Foresight-to-Duty Conversion Series Introduction: Meta Foresight-to-Duty Conversion Across Privacy, Child Safety and Scam Ads · Meta and Bank of America Foresight-to-Duty Conversion: Revenue-Funded Versus Cost-Funded Deferral · Consent Order Remedies at Meta, Boeing, Starling and Wells Fargo: Verified Correction Versus Recurrence
Related Works: Bank of America $1.2 Billion Money Laundering Penalty and the Compliance System That Knew Too Much · The Foresight-to-Duty Conversion — Measured Governance Debt Becomes Evidence When Institutions Keep the Gap They Found
Foundational Works: The Duty to Foresee, AI Deployment Readiness as Prospective Governance, and the Arrival of Agentic Duty of Care · AI Governance Equilibrium · Decision Modeling and Foresight Simulation
Executive Summary
Agents move the foreseeability question from the single act to the deployment. A deployer cannot predict each action its agents take, but it can inquire into the harm pathways its agents’ permissions and integrations open. Courts that reach foreseeability will ask what that inquiry would have revealed and which precautions it showed to work. Eight state suits against OpenAI reported in October 2026 and California’s new statute make the question immediate for deployment leaders, counsel and underwriters.
Thesis: A deployer’s duty of care for its agents turns on deployment-specific evidence and effective precautions. California barred the defense that “the AI autonomously caused the harm” from January 1, 2026, under Civil Code section 1714.46. The statute removes one argument and leaves the other elements of the claim to ordinary doctrine, including how responsibility is allocated among developers, modifiers and users. Foreseeability will decide much of that dispute, and insurers’ audits, conditions and exclusions add outside evidence and outside constraint.
What distinguishes the MindCast approach: Meta Foresight-to-Duty Conversion Across Privacy, Child Safety and Scam Ads showed that a finding matters only when it reaches someone who can fund the fix. Meta and Bank of America Foresight-to-Duty Conversion: Revenue-Funded Versus Cost-Funded Deferral examined how deferral persists once a gap is measured. Consent Order Remedies at Meta, Boeing, Starling and Wells Fargo — Verified Correction Versus Recurrence showed which remedies make correction hold.
All three installments covered institutions that measured a gap and kept it, while the present paper covers the case they left open: harm the deployer never measured. The Duty to Foresee: AI Deployment Readiness as Prospective Governance, and the Arrival of Agentic Duty of Care (2026) extended the Hand formula to agents. The present paper turns that formula into an assessment a deployer, an underwriter or a board can apply before a court does. With one actor, one act and no outside measurement, the assessment reduces to the classical reasonable-person inquiry.
MindCast AI applies Predictive Behavioral Economics + Dynamic Game Theory through MindCast AI Proprietary Cognitive Digital Twin Foresight Simulations (MP CDT FS). Behavioral Economics supplies the decision rules. Game Theory supplies the payoff structure. Predictive simulations emerge from the combination.
What the paper does: The paper shows what California’s statute removed and what it left to ordinary doctrine, then identifies the assumptions of classical foreseeability that agents break. The paper examines exposure at scale, the type-of-harm rule for emergent behavior and the reasonable-inquiry standard for constructive knowledge. Insurance follows as a source of information and constraint, including per-action coverage, and the paper examines the limits of strategic ignorance. The paper closes with the Agentic Foreseeability Assessment, four Simulation Predictions and a Risk Mitigation Layer.
Simulation Prediction highlights: The forecast set holds four MindCast Foresight Simulation Predictions: three primary and one secondary. Procedure more than doctrine decides whether courts reach foreseeability, because early resolution or a product-classification ruling can end a case first. When a court does reach the question, it frames foreseeability by type of harm rather than by the specific output (62-80% given a qualifying ruling). The lead entry is closely contested: a U.S. court rejects an AI-unpredictability defense to causation or foreseeability in a reasoned written ruling by December 31, 2028 (29-57%).
🏛️ Policymakers: Barring the autonomy defense removes one argument without telling deployers what to inquire into. Safe-harbor design decides whether the law rewards inquiry that leads to correction or inquiry that only produces files.
💼 Executives: The inventory of agent permissions and integrations is the starting map of foreseeable harm pathways. Each tool an agent can call adds pathways a reasonable inquiry should examine.
🤖 AI deployment leaders: Tested precautions and per-pathway measures of frequency, severity and reversibility form the evidence a court or underwriter will ask to see. One expected harm a year, meaning the per-action failure rate times annual action volume, marks a pathway for escalation rather than a legal threshold.
⚖️ Counsel: System cards, evaluations, underwriting questionnaires and policy exclusions are potential notice evidence. Their weight depends on content, receipt and fit with the deployment. A documented risk without a documented response is the gap a plaintiff will plead.
📊 Investors: An AI exclusion in an issuer’s insurance program marks exposure the market will not cover at current terms. Model it as retained exposure.
Across audiences the implication is the same. Foreseeability for agents rests on evidence a reasonable inquiry can produce, and much of that evidence already exists outside the firm.
I California Removed the Autonomy Defense and Left Responsibility to Ordinary Doctrine
Agency law already treats software as an instrument rather than an actor. The Restatement (Third) of Agency, section 1.04, comment e describes a computer program as an instrumentality of the person who uses it rather than a legal agent. The rule points responsibility toward the people and firms behind the program, without deciding which of them answers for a given harm.
Tribunals and courts have applied the same view to modern systems. A British Columbia tribunal in Moffatt v. Air Canada (2024) rejected the airline’s argument that its chatbot was a separate entity responsible for its own statements. The Ninth Circuit in Amazon.com Services v. Perplexity AI (August 4, 2026) called the Comet Assistant “a tool, not a person” and attributed its access to the user who directed it for purposes of computer-access statutes.
California then removed one defense by statute. Civil Code section 1714.46 bars any defendant who “developed, modified, or used” an AI system from arguing that the system autonomously caused the harm. The same statute preserves causation, foreseeability and comparative fault. Autonomy alone cannot excuse a defendant in California, while every ordinary element of the claim remains open.
The open elements include allocation. A developer, a fine-tuner, an integrator and an enterprise deployer may each fall within the statute’s reach for the same system. The statute does not say which of them owes what. Foreseeability will decide much of that allocation, because each party’s duty runs to the harms its own role made foreseeable.
Cardozo supplied the starting rule for allocation more than a century ago. In MacPherson v. Buick Motor Co. (1916), he held that a thing “reasonably certain to place life and limb in peril when negligently made” is “a thing of danger.” Where the maker also knows the thing will be used by persons other than the purchaser, the duty runs to those persons without a contract. For physical harm, a model developer that knows its system will reach deployers’ users stands where Buick stood, while each deployer answers for the permissions and integrations it adds.
Takeaway: California removed autonomy as an excuse, and ordinary doctrine now decides who answers and for what, with foreseeability doing much of the work.
II Classical Foreseeability Assumed One Actor, One Act and Costly Foresight
The leading foreseeability cases each judged a single act and a single plaintiff. In Palsgraf v. Long Island Railroad (1928), Judge Cardozo limited duty to plaintiffs within the zone of foreseeable danger from the conduct. The Privy Council in The Wagon Mound (No. 1) (1961) limited liability to damage of a foreseeable kind.
The House of Lords then separated the kind of harm from the way it happened. In Hughes v. Lord Advocate (1963), a boy was burned after an unattended paraffin lamp exploded in an unforeseeable way. The court held the defendant liable because burns were a foreseeable kind of harm, even though the explosion was not a foreseeable mechanism.
Breach followed a separate calculus. Judge Learned Hand in United States v. Carroll Towing Co. (1947) found negligence where the burden of precaution falls below the probability of harm times its magnitude. The Restatement (Third) of Tortslater disapproved of no-duty rulings based on foreseeability and addressed foreseeability chiefly under scope of liability. Section 29 limits liability to “those physical harms that result from the risks that made the actor’s conduct tortious.”
Holmes had already fixed the standard against which foresight is judged. Holmes wrote in The Common Law (1881) that “the law takes no account of the infinite varieties of temperament, intellect, and education.” Liability turns on “the average man, the man of ordinary intelligence and prudence” rather than on what a particular defendant happened to foresee. Agents extend the external standard one step further, from what a prudent person would imagine to what a reasonable inquiry would reveal.
Three assumptions run through the classical cases. Each case involves one actor making one decision, and foresight is costly because a reasonable person can only imagine what might go wrong. The plaintiff stands at a remove that the court must judge. Agents strain all three assumptions.
Takeaway: Classical foreseeability judged one person’s imagination about one act, while agents produce many acts and make inquiry into their risks practical.
III Scale Turns Rare Failures Into Recurring Exposure
Volume changes the exposure behind a fixed per-act risk. Suppose a harm pathway fails once in a million actions. A human clerk making 10,000 decisions a year expects one such failure every century.
An agent fleet executing 50 million actions a year expects 50 such failures annually. The per-action odds have not changed, yet the deployer now faces a recurring exposure rather than a remote one. The plaintiff harmed by an agent fleet belongs to a population the deployer can estimate in advance.
Expected counts measure exposure, and they guide escalation rather than settle the law. An expected count of one in a year still leaves about a 37% chance of no incident under independent rare events, and correlated failures across a shared model change the tail. Frequency also misses severity, so a rare catastrophic or irreversible pathway can warrant more precaution than a frequent minor one.
Game theory shows what a deployer gains from per-act framing. A firm that frames each harm as a single unforeseeable act keeps its expected sanction low, while a firm judged across the deployment faces the full expected exposure. Behavioral economics explains why the per-act frame persists inside firms: one-in-a-million reads as safe to a product owner, and 50 a year does not.
Takeaway: At agent scale, a rare per-action failure becomes a recurring deployment exposure that a reasonable inquiry should measure in frequency, severity and reversibility.
IV Emergent Behavior Defeats Prediction of the Act, Not Foresight of the Harm Type
Defendants will argue that agent behavior is emergent and therefore unforeseeable. The argument has force at the level of the specific act. No deployer can predict the exact sequence of tool calls an agent will chain together in a novel situation.
Hughes v. Lord Advocate answers the argument at the level of the harm type. A deployer need not foresee the explosion’s mechanism if it could foresee the burns. An agent with payment authority can cause financial loss by paths no one anticipated, and financial loss may still be the foreseeable kind of harm.
Permissions and integrations supply the starting inventory of harm pathways. Payment authority opens financial loss, and messaging authority opens misrepresentation and defamation. Code execution opens damage to systems and data, while companion conversation with minors opens self-harm risk. Quanyan Zhu’s “Insurance of Agentic AI” (2026) treats autonomy as a first-order rating variable and inventories external-state permissions for the same reason.
The inventory is a starting map, not a complete legal perimeter. Prompt injection, bypassed permissions and unanticipated tool chains can open contested pathways, and a category as broad as financial loss does not by itself establish foreseeability. Deployment-specific tests connect a category to a concrete pathway that a reasonable deployer should have examined.
Takeaway: Emergence makes the path unpredictable, but permissions and tests identify the kinds of harm a reasonable deployer should anticipate.
V Reasonable Inquiry Sets the Knowledge Baseline
Constructive knowledge asks what a defendant should have known. For a human actor, the answer depended on experience and imagination. For an agent deployer, the answer increasingly depends on what a reasonable inquiry into the deployment would have revealed.
Inquiry into agent behavior is now practical and routine. Developers publish system cards and technical reports, and deployers run red-team suites before release. Agent insurers run their own probes: Klaimee underwrites through a governance assessment and behavioral testing with more than 100 probes. The Duty to Foresee showed that falling simulation costs lower the burden of looking.
Plaintiffs already plead published evaluations as notice. Iowa’s October 2026 petition against OpenAI cites the GPT-4 Technical Report to allege that OpenAI understood since at least 2023 that the model “may generate undesirable content.” Iowa was one of eight states whose suits against OpenAI were reported in October 2026. Practitioners now advise that “a documented risk with no documented response is a failure-to-warn claim waiting to be filed”.
The baseline follows from the duty of reasonable inquiry. A deployer should be charged with what reasonably available, reliable and deployment-relevant inquiry would have shown about its harm pathways. A general model evaluation may not match a specific deployment, and the least expensive test may not be adequate for a severe harm. The Foresight-to-Duty Conversion: Measured Governance Debt Becomes Evidence When Institutions Keep the Gap They Found (2026) separated latent from measured debt, and reasonable inquiry narrows the gap between them.
Takeaway: Once inquiry is practical, the question shifts from what the deployer imagined to what a reasonable inquiry into its deployment would have revealed.
VI Insurers Supply Information and Constraint
Insurance gives deployers outside information about their risks and outside conditions on their conduct. An underwriter who writes agent cover has assessed the deployment and attached controls to it. An underwriter who excludes a category has identified exposure it will not take at current terms.
Both responses are now visible. Verisk’s Insurance Services Office (ISO) endorsements CG 40 47, CG 40 48 and CG 35 08 exclude generative AI injury and damage from commercial liability forms. Berkley introduced an absolute AI exclusion in 2025 across directors and officers, errors and omissions and fiduciary lines, according to the same Insurance Journal report. A Gallagher study cited there counted a 978% rise in AI-related lawsuits from 2021 to 2025.
Affirmative coverage is arriving alongside the exclusions. The Artificial Intelligence Underwriting Company (AIUC) raised a $15 million seed round in July 2025 to pair its AIUC-1 standard with independent audits and liability coverage, with pricing intended to reflect audit results. Thirty-seven authors in “Underwriting the Agent Economy: The Blueprint for an AI Insurance Stack” (2026) argue that affirmative AI coverage with limits in the billions is achievable by 2030 with industry-wide coordination.
Underwriting communications are potential notice evidence, not proof of foreseeability. An exclusion can reflect uncertainty, capital limits or accumulation across a shared model, and a premium blends frequency with severity and expense.
Omri Ben-Shahar and Kyle Logue’s “Outsourcing Regulation: How Insurance Reduces Moral Hazard” (2012) showed that insurers regulate through the conditions they attach to cover. Agent insurers apply those conditions to agent risk, so the underwriting file becomes part of what a reasonable inquiry would have revealed.
Takeaway: Insurers add outside evidence and outside conditions, and a deployer that receives either has more to answer for if it does not respond.
VII Per-Action Insurance Would Assess Risk at the Moment of Action
Per-action coverage would take underwriting to the single action: before an agent executes a consequential action, the deployment would request cover and receive terms or a decline. The response would be a third-party risk assessment issued at the moment the agent acts. The coverage described publicly by AIUC and Klaimee attaches at the policy level, and Zhu’s draft clauses condition cover on human confirmation for material transactions. Per-action cover would also need a workable action identity, carrier capacity, sound unit economics and a lawful binding route.
Each response would date an outside assessment of the action’s risk. Proceeding after a decline creates evidence like the 2022 test in Bank of America $1.2 Billion Money Laundering Penalty and the Compliance System That Knew Too Much, where one dated internal test became evidence of willfulness. The response protects the deployer only if it reaches a gate with power to stop the action. A gate supplies prevention without insurance, and insurance supplies compensation without prevention, so their value lies in the combination.
Takeaway: Per-action cover would make outside assessment contemporaneous, and its value depends on whether each response can stop the action it assesses.
VIII Strategic Ignorance Carries Its Own Risk, and Safe Harbors Must Reward Responded Findings
Measurement creates a perverse incentive. W. Kip Viscusi’s “Corporate Risk Analysis: A Reckless Act?” (2000) found that mock jurors punished firms that ran a risk analysis and declined a safety improvement. Sound analysis did not reduce punitive damages, and higher internal value-of-life figures raised awards by acting as an anchor. Behavioral economics names the mechanism: hindsight and anchoring turn a written trade-off into evidence of indifference.
A rational deployer might conclude that inquiring less is safer. Constructive knowledge limits that strategy, because a deployer can be charged with what a reasonable inquiry would have revealed. Willful blindness under Global-Tech Appliances v. SEB (2011) reaches further only where a defendant believes a fact is highly probable and acts deliberately to avoid learning it.
Texas has begun to reward inquiry instead. Texas’s Responsible Artificial Intelligence Governance Act (HB 149) shields a person who discovers a violation through testing or good-faith audits. The same act offers a safe harbor for substantial compliance with the National Institute of Standards and Technology (NIST) AI Risk Management Framework. California removes the autonomy defense, and Texas rewards the search for problems within its own act.
A safe harbor tied to testing alone repeats the failure Installment III documented. Firms test, file and defer, and the filing becomes the defense. A sound safe harbor attaches to findings that reached someone with power to gate the agent and that produced a response. Game theory predicts the difference: a testing safe harbor pays for documentation, while a responded-finding safe harbor pays for correction.
Takeaway: Inquiring less removes the evidence of care without removing constructive knowledge, so the policy choice is which kind of inquiry the law rewards.
IX Four Questions Turn Agentic Foreseeability Into a Deployment Decision
Pathways, inquiry, precautions and authority combine into one decision instrument: the Agentic Foreseeability Assessment. The assessment asks four questions about each harm pathway, using evidence the deployer holds or could reasonably obtain. Deployers, counsel and underwriters can apply it before a court applies its own doctrine.
Question 1 · Pathway: Which harm pathways do the agent’s permissions and integrations open, including through injection, bypass or tool chaining? Observable: the permission and integration inventory at the time of deployment.
Question 2 · Inquiry: What would reasonably available, reliable and deployment-relevant inquiry show about each pathway’s frequency, severity and reversibility? Observables include system cards, the deployer’s own evaluations, underwriting assessments and public incident data.
Question 3 · Precaution: Which available precautions reduce each pathway, and did the deployer adopt them? Observables include permission narrowing, confirmation gates, transaction caps and before-and-after tests of the same workflow.
Question 4 · Authority: Did each finding reach someone with power to fund a precaution, gate the permission or halt the deployment, and what response followed? Observables include approval chains, escalation logs and the response to each finding.
Expected counts enter at Question 2 as exposure measures, and one expected harm a year serves as a proposed escalation trigger. A responded finding is evidence of a reasonable response, though controls can still be ineffective or late. An unanswered or deferred finding is evidence a plaintiff will use to show breach.
The Supreme Court tested a fixed rule of care once and retreated. In Baltimore & Ohio Railroad v. Goodman (1927), Holmes held that a driver unsure of an approaching train “must stop and get out of his vehicle” because a clear standard “should be laid down once for all by the Courts.” Seven years later, Cardozo in Pokora v. Wabash Railway (1934) limited that rule and warned of “the need for caution in framing standards of behavior that amount to rules of law.” His reason applies to the expected-count trigger as well: “Standards of prudent conduct are declared at times by courts, but they are taken over from the facts of life.”
With one actor, one act and no outside measurement, the assessment collapses into the classical reasonable-person inquiry. The Agentic Hand Formula in The Duty to Foresee reduces to Learned Hand’s formula in the same way. Courts need not adopt any numerical threshold for the assessment to guide a deployment decision.
Takeaway: The Agentic Foreseeability Assessment turns a contested legal judgment into four observable questions about pathways, inquiry, precautions and authority.
X Three Explanations Compete for How Courts Will Treat Agent Harm
Three readings compete for how courts will decide agent cases. Each has its own falsifier, and the Simulation Predictions test them.
Hypothesis A · Per-act foreseeability persists: Courts ask whether the specific output or action was foreseeable, so emergent agent behavior often defeats liability. Falsifier: written rulings that frame foreseeability by type of harm, the outcome the secondary Simulation Prediction in Section XI forecasts.
Hypothesis B · Product classification decides the case: Courts treat AI systems as products, and the product-or-service question becomes the decisive threshold dispute. Falsifier: product-law rulings that turn on foreseeable-risk analysis rather than on classification.
Hypothesis C · Existing doctrine applied to deployment-specific evidence: Courts apply familiar duty, breach and scope rules to the deployment’s permissions, evaluations and available precautions. Foreseeability is framed by harm type. Falsifier: rulings that accept agent unpredictability as a superseding cause where tests had identified the harm type.
The Garcia v. Character Technologies court let design-defect claims proceed at the pleading stage in May 2025 and rejected the argument that the chatbot was a service. The parties agreed to resolve the claims in January 2026, subject to court approval. The Restatement (Third) of Torts: Products Liability, section 2(b) defines design defect by “foreseeable risks of harm,” so foreseeable-risk questions persist inside product law even where classification is decisive.
The forecast rests on Hypothesis C, with Hypothesis B as the most likely procedural route. Early resolution or a product-classification ruling can keep a court from reaching foreseeability at all, which keeps P-2’s band below even odds.
Takeaway: When courts reach foreseeability, the harm type and the deployment’s own evidence decide it, but procedure often decides whether they reach it.
XI MindCast Simulation Predictions
Holmes defined law in “The Path of the Law” (1897) as “the prophecies of what the courts will do in fact.” The Simulation Predictions below apply that definition to the questions this paper raises.
The forecast set holds four Simulation Predictions: three Primary Simulation Predictions (P) and one Secondary Simulation Prediction (S). The secondary entry is conditional and prints as P(A given B). No Simulation Prediction in the series has yet reached its deadline, so the series shows no resolved entries.
P-1 · A second U.S. state enacts a statute barring defendants from arguing that an AI system autonomously caused the harm by December 31, 2028 (33-60%)
A statute limited to one sector counts. Falsifier: no second enactment by the deadline.
P-2 · A U.S. court in a reasoned written ruling rejects at least in part an argument that an AI system’s unpredictable output was a superseding cause or made the harm unforeseeable by December 31, 2028 (29-57%)
Pleading-stage rulings count, and a bare order without reasons does not. Falsifier: no such ruling, or rulings that accept the argument.
P-3 · A U.S. court relies in its reasoning on a defendant’s own system card or model card (or its technical report or pre-deployment evaluation) as evidence that a harm was foreseeable or known by December 31, 2028 (22-44%)
Recital of a complaint’s allegations does not count, and neither do complaints or petitions. Falsifier: no such reliance by the deadline.
S-1 · Given a P-2 ruling, the court frames foreseeability by type of harm rather than by the specific output (62-80% given P-2)
The first qualifying P-2 ruling governs, and no P-2 ruling leaves the entry unresolved. Falsifier: the ruling requires foresight of the specific output or action.
The four entries test the paper’s mechanisms in court and in legislatures. P-1 tests how legislatures extend California’s rule. P-2 and S-1 test the type-of-harm rule, and P-3 tests the reasonable-inquiry baseline.
P-3 differs from an earlier forecast in The Foresight-to-Duty Conversion. The earlier forecast expects an enforcement action to cite a deployer’s own evaluation documents by December 31, 2028 (58-70%). The earlier entry counts filings by enforcers, while P-3 requires a court to rely on the documents in its own reasoning.
Three questions remain open hypotheses without bands. The first is whether an insurer or payments network offers per-action agent coverage by 2028. The second is whether a state limits the use of AI safety evaluations as evidence, a competing policy response to strategic ignorance. The third is whether a court treats an insurer’s terms or exclusion as notice, which no ruling has yet addressed.
Takeaway: The forecasts test whether courts and legislatures converge on harm-type foreseeability, while the insurance and privilege questions stay open until evidence arrives.
XII Risk Mitigation Layer
Each entry below states exposure in a unit the stakeholder controls, with severity and probability stated separately. Actions are unilateral, and each names an owner and a deadline tied to the forecast checkpoints.
AI deployment leaders · P-2 (29-57%), S-1 (62-80% given P-2): Severity: high. Exposure: every pathway without a documented inquiry becomes an unanswered harm type in discovery, counted per release.
Action 1: map each granted permission and integration to the harm pathways it opens. Owner: head of AI platform. Deadline: the next production release or June 30, 2027, whichever comes first.
Action 2: measure frequency, severity and reversibility per pathway through deployment-specific tests, and test precautions before and after on the same workflow. Owner: model risk management. Deadline: December 31, 2027.
Action 3: route each pathway above one expected harm a year to the owner with authority to revoke the permission. Route severe or irreversible pathways the same way at any frequency. Owner: chief risk officer. Deadline: each release.
Residual: pathways outside the mapped inventory remain a scope question decided after the harm.
General counsel · P-3 (22-44%): Severity: high. Exposure: the evaluation archive becomes the discovery scope for knowledge, measured in documents per harm pathway.
Action 1: reconcile each published system card claim with observed production behavior. Owner: AI governance counsel. Deadline: each model or agent release.
Action 2: attach a documented response to each documented risk. Owner: product counsel. Deadline: before each release.
Action 3: keep evaluation files under the existing retention policy, because pruning them creates spoliation exposure. Owner: the litigation hold function. Deadline: continuous.
Residual: earlier cards and evaluations remain dated notice for the period before correction.
Insurers and underwriters · P-3 (22-44%): Severity: moderate. Exposure: a ruling that relies on a defendant’s own evaluation documents raises claim severity on unendorsed legacy forms, measured in loss-ratio basis points on affected lines.
Action 1: write per-pathway terms conditioned on a gate that can stop the action. Owner: the product lead. Deadline: the 2028 renewal cycle, ahead of the P-3 deadline.
Action 2: require evidence that assessment findings reach a gating authority as a coverage condition. Owner: underwriting. Deadline: each new placement.
Residual: correlated losses across deployers sharing one foundation model remain outside any single insured’s controls.
State legislators and attorneys general · P-1 (33-60%): Severity: moderate. Exposure: a bar on the autonomy defense without a responded-finding safe harbor pushes deployers toward inquiring less, measured in legislative sessions of drift.
Action 1: pair any autonomy-defense bar with a safe harbor conditioned on findings that reached a gating authority and produced a response. Owner: judiciary committee counsel. Deadline: the 2027 session.
Action 2: confine any evaluation privilege to the evaluative process and leave the underlying facts discoverable. Owner: judiciary committee counsel. Deadline: before committee markup.
Residual: federal preemption litigation under the December 2025 executive order can delay any state enactment.
Boards · P-2 (29-57%): Severity: high. Exposure: oversight claims reach directors when material harm pathways never reached the board, measured in reporting cycles without a pathway report.
Action 1: require a quarterly report of harm pathways with frequency, severity and routing. Owner: the risk committee chair. Deadline: the first quarter of 2027.
Action 2: confirm that each escalated pathway has a named owner with authority to gate it. Owner: the audit committee. Deadline: each quarter.
Residual: a report the board receives dates the board’s knowledge, so each report must arrive with a response.
Investors · P-3 (22-44%): Severity: moderate. Exposure: AI exclusions in an issuer’s insurance program leave known exposure uninsured, measured as retained loss in valuation models.
Action 1: treat disclosed AI exclusions as retained exposure in models. Owner: the covering analyst. Deadline: the next valuation update.
Action 2: request harm-pathway inventories and gating authority in stewardship engagement. Owner: the stewardship lead. Deadline: before the 2027 proxy season.
Residual: issuers can disclose inventories without disclosing rates, which leaves the size of the exposure open.
The actions share one direction. Each converts a harm pathway into a measured pathway with a tested precaution and someone who can stop it. Placing these entries as one standalone section keeps the paper readable, at the cost of separating each entry from the prediction it addresses.
Takeaway: Mitigation for agentic foreseeability means inquiring into the pathways permissions open, testing the precautions that reduce them and giving each finding a gate.
Conclusion
California’s statute removed autonomy as an excuse and left foreseeability among the ordinary elements still in play. The contest no longer turns on what a reasonable person could imagine. Foreseeability now turns on what a reasonable inquiry into the deployment would have revealed and which precautions it showed to work.
Insurers supply part of that evidence through audits, conditions and exclusions. Per-action coverage would bring outside assessment to the moment each agent acts. P-2 tests whether a court reaches that question and rejects the unpredictability defense.
The series now runs from measurement to inquiry. Installments I through III showed what happens when an institution knows and defers. Installment IV shows what a deployer is expected to find out when it never looked.
What to Watch
The first checkpoint falls on June 30, 2027. Later checkpoints fall on December 31 of 2027 and 2028. The dominant fork is the first reasoned ruling on causation in the coordinated ChatGPT product liability cases in San Francisco, or an early resolution that forecloses it.
Each signal maps to an entry. The 2027 legislative sessions move P-1. The first qualifying ruling rejecting the specified unpredictability argument resolves P-2 and activates S-1. Other causation rulings inform monitoring but do not resolve the entry.
The first ruling that relies on a defendant’s own evaluation documents resolves P-3. A per-action insurance product would supply the first evidence on the open insurance hypotheses.
European Union member states must transpose the revised Product Liability Directive by December 9, 2026. The directive brings software into scope and presumes defect where damage follows an obvious malfunction during “reasonably foreseeable use.”
Working With MindCast
Published analysis can state the assessment and map the doctrine. Published analysis cannot tell a specific deployer which harm pathways its permissions open or which precautions work in its own workflows. Nor can it show which assessments the deployer’s insurer and vendors already hold. The series introduction sets out where the answers sit: permission inventories, evaluation archives, underwriting files and approval chains.
MindCast builds Cognitive Digital Twins (CDTs) of the deployer, its insurer, its regulators and the courts that will hear its cases. The model runs the Agentic Foreseeability Assessment against the deployer’s actual permissions and reruns the litigation and underwriting environment against its options.
For the question this installment asks, the engagement is a deployment-specific foreseeability assessment for AI deployment leaders, general counsel and boards. The assessment inventories harm pathways tied to actual permissions and integrations and tests the reasonably available precautions. The assessment also maps each finding to the authority that can act on it and models residual loss and insurer response.
The benchmark compares the same agent and workflow before and after safeguards under the same task and threat conditions. The comparison reports severity, reversibility, detection time and intervention success alongside frequency. The output shows which authorized actions should proceed, which need confirmation and which should stay blocked, with the reasons.
Insurers can commission the same model as an underwriting simulation, and legislative staff can commission it to test a safe-harbor draft before markup. Decision Modeling and Foresight Simulation describes the method, and AI Governance Equilibrium supplies the review-capacity measures the assessment uses.
Commissioned work delivers three outputs. The first is a harm-pathway map with tested precautions and routing status. The second is a set of exposure scenarios with low, median and high cases. The third is a set of monitoring thresholds keyed to P-1, P-2 and P-3.
MindCast offers a complimentary pilot built from public filings and backtested on a known case before any retainer. No engagement proceeds without a named decision to resolve. Contact mcai@mindcast-ai.com or visit www.mindcast-ai-simulation.com to schedule the diagnostic session.
Sources
MindCast Works
Foresight-to-Duty Conversion in AI Governance, Series Introduction. Sets the series question and the commissioning offer that Installment IV extends to unmeasured harm.
Meta Foresight-to-Duty Conversion Across Privacy, Child Safety and Scam Ads. Shows why a finding must reach an authority that can fund the fix, the authority question in the assessment.
Meta and Bank of America Foresight-to-Duty Conversion: Revenue-Funded Versus Cost-Funded Deferral. Examines why deferral persists once a gap is measured, the payoff structure behind resistance to fleet-level framing.
Consent Order Remedies at Meta, Boeing, Starling and Wells Fargo — Verified Correction Versus Recurrence. Shows why testing-only safe harbors produce documentation rather than correction.
The Foresight-to-Duty Conversion: Measured Governance Debt Becomes Evidence When Institutions Keep the Gap They Found. Separates latent from measured debt, the gap the reasonable-inquiry baseline narrows.
The Duty to Foresee: AI Deployment Readiness as Prospective Governance, and the Arrival of Agentic Duty of Care. Supplies the Agentic Hand Formula that the assessment turns into a decision instrument.
Bank of America $1.2 Billion Money Laundering Penalty and the Compliance System That Knew Too Much. Shows how a dated internal test becomes evidence of knowledge, the model for a declined per-action response.
AI Governance Equilibrium. Supplies the review-capacity measures behind the authority question.
Decision Modeling and Foresight Simulation. Describes the simulation method behind the forecasts.
Primary Sources
California Civil Code section 1714.46 (AB 316, Chapter 672, Statutes of 2025). Bars the autonomy defense and preserves causation, foreseeability and comparative fault.
Moffatt v. Air Canada, 2024 BCCRT 149. Rejects a chatbot-as-separate-entity defense.
Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011). Sets the two-part willful blindness standard.
State of Iowa ex rel. Bird v. OpenAI, petition (Polk County, October 2026). Pleads a developer’s own technical report as notice.
Palsgraf v. Long Island Railroad Co., 248 N.Y. 339 (1928). Limits duty to the foreseeable plaintiff.
Overseas Tankship (UK) Ltd v. Morts Dock and Engineering Co. (The Wagon Mound No. 1) (1961). Limits liability to damage of a foreseeable kind.
Hughes v. Lord Advocate (1963). Separates the foreseeable kind of harm from its unforeseeable mechanism.
United States v. Carroll Towing Co., 159 F.2d 169 (2d Cir. 1947). Supplies the burden-probability-loss test for breach.
MacPherson v. Buick Motor Co., 217 N.Y. 382 (1916). Extends a maker’s duty to foreseeable users beyond the purchaser.
Baltimore & Ohio Railroad Co. v. Goodman, 275 U.S. 66 (1927). Holmes’s fixed stop-and-look rule of care.
Pokora v. Wabash Railway Co., 292 U.S. 98 (1934). Cardozo’s limitation of the Goodman rule in favor of standards drawn from the facts.
Secondary Sources
Oliver Wendell Holmes Jr., The Common Law (1881), excerpted in Tobia, Torts (2022). Sets the external reasonable-person standard.
Oliver Wendell Holmes Jr., The Path of the Law, 10 Harvard Law Review 457 (1897). Defines law as prediction of what courts will do.
W. Kip Viscusi, Corporate Risk Analysis: A Reckless Act?, 52 Stanford Law Review 547 (2000). Shows jurors penalize firms that analyze risk and decline a fix.
Omri Ben-Shahar and Kyle D. Logue, Outsourcing Regulation: How Insurance Reduces Moral Hazard, 111 Michigan Law Review 197 (2012). Shows insurers regulate through the conditions they attach to cover.
Noam Kolt, Governing AI Agents, Notre Dame Law Review (forthcoming), quoting Restatement (Third) of Agency section 1.04 comment e. Supplies the instrumentality rule for software.
Cristian Trout et al., Underwriting the Agent Economy: The Blueprint for an AI Insurance Stack (2026). Sets out the infrastructure affirmative agent coverage requires.
Quanyan Zhu, Insurance of Agentic AI (2026). Treats autonomy and permissions as rating variables.
Don Jergler, Insurer Interest in AI Coverage Exclusions Growing as Risk Becomes Omnipresent, Insurance Journal (2026). Reports the ISO generative AI exclusions, Berkley’s exclusion and the Gallagher lawsuit count.
Fortune report on AIUC’s $15 million seed round, Fortune (July 23, 2025). Reports AIUC’s audit-and-coverage model.
Klaimee company profile, Y Combinator (2026). Describes Klaimee’s assessment-based underwriting.
Robert Botkin, Sarah Hutchins and Susie Lloyd, Show Me Your System Cards: AI Risk and What Companies Should Know, Business Law Today (2026). Treats system cards as notice evidence.
Ninth Circuit Vacates Injunction Against Perplexity’s AI Shopping Agent, Pearl Cohen (2026). Reports the Ninth Circuit’s tool-not-person holding.
California Eliminates the Autonomous AI Defense: What AB 316 Means for AI Deployers, Mondaq (2026). Summarizes the statute’s reach and preserved defenses.
TRAIGA: Key Provisions of Texas’ New Artificial Intelligence Governance Act, Greenberg Traurig (2025). Describes Texas’s testing and framework safe harbors.
A New Way of Looking at Duty and Causation, Day on Torts, on Restatement (Third) of Torts sections 7 and 29. Explains the move of foreseeability toward scope of liability.
Alternative Approaches to Alternative Design, Bradley (2014), on Restatement (Third) of Torts: Products Liability section 2(b). Supplies the foreseeable-risk language in design defect.
In Lawsuit Over Teen’s Death, Judge Rejects Arguments That AI Chatbots Have Free Speech Rights, WUFT (May 23, 2025). Reports the May 2025 Garcia ruling.
Section 230 Immunity for AI Chatbot Lawsuits, Moody’s (2026), on Garcia v. Character Technologies. Reports Garcia’s product treatment.
OpenAI Faces Suits for Harming Kids in Iowa, Kansas, Nebraska, West Virginia, Canadian Lawyer (2026). Reports the eight state suits against OpenAI.
California Court Decision on AI Products Liability Litigation, National Law Review (2026), on In re ChatGPT Product Liability Cases, JCCP No. 5431. Describes the coordinated ChatGPT cases.
Google and Chatbot Maker Character Settle Lawsuit, Associated Press via The Gleaner (January 9, 2026). Reports the January 2026 Character.AI resolution.
EU Member States Begin Rolling Out New Product Liability Rules, Covington Inside Privacy (2026). Reports the EU directive’s software scope and presumptions.
President Trump Signs Executive Order Challenging State AI Laws, Paul Hastings (2025). Describes the federal preemption executive order.
