Agentic AI and the reasonable duty of cybersecurity: The reasonableness paradox

Abstract

The proliferation of agentic AI poses various regulatory challenges. The reasonable duty of cybersecurity is a common law duty that was forged by courts to regulate the reasonable security measures expected of organisations. In this context, the main research question consists of examining the impact of agentic AI on the reasonable duty of cybersecurity. More specifically, the paper attempts to address the impact of agentic AI at both the threat management and risk management levels. Drawing mainly on U.S. law, the paper depicts a “reasonableness paradox” created by the complexity of new agentic AI architectures. On one hand, from a threat management perspective, the paper posits that agentic AI increases the legal threshold of reasonableness by broadening the attack surfaces introduced by complex agentic AI architectures. Consequently, the reasonable duty of cybersecurity should be assessed at a multi-layered level and construed by courts as a dynamic, non-static legal standard applied to the various technical layers composing the agentic AI architecture. On the other hand, from a risk management perspective, the open problems related to the foreseeability of risk pertaining to agentic AI undermine directly the judicial recognition of an independent common law duty of cybersecurity founded on a reasonably foreseeable risk of harm. This “reasonableness paradox” would in turn make more complex the traditional balancing of interests when courts are asked to assess the reasonableness of cybersecurity measures in the era of agentic AI.