01Who is responsible

Responsibility follows control. A product that ships with unnecessarily broad access made that choice at the factory. A business that widens a safely limited agent made a different choice. The statute should say so.

The test is who controlled the choice that caused the harm. The developer answers for what the base system does out of the box: its training, its defaults, the access it ships with. The deployer answers for what it adds: the data it connects, the instructions it sets and the decision it imposes on people. A hiring platform that screens out applicants by default is the developer's problem; an employer that turns a neutral ranking into an automatic rejection owns the decision.

Where both contribute to one proven harm, the affected person can recover from either, and the companies settle the split between themselves under their contract. The records the framework requires (Part two) are what make this traceable after the fact.

02Prices

Personalized pricing. When a person's own data shapes the price they see, they are told so, in plain view, at the point of the offer. New York already requires a disclosure like this for covered personalized algorithmic pricing ^[1]. Independent dynamic pricing based on inventory or demand stays legal. A related federal proposal from Senators Luján and Merkley addresses grocery surveillance pricing ^[2], and the EU AI Act bars exploiting a person's vulnerabilities, on different behavioral-distortion and significant-harm conditions ^[3]. The rule proposed here combines multiple necessities and inferred vulnerability, and preserves ordinary discounts and demand pricing. I would also bar raising the price of a necessity because a system inferred that the person is desperate or has no alternative. The statute has to define "necessity" and "inferred vulnerability" tightly so that ordinary discounts and loyalty pricing stay legal.

In practice, the disclosure appears where the price is shown, before the person commits, and says that their own data shaped the number. A seat that costs more because demand rose is ordinary dynamic pricing and stays legal. As a hypothetical - not a reported case - a price for a refill of an essential medication that rises because the system inferred urgency from the person's searches would cross the line; the FTC's surveillance-pricing work uses similar illustrations ^[4]. I would start the necessity list with food, housing, utilities and essential medication, and Congress would finish it. The definition of inferred vulnerability should err toward covering the clear cases rather than the edge ones.

03Enforcement

The FTC and state attorneys general can enforce, with real penalty authority and the resources to use it. But public enforcement will not reach most individual harms, and an agency fine does not repay a person who lost money, a job or a home. People need to be able to bring their own claims, and I think plaintiffs' attorneys should have a role in enforcing these rights. Consumer litigation is not frivolous by nature. It is how rights become real.

On what a person can recover: actual damages and attorney's fees for plaintiffs who win are the floor. Statutory damages set an amount by law, which helps when harm is real but hard to price, such as being denied an explanation. A compromise I could support is actual damages, attorney's fees and a modest statutory minimum for violations that are hard to price, awarded once per person per decision. The final mix belongs to the negotiation between consumer groups and business groups. The test is that the rights stay strong enough to enforce.

The working pieces: concurrent authority for the FTC and state attorneys general, so a pattern in one state can be answered nationally and vice versa; penalties scaled to the company's size and the number of people affected. Fee-shifting is what makes a denied explanation worth a lawyer's time on a small claim. For private claims, the statute sets the injury, the proof and the recovery, and the open questions at the end list what drafters still have to settle.

04Agents that work for individuals

The central idea is that an agent should give an individual more power, not more exposure. A person should be able to send an AI agent to shop, compare prices, manage subscriptions, cancel what they no longer want and book travel, the way they could hire a human assistant.

The Ninth Circuit's August 2026 decision in Amazon v. Perplexity shows how little the law settles today ^[5]. Perplexity's Comet browser runs an AI assistant at the user's direction; Amazon barred its AI products from the Amazon store, in a dispute over whether the assistant identified itself as an agent, and sued under federal and California computer fraud law. The Ninth Circuit vacated the preliminary injunction, holding that Amazon was unlikely to show Perplexity "accessed" its computers, because on this record the user accessed Amazon through the assistant as a tool.

The court stressed the holding is narrow: it creates no new regime for agentic AI, does not reach other claims such as tort, and leaves Amazon free to restrict access through its terms of service ^[5]. Rehearing was denied September 10, 2026 ^[6]. So today's answer turns on a narrow computer-crime theory, one browser's facts, and each company's contract terms.

Congress should settle the question directly. My proposal has two parts.

The individual's right. A person may authorize an agent to act on the person's own accounts, within the person's own entitlements, for ordinary consumer tasks. A website's terms cannot bar that use altogether. The authorization is specific and revocable, and the agent acts only for the person who gave it.

The company's protections. Companies can require that agents identify themselves, using a standard signal of the kind the Amazon dispute turned on. They can rate-limit, require extra verification for payments and account changes, block abusive or insecure agents, and pursue fraud. And they can block other companies. A business that uses automation to harvest another company's catalog, prices or customer data for its own commercial use is not an individual acting through an agent, and the statute should not give it the individual's right. The right belongs to people, not to automation providers.

The hard part is telling security from pretext. A site should not be able to deny every consumer-authorized agent in the name of security while favoring its own agent. The statute should require that blocking be proportionate and tied to a real security or abuse concern, and should treat a blanket refusal that serves only the site's own shopping or assistant product as presumptively unfair. This keeps the playing field level between the individual and the large platform, and it keeps the platform's security tools intact.

It also depends on the agent identity and delegation rules in Part two. Senator Warner's AI AGENT Act, introduced in July 2026 as S. 5051, covers similar ground, including certification and access machinery, though its platform coverage differs ^[7]; Kapoor, Kolt and Lazar argue for user-controlled agent advocates and against platform foreclosure ^[8]. The Ninth Circuit did not establish this affirmative statutory access right ^[5].

Operationally, the authorization works like a power of attorney with technical limits: it names the agent, the accounts and the tasks; it expires; and the person can revoke it at any time, effective immediately. The agent carries the verifiable identity and delegation proof from Part two, so a site can tell a person's agent from an impostor and honor the first while blocking the second. When a site blocks an agent that followed the rules, the person or the agent's provider can challenge the block as disproportionate, and a block that serves only the site's own shopping or assistant product is evidence against it.

05Professional services

Today a person with a legal, medical or other professional question often cannot get access to a professional at all, because of cost, location or time. AI could change that. This statute can help in a specific way, and it should be clear about what it does not do.

In the United States, professional licensing is mostly a matter of state law. Medical licensing, for example, runs through state medical boards; the FSMB's 2024 policy report describes boards' oversight as focused on licensed physicians, not the tools they use ^[9]. A federal AI statute does not license anyone and should not authorize unlicensed practice. What it can do is set a national baseline: AI systems must not present themselves as licensed professionals, and must disclose that they are AI, keep records of consequential outputs and carry the developer and deployer responsibilities above. Pennsylvania's lawsuit against Character.AI, concerning allegations that chatbots misrepresented themselves as licensed physicians, shows why that baseline is needed ^[10].

I want Congress to go beyond that accountability baseline. My proposal is that Congress make it a national mandate for the regulators and state authorities that govern traditionally licensed professions to democratize access. A mandate that orders state licensing bodies to act runs into the anticommandeering problem described in the bridge section, so the mechanism is for Congress to design within those limits. Start with simple uses that do not need a human supervisor and that clearly widen access, and work toward more complex ones over time. I believe AI services without a human supervisor will come to play a role in law, medicine and other licensed fields once the framework is in place, and that this could widen access to professional help in a way that has not been possible before.

This is a proposal, not current law. How far Congress can direct state authorities is for the drafters and the courts.

What the mandate would mean in practice: each profession's regulators identify the tasks an AI system can do without a human supervisor, and set the conditions. Anything beyond those tasks still routes to a licensed human. The federal statute supplies the floor: disclosure that the system is AI, records of consequential outputs, and the responsibility split from the first section. The point is that a person who cannot reach a lawyer or a doctor today gets real help sooner, with the profession's own rules deciding where the line sits.

This is separate from the business measures in this statute. Those make companies faster. This one is about access for individuals, and it should be argued on its own terms.

06The carveouts for business

A framework that burdens every company the same way will get killed or ignored. The statute draws four boundaries, and each is described below: ordinary assistance tools, a safe harbor for good practice, small business, and contracts between businesses. Two limits apply to all four. No carveout removes a right that belongs to an individual, and none repeals existing law on discrimination, fraud and consumer protection.

07Ordinary assistance

Tools that polish a memo, schedule a meeting or summarize a document sit outside heightened duties when they do not materially shape a consequential decision about a person. Companies would keep a short record of the tool's function and limits so that regulators and affected people can check the classification.

Actual use governs. A summarizer used for a reader's convenience is ordinary assistance; one that selects the evidence a hiring manager sees may materially shape the decision and trigger all six rights. Calling a system an assistant cannot exempt it. Congress and regulators would resolve boundary cases, including candidate rankings presented as suggestions.

The record is short: what the tool does, what it does not do, and where its output goes. If a tool's output starts feeding a consequential decision, the duty follows the use, not the label the vendor gave it.

08The safe harbor

The safe harbor rewards companies that build to a recognized standard before harm occurs.

What earns it. A developer or deployer qualifies when it conforms to a version of the private framework in Part two that the statute recognizes and that was current at the time of deployment. It must have independent attestation of that conformance, with a simpler attestation allowed for small businesses. It must keep the required records, update within a set period after a new version is issued, and report serious incidents.

What it gives. A rebuttable presumption that the company exercised reasonable care, in claims where reasonable care or reasonable security is the standard. In public enforcement, conformance counts toward a lower penalty. Texas's AI law, effective January 1, 2026, is a narrower precedent. In an attorney general action for a civil penalty, it presumes a person used reasonable care, and it provides that a defendant may not be found liable if it discovers a violation through listed routes, one of which is an internal review process while substantially complying with the NIST generative AI profile or another recognized framework ^[11]. It is not a general immunity for compliance. What I describe here is broader and is my proposal, not current law.

What it cannot excuse. It does not remove any right in this statute. A person can still demand notice, reasons, correction and reconsideration, and can still bring a claim to enforce those rights. It does not cover intentional violations, a known defect the company has not fixed, or use outside the system's documented scope. Discrimination, fraud and consumer protection law apply as usual.

Why create it. A recognized standard gives businesses a target before a dispute and courts a benchmark afterward. Independent conformance earns a rebuttable presumption of reasonable care, not immunity. Smaller firms can adopt that standard instead of developing their own compliance system. The architecture has precedent: the Obama administration's 2012 Consumer Privacy Bill of Rights paired individual rights with enforceable codes of conduct ^[12], and Marchant and Buckwald have proposed liability protection tied to standards compliance ^[13]; COPPA's approved safe-harbor programs ^[14] and Ohio's framework-based cybersecurity defense ^[15] are narrower relatives. The presumption proposed here is limited and rebuttable, and the individual rights remain.

How rebuttal works. The company shows current attestation to a recognized version, and the burden shifts to the person bringing the claim to show the company departed from the standard, ignored a known defect or used the system outside its documented scope. The presumption rewards what the company actually did, not the certificate on the wall. The claimant may also rebut the presumption by showing that the company's conduct was unreasonable under the circumstances despite formal conformance.

The risks. A checklist can become a substitute for judgment, and a standard can be captured by the companies it governs. That is why the presumption can be rebutted, the standard has open membership, consumer and security seats and scheduled review as conditions of recognition (Part two), and the safe harbor stops at the limits above.

09Small business

My parents have a small business, and I want small businesses to be free to experiment with AI agents and put AI to work without a compliance department. In a small business, the owners, who are the equity holders, are close to the customers and answer for the product themselves. In a large enterprise, including a large private-equity-backed company, ownership is remote from the customer, and the gap in resources and AI capability between the enterprise and an individual consumer is far wider. The statute should reflect that difference in power.

Federal disability-access law and its tax incentives offer three useful models. Title I covers employers with 15 or more employees ^[16]. Within Title III, the duty to remove existing architectural barriers applies only where that is "readily achievable," meaning easily accomplishable without much difficulty or expense, which scales that duty to the business ^[17]. And the Disabled Access Credit, a separate tax provision (IRC section 44), helps eligible small businesses pay for access, with eligibility for businesses with gross receipts of $1 million or less or no more than 30 full-time employees in the preceding taxable year ^[18]. A threshold, an effort-scaled standard and an incentive.

I would borrow all three:

• A size threshold. Small deployers are outside the heightened duties: no required risk-management program, documentation package, audit or conformance filing. The test uses headcount, revenue or both, and Congress would set the numbers. The ADA's 15 employees and the credit's 30 employees or $1 million are reference points, and the SBA's own size standards, which vary by industry in employees or annual receipts, show that one number will not fit every sector ^[19]. Where to set them is a policy choice, and it should be tested against real business data. Similar support appears in the March 2026 White House recommendations on AI grants and tax incentives ^[20], and the EU AI Act offers simplified compliance for smaller providers ^[21]; the design here keeps the same individual rights, simplifies specified duties, adds a scale-of-impact backstop and links support to the recognized framework.
• The same rights, with simpler compliance. Where a small business does make a consequential decision about a person, the person keeps all six rights: notice, principal reasons, actual reasons, correction, human reconsideration and no waiver by fine print. The compliance is simpler. A short notice, a standard-format statement of the actual principal reasons, and a named reviewer can meet them, without a program, filing or audit. The rights do not shrink with the size of the business, and only the paperwork does.
• An incentive. A tax credit or grant for small businesses that adopt the recognized private framework from Part two, so the standard becomes something small firms can afford to adopt.

What simpler compliance looks like: a short notice naming the system, a standard-format statement of the actual principal reasons, and a named reviewer with contact information that works. No risk-management program, no documentation package, no outside audit. A bakery using an agent to manage suppliers files nothing; if it ever makes a consequential decision about a person, that person still gets all six rights.

Two guardrails keep the carveout honest. Size alone should not exempt a tiny company whose system makes consequential decisions about large numbers of people, so the statute needs a scale-of-impact test alongside headcount. And a small business is still covered by existing laws on discrimination, fraud and consumer protection. The point is to keep the AI-specific burden off innovation and experimentation, not to repeal the rest of the law.

10Contracts between businesses

Between businesses, duties would be lighter: basic security, documentation and a clear split of responsibility, without consumer-style explanation rights. A statutory default for liability caps, exceptions and defense obligations would give smaller parties a baseline and reduce repeated negotiation. The schedule below sets it out.

Private forms already show the structure. Bonterms publishes standard cloud terms with a general cap equal to amounts paid or payable in the twelve months before the first incident giving rise to liability, a higher cap of three times that amount for security and data protection breaches, and some claims left uncapped ^[22]. Common Paper's 2026 benchmark of deals on its own form reports that 99 percent included a multiplier cap and 96 percent capped liability at one times fees ^[23][24]. These are optional forms and the benchmark covers one vendor's customers. They show what a default could look like, not that industry has converged or that a default shortens negotiations.

The European Commission's November 2025 draft model cloud-contract clauses address liability as optional terms ^[25]; the schedule here would apply by statute, with limits on variation.

The limit on this carveout is that it ends where an individual is on the receiving end. If a company buys a tool to rank job applicants, the applicants keep every right above, and the deployer owes them. A business contract cannot waive the rights of the person who was never at the table. The consumer rights above and public enforcement by the FTC and state attorneys general sit outside any cap or indemnity. Caps allocate risk between companies. They cannot limit a company's duty to an affected individual, delay payment of it, or waive any right in this statute. When a developer and deployer both contribute to a proven loss, the individual can recover from either, and the two companies settle the split afterward under their contract.

For comparison, the Uniform Commercial Code lets parties limit consequential damages but treats such a limit for personal injury from consumer goods as prima facie unconscionable, while a limit on commercial loss is not ^[26]. It is an analogy for the line I am drawing between consumers and businesses, not existing law for AI services.

11The default risk-allocation schedule

Government should not write a full services agreement. Technical standards stay with industry, as in Part two. Congress would enact a short risk-allocation schedule for the few terms that cause most of the fighting, developed through public comment with industry and consumer input and reviewed on a set schedule. The schedule below sets out recommended rules, not a description of universal current U.S. contract law. The statute would say:

• A default cap. Unless the parties agree otherwise in writing, each party's liability to the other is capped at the fees paid in the twelve months before the claim. This is my recommendation, and it differs from Bonterms, which counts amounts paid or payable before the first incident.
• Defined exceptions. For breaches of data security and privacy duties and for violations of the statute's AI duties, the cap is three times the general cap. Fraud, willful misconduct and gross negligence are uncapped, and parties cannot contract to cap them. The next provision addresses indemnity for third-party claims.
• Indemnities that follow control. The developer defends and indemnifies the deployer against third-party claims that the base system infringes IP or breaches the developer's statutory duties. The deployer does the same for claims arising from its own data, from configuration beyond the developer's documented limits, or from use outside the documented scope. The defending party controls the defense, and the other party must give prompt notice and cooperation.
• Variation within a floor. Parties can change the numbers. A term unilaterally imposed on a small business that departs sharply from the default gets closer review. The EU Data Act's Article 13 is a comparator for specified unilaterally imposed data-contract terms - for enterprises generally, not only small businesses ^[27].
• A presumption for adoption. A contract that uses the default without material change is presumed not unconscionable as to those terms. The presumption can be rebutted.

The cap amounts are my proposed defaults, drawn from the private forms above; a candidate could set them differently. The structure is the proposal: a default, defined exceptions and an indemnity rule tied to control. I recommend a default that parties can vary, not one mandatory template, because a template would misfit contracts as different as a small chatbot's and a hospital system's. The tradeoff is that the stronger party can contract around a default, which the floor and the closer review of one-sided terms are meant to narrow. A single mandatory template is a defensible alternative.

Two cautions. Contract law is mostly state law. Congress would be setting terms for a defined class of AI service contracts and would have to say which state rules it displaces, and whether that rests securely on its commerce power is a question for the drafters and the courts. And a statutory default can freeze today's market norms, which is why it needs scheduled review.

12Open design questions

Some questions belong to the bill's drafters rather than to this essay: how far the right to an agent reaches for sole proprietors and employees buying supplies, and how to separate a paid service acting at a user's direction from bulk extraction by another company; how long conformance records should be kept, with as little personal data as possible and rules for updating and revoking authorizations; the floor under the contract default, where a cap based on fees paid can shrink to zero in a free trial, and how indemnities, defense and settlement should work; which agency covers banking, insurance and other regulated areas, and whether the FTC would need new authority; how recovery splits when a developer and a deployer both contribute to a harm, with no double recovery; and how to define the injury that supports a private claim alongside public enforcement; where the small-business scale-of-impact test sits; and the limitations period for private claims, including when the clock starts.

Private damages claims in federal court remain subject to concrete-injury requirements, including TransUnion ^[28]; Congress should design disclosure rights and remedies with those requirements in mind. Congress and regulators would resolve them in the drafting and comment process.