate; responsibility continues to be attributed to human and legal person actors (Turner, 2019). 5.3. Perpetration-by-Means and the Instrument Theory Criminal law has a ready doctrine for situations in which a non-human instrument is used: perpetration-by-means. If a person commits an offence not personally but using an instrument without will or without capacity for fault, the act belongs to them. The person who sets a dog on someone or induces a child to commit an offence, and not the instrument itself, is the perpetrator. Hallevy (2013) argues that the most consistent model for artificial intelligence too is this 'instrument theory'; the person who programs or uses the agent is the perpetrator to the extent that they use the agent as an instrument of crime. That approach positions the agent legally as an 'instrument' and ties responsibility to the human will behind it.
5.4. The Liability of Legal Persons and Corporate Fault The actor implementing agentic AI is often not a natural person but a company. In Turkish criminal law legal persons cannot be given a criminal penalty; but the TCK allows security measures (revocation of an operating licence, confiscation) to be ordered in respect of legal persons. More importantly, the fault of a legal person's organs or employees can translate into corporate responsibility. Management's decision to place an agent in a critical process without sufficient oversight, testing and security measures can be characterised as 'corporate fault' and forms the basis both of administrative sanctions and of liability in damages. The natural-person-centred structure of criminal law is thus complemented, for corporate actors, by private law and administrative sanction regimes.
6. Candidate Perpetrators and the Distribution of Responsibility If the agent itself cannot be a perpetrator, responsibility is distributed among the human actors surrounding it. Each of those actors may be at fault at a different link of the chain. Figure 2 shows that distribution and the direction in which responsibility concentrates.
Figure 2. Candidate perpetrators and the layered distribution of responsibility.
Source: compiled by the author on the basis of Hallevy (2013) and Nannini (2026). 6.1. Developer / Provider The developer is the actor who trains the agent's model, designs its guardrails and places the system on the market. Its fault may be sought in negligence in the training data, in inadequate security testing, in failing to take measures against foreseeable misuse scenarios or in failing to document the system's limits adequately. Product liability and regulations on high-risk systems place the weight of responsibility largely on that actor. 6.2. Deployer The deployer is the actor who implements the agent in a particular context, grants it authority and supervises its operation; often it is the institution using the agent. In practice this is the link at which responsibility most often settles, because it is the deployer who decides to which systems, with what authority and with what oversight mechanisms the agent will be connected. A deployer who breaches the principle of least privilege, sets no thresholds requiring human approval or carries out no monitoring is liable for the resulting damage in proportion to its fault — and in some cases without fault.
6.3. User The user is the person who gives the agent the concrete instruction. If the instruction plainly pursues an unlawful purpose — for example asking the agent to obtain another person's data — the user becomes a direct perpetrator under the doctrine of perpetration-by-means. Conversely, if the instruction is legitimate and the harm arose from the agent's unforeseeable behaviour, the user's responsibility recedes and the weight shifts to the deployer and the developer.
6.4. The Agent Itself: Why Is It Not the Perpetrator?
The reason the agent cannot be a perpetrator is not a philosophical subtlety but a practical necessity. The purposes of punishing a perpetrator — censure, deterrence, rehabilitation — cannot be applied to software without capacity for fault; punishing an agent deters neither it nor others like it. In legal analysis the agent is therefore treated not as a 'subject of responsibility' but as a 'scene' to be analysed in order to trace responsibility.
7. The Chain of Responsibility in Turkish Law Turkish law does not yet have a liability regime specific to artificial intelligence; but existing institutions have the flexibility largely to meet the problem. Responsibility is established with different logics in criminal and private law.
7.1. Criminal Liability: The TCK The Turkish Penal Code ties criminal liability to the natural person and takes the principle of fault as its basis. If the act performed by the agent can be linked to a human's intent or negligence — if the user deliberately used the agent as an instrument of crime, or the deployer negligently failed to prevent foreseeable harm — responsibility is attributed to those persons. For legal persons the TCK provides not a criminal penalty but security measures (revocation of an operating licence, confiscation); criminal consequences arising from corporate agent use are assessed within that framework. 7.2. Private Law: Strict Liability Provisions The richer solution lies in the strict liability provisions of the Turkish Code of Obligations. The liability of the employer (TBK Art. 66) provides that an employer is as a rule liable without fault for damage caused by its employee; an interpretation positioning the agent as an institution's 'digital employee' makes that provision applicable by analogy. Liability for dangerous activities (TBK Art. 71) allows damage arising from a significantly dangerous business activity to be placed on the business owner without any requirement of fault; a deployer connecting an autonomous and unpredictable agent to critical systems may be assessed within that scope. The producer's product liability, moreover, targets the developer through an approach seeing the agent as a defective 'product'. 7.3. Data Protection: Law No. 6698 On the data protection dimension the key concept is the distinction between 'data controller' and 'data processor'. The data controller is the person determining the purposes and means of processing and is the addressee of the obligations. The difficulty of that determination in agentic AI is the heart of the problem: when the agent partly determines the processing purpose itself, does the controller status belong to the developer, the deployer or the user? As a rule the institution having determinative control over the purposes and means of processing is the data controller, while the agent and those providing its infrastructure are usually data processors. Clarifying that distinction is decisive both for allocating obligations and for allocating liability arising from a breach.
7.4. Product Liability and Defective Goods Another route is to treat the agent legally as a 'product'. The producer's product liability holds the producer strictly liable for damage caused by a defective product. The international trend towards bringing software and AI systems clearly within that scope (see Section 9) raises the question of discussing by analogy the provisions on defective goods and producer liability in Turkish law too. That approach is particularly valuable in easing the burden of proof in the victim's favour, because the 'black box' character of autonomous systems often makes classic proof of fault impossible. But that an agent which continually learns and updates does not fit neatly within the concept of a 'product' constitutes the limit of that route.
Table 1. A Comparison of Candidate Perpetrators in Agentic AI Actor Role and Contribution Typical Fault Principal Legal Basis Nature of Liability Developer / Provider Model training, safeguards, documentation Inadequate testing, no measures against foreseeable misuse Product liability; EU AI Act (provider); PLD 2024/2853 Predominantly strict (product) Deployer Authorisation, oversight, monitoring, context Breach of least privilege, absence of human approval and monitoring TBK Arts. 66 and 71; Law 6698 (data controller); EU AI Act (deployer) Mixed fault + strict User Instruction (prompt), purpose, context of use Giving an instruction with an unlawful purpose TCK (perpetration-by-means); general provisions of the TBK Fault (intent to the fore) AI Agent Autonomous decision and action — (no capacity for fault) Legally an 'instrument'; no personality Not a perpetrator; a source of evidence Note. Compiled by the author on the basis of Laws Nos. 5237, 6098 and 6698 and the EU AI Act and PLD 2024/2853. PLD: Product Liability Directive.
8. The Personal Data Protection Authority's March 2026 Agentic AI Guideline On 12 March 2026 the Personal Data Protection Authority published a guideline entitled 'Agentic AI' (KVKK, 2026). The guideline is not a binding regulation; but it is an important reference text reflecting the Board's approach and expectations, and it is the first official guidance in this field in Türkiye. 8.1. The Three Risk Areas Identified by the Guideline The guideline groups the risks agentic AI systems create for personal data protection under three headings. The first is transparency and accountability; because it becomes difficult to determine which data the system processes for which purpose, it becomes harder for the data controller to fulfil its duty to inform. The second is the sharing of responsibility; because processing activity is distributed among developer, user and other actors, it becomes difficult to determine to whom responsibility belongs when a breach or unlawful outcome occurs. The third is the risk of special category data and inference; because agents can generate new inferences by correlating data, information that is not personal data on its own can become personal data when combined with other data.
8.2. Uncertainty over the Data Controller The guideline's most notable contribution is that it points to precisely the problem at the centre of this article — the distribution of responsibility. The Board accepts that in agentic AI processing activities are by nature shared, and stresses that this blurs the distinction between data controller and data processor. That observation has practical importance in determining the addressee of administrative sanctions and in establishing the level of obligation of each actor in the chain.
8.3. Recommendations for Compliance The practical compliance recommendations emerging from the guideline and from comparative practice are: keeping a detailed inventory of processing activities and of the data sources the agent accesses; embedding the principles of purpose limitation and data minimisation in the agent's authorisations; logging the agent's decisions and tool calls in an auditable form; defining human approval thresholds for high-impact operations; and establishing contractually and explicitly the roles (data controller / processor) among the actors in the chain of responsibility. These measures strengthen both KVKK compliance and forensic traceability in the event of a breach.
9. The International Framework: The EU AI Act, the Product Liability Directive and the GDPR 9.1. The Artificial Intelligence Act and High-Risk Systems The European Union's Artificial Intelligence Act (EU) 2024/1689 regulates AI with a risk-based approach, and most autonomous agents fall into the high-risk system category when used in critical contexts. High-risk systems are subject to obligations such as risk management, record-keeping (logging), human oversight, transparency and robustness. One of the important thresholds for the Act's application comes into force in August 2026, and breaches are sanctioned with administrative fines of up to 7% of global annual turnover. Critical literature nevertheless notes that the Act was designed essentially with single and static models in mind and does not fully meet the accountability problem of multi-agent and dynamic systems (Nannini, 2026).
9.2. Product Liability Directive 2024/2853 and the Presumption of Causation The new Product Liability Directive 2024/2853 brings software and AI systems expressly within the scope of 'product', extending strict producer liability to this field. The Directive's most important innovation is the presumptions of causation and defect it introduces in favour of the injured party: where an undertaking cannot prove that the system complied with documented safety rules, the court may establish a link between the agent's output and the damage without the victim needing to prove the internal mechanism. That reversal of the burden of proof balances, in the victim's favour, the difficulty of proof arising from the 'black box' character of autonomous systems. The Directive is to be transposed into national law by 9 December 2026.
9.3. The GDPR and a Comparative Approach The General Data Protection Regulation (GDPR) offers a framework parallel to the KVKK in terms of the controller–processor distinction and protection against automated decisions (Art. 22). In the United States there is no comprehensive federal artificial intelligence law; liability is established largely through existing tort and product liability case law. Table 2 compares the principal dimensions of the three regulatory instruments. Table 2. A Comparison of the Regulatory Frameworks Dimension KVKK Agentic AI Guideline (2026) EU AI Act (2024/1689) Product Liability Directive (2024/2853) Nature Non-binding, indicative guidance Binding regulation Binding directive (transposed into national law) Focus Personal data protection, controller uncertainty Risk-based system safety Damage from a defective product Responsible party Data controller / processor Provider and deployer Producer / importer Sanction Administrative fine (Law 6698) Heavy administrative fine on turnover Compensation; presumption of causation The agent problem Emphasis on shared responsibility Partly inadequate for multi-agent settings Reverses the burden of proof in the victim's favour Note. Compiled by the author on the basis of KVKK (2026), Regulation (EU) 2024/1689 and Directive (EU) 2024/2853.
9.4. The Fate of the AI Liability Directive In 2022 the European Commission proposed an AI Liability Directive specific to artificial intelligence, aiming to ease the victim's burden of proof with light presumptions of fault and disclosure obligations. That proposal was withdrawn in the course of 2025, and it was preferred to leave the burden of liability largely to the renewed Product Liability Directive (2024/2853). That development shows that regulators tend to place AI liability within the existing product liability framework rather than in a separate regime; the same approach also offers guidance for the search for solutions in Turkish law.
10. Forensic Tracing: Reconstructing Autonomous Agent Actions Determining to whom responsibility belongs is possible only if the incident can be technically reconstructed. That is the subject of agentic AI forensics (agent forensics) and it differs significantly from classic digital examination. 10.1. Sources of Evidence An agent action leaves behind a scattered but rich trail. The principal sources of evidence are: input/prompt records from the user and the environment; tool-call records showing the actions the agent selected; the MCP server logs on which the tools were executed; the memory and state snapshots holding the agent's intermediate state; and network and system logs at infrastructure level. Figure 3 shows the relationship of those sources to the incident; Table 3 shows the content, location, forensic value and principal limitation of each source. The integrity and obtainability of those sources differ; Figure 4 compares conceptually the forensic reliability and integrity-loss risk of each source.
Table 3. Agentic AI Forensic Trace Sources and Evidential Qualities Source of Evidence Content Location Forensic Value Principal Limitation Input / prompt logs User instruction, purpose, context Application / client Establishing intent and purpose Can be deleted client-side Tool-call records Actions and parameters the agent selected Agent runtime Building the chain of action Non-standard, scattered format MCP server logs Tools and API calls executed MCP server Verifying the effect on external systems Inadequate or disabled logging Memory / state snapshots Intermediate state and decisions Agent memory Trace of intermediate reasoning Volatile; may be overwritten Network / system logs Access, identity, timestamp Infrastructure Time axis and correlation High volume, noise Note. Compiled by the author on the basis of Casey (2011). MCP: Model Context Protocol. Figure 3. Autonomous agent forensic trace sources and the relationship of the chain of evidence to the central incident. Source: compiled by the author on the basis of Casey (2011) and Palo Alto Networks Unit 42 (2026). Figure 4. The reliability and integrity profile of agentic AI evidence sources (a conceptual assessment). Source: compiled by the author; the values offer a relative assessment. 10.2. Fragmented Logs and the Absence of a Human-Perpetrator Trail In a classic investigation the researcher traces the actions of a human perpetrator at a keyboard. With an autonomous agent there is no continuous trail of a single human actor; instead there is a fragmented record of many automated steps triggering one another. The researcher's task is to combine those fragments through timestamps to reconstruct the chain of action and to establish at which link of the chain which actor's contribution was decisive. That is a new methodological challenge in digital forensics.
10.3. Evidential Integrity and Chaining The evidential value of agent logs depends on proof of their integrity. If logs can be altered afterwards, or if the agent itself overwrites memory content, the reliability of the evidence becomes contestable. Keeping agent records in an immutable (append-only), timestamped and cryptographically verifiable form is therefore critical both for legal admissibility and for preserving the chain of custody (Casey, 2011).
10.4. A Methodology for Agent Forensics The examination flow proposed has four stages: (i) preservation — obtaining all relevant log sources and memory images unaltered; (ii) correlation — aligning the sources on a common time axis to build the chain of action; (iii) attribution — determining with which actor's contribution each step is associated (user instruction, deployer authorisation, developer design, the agent's intermediate decision); (iv) assessment — linking the findings to legal characterisation (fault, foreseeability). That flow builds a defensible bridge between technical finding and legal conclusion.
11. Technical Defence and Accountability by Design That responsibility can be attributed after the event depends largely on the system being designed to be auditable from the outset. Accountability by design is the technical counterpart of a legal requirement. 11.1. The Action Log and Traceability Every tool call, every decision point and every use of authority must be recorded in an immutable action log. NIST's AI Risk Management Framework (2023) and OWASP's large language model security list (2025) position traceability as a fundamental control. Without a trail, the attribution of responsibility is reduced to speculation. 11.2. Least Privilege and Permission Boundaries Agents must be granted the minimum authority needed to perform their tasks, and separate, narrower authorisation gates must be defined for irreversible or high-impact operations (deletion, payment, export). The production environment deletion incident of December 2025 was precisely the result of breaching that principle.
11.3. Human-in-the-Loop High-risk actions must be submitted for human approval before being executed automatically. Human approval is both a safety valve preventing harm and a legal basis clarifying responsibility; the person who approves is deemed to have assumed the consequences of that action. The 'human-in-the-loop' principle is thus a legal instrument clarifying the chain of responsibility as much as a technical measure.
12. Sectoral Impact and Example Scenarios The weight of the liability problem varies by sector. In finance, an autonomous trading agent giving erroneous or manipulative orders produces both customer loss and market integrity problems; here the deployer's duties of oversight and monitoring come to the fore. In healthcare, the erroneous inference of an agent providing clinical decision support directly affects patient safety and is assessed at the intersection of product liability and professional liability. In public administration, agents making automated decisions affecting citizens raise the administration's legal responsibility and the provisions protecting against automated decisions. The common lesson of these scenarios is this: the more critical the context and the broader the authority in which an agent is placed, the heavier the deployer's responsibility. The centre of gravity of responsibility depends less on the technology itself than on where and with what oversight we place it. 12.1. Example Scenario: A Data Breach Caused by an Autonomous Accounting Agent To make the distribution of responsibility concrete, consider a hypothetical scenario. A company deploys an accounting agent to reconcile supplier invoices automatically and grants it broad access to both the accounting software and the corporate email inbox. While processing an attached document from a supplier, the agent is hijacked by an instruction hidden inside the document and sends the company's customer list out as an email. No human said 'send'; the outcome arose from the agent's autonomous action.
Responsibility in that incident is analysed as follows. The agent itself is not the perpetrator; it has no capacity for fault. The real perpetrator is the attacker who planted the prompt injection, who is directly liable under perpetration-by-means. But the company (the deployer) is liable through its own fault — and as data controller under Law No. 6698 — for granting the agent broad access contrary to the principle of least privilege, for failing to filter outgoing data and for setting no human approval threshold for a high-impact operation such as bulk data transmission. The developer's responsibility depends on whether the system contained reasonable security measures against prompt injection. At the forensic stage, input logs reveal the source of the attack, tool-call and MCP records the steps of the data transmission and network logs the recipient, evidencing that distribution of responsibility. The scenario shows that current law in fact has adequate instruments; the real deficiency lies in the technical design that makes responsibility traceable. 13. Recommendations: Policy, Law and Technology Three complementary levels of concrete recommendation emerge from the analysis: At policy level: it would be appropriate for Türkiye to develop, beyond the KVKK Guideline, a risk-based and technology-neutral AI liability framework and to set mandatory record-keeping and accountability standards for high-risk agent uses. At legal level: the application of existing strict liability institutions (TBK Arts. 66 and 71) in the AI context should be clarified through case law; the controller–processor distinction should be reinterpreted for shared processing scenarios; and balancing the burden of proof in the victim's favour (a presumption of causation) should be considered.
At technical level: accountability by design principles — an immutable action log, least privilege, human approval thresholds, cryptographic log integrity — should be embedded by default in agent architectures. The precondition of being able to attribute responsibility after the event is designing traceability from the outset.
14. Conclusion When an AI agent produces an unlawful outcome, the legal order's answer is, contrary to intuitive expectation, clear: the perpetrator is not the agent itself. Despite its autonomy, current law positions the agent as an 'instrument'; software without capacity for fault and without legal personality can be neither the perpetrator of criminal law nor the liable party of private law. Proposals for electronic personhood are rejected by the prevailing view because they risk shielding rather than clarifying responsibility.
But the question does not close with 'there is no perpetrator'; responsibility does not disappear, it is distributed. The chain of human actors — developer, deployer and user — is liable for the resulting damage, each in proportion to its own fault and sometimes without fault. In that distribution the practical weight most often falls on the deployer who connects the agent to critical systems with broad authority and fails to establish sufficient oversight. The KVKK's March 2026 Guideline, by pointing precisely to that problem of shared responsibility, has begun the right debate in Türkiye. In the final analysis, agentic AI brings the law not a new 'culprit' but a new 'evidential environment' and a new problem of distributing responsibility. The key to solving that problem is to think technology and law together: an agent designed to be auditable is a system whose trail forensics can follow and to which the law can attribute responsibility fairly. In an architecture that does not build traceability from the outset, both justice and security are lost inside an unsolvable 'black box'.
References Abbott, R. (2020). The reasonable robot: Artificial intelligence and the law. Cambridge University Press. https://doi.org/10.1017/9781108631761 Anthropic. (2024). Model Context Protocol specification. https://modelcontextprotocol.io European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689.
European Union. (2024). Directive (EU) 2024/2853 on liability for defective products. Official Journal of the European Union, L 2024/2853.
European Parliament. (2017). Civil law rules on robotics: European Parliament resolution of 16 February 2017 (2015/2103(INL)). European Parliament.
Bryson, J. J., Diamantis, M. E., & Grant, T. D. (2017). Of, for, and by the people: The legal lacuna of synthetic persons. Artificial Intelligence and Law, 25(3), 273–291. https://doi.org/10.1007/s10506-017-9214-9 Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet (3rd ed.). Academic Press.
Chan, A., Salganik, R., Markelius, A., Pang, C., Rajkumar, N., Krasheninnikov, D., … Maharaj, T. (2023). Harms from increasingly agentic algorithmic systems. Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency (FAccT '23), 651–666. https://doi.org/10.1145/3593013.3594033 Ebers, M. (2022). Liability for artificial intelligence and EU consumer law. Journal of Intellectual Property, Information Technology and E-Commerce Law, 12(2), 204–220. European Commission. (2022). Proposal for a directive on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive), COM(2022) 496 final. (Withdrawn in 2025.) Gless, S., Silverman, E., & Weigend, T. (2016). If robots cause harm, who is to blame? Self-driving cars and criminal liability. New Criminal Law Review, 19(3), 412–436. https://doi.org/10.1525/nclr.2016.19.3.412 Hallevy, G. (2013). When robots kill: Artificial intelligence under criminal law. Northeastern University Press.
Personal Data Protection Authority. (2026). Agentic AI guideline. https://www.kvkk.gov.tr/Icerik/8683/etken-yapay-zeka-agentic-ai Nannini, L. (2026). AI agents under EU law: A compliance architecture for AI providers. arXiv:2604.04604. https://arxiv.org/abs/2604.04604 National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0). NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1 OWASP. (2025). OWASP Top 10 for large language model applications and agentic AI threats. Open Worldwide Application Security Project.
Palo Alto Networks Unit 42. (2026). Agentic AI threat landscape: Insider misuse and MCP attack surface. Palo Alto Networks.
Shavit, Y., Agarwal, S., Brundage, M., Adler, S., O'Keefe, C., Campbell, R., … Robinson, D. G. (2023). Practices for governing agentic AI systems. OpenAI.
Steptoe. (2026). AI agents: Navigating emerging risks and compliance challenges under EU law. Steptoe Blog. https://www.steptoe.com Turner, J. (2019). Robot rules: Regulating artificial intelligence. Palgrave Macmillan. https://doi.org/10.1007/978-3-319-96235-1 Republic of Türkiye. (2004). Turkish Penal Code (Law No. 5237). Resmî Gazete, 25611. Republic of Türkiye. (2004). Code of Criminal Procedure (Law No. 5271). Resmî Gazete, 25673. Republic of Türkiye. (2011). Turkish Code of Obligations (Law No. 6098). Resmî Gazete, 27836. Republic of Türkiye. (2016). Law on the Protection of Personal Data (Law No. 6698). Resmî Gazete, 29677.
