# CompanyScope: AI governance for the agent era > Michael K. Onyekwere is the lawyer who answers who carries the liability when an AI agent causes harm: a common law qualified lawyer and CIPP/E practising as a Data Protection Officer, and the author of the AI Agent Incident Register. The flagship is the AI Agent Incident Register: a numbered public corpus in which significant public AI agent failures are analysed legally, covering the duty engaged, the liability across the chain, the governance that would have prevented it, and mapped controls (EU AI Act, OWASP, IMDA, NIST AI RMF). Each entry is assigned a liability locus, deployer, shared, vendor or target, the per-incident allocation of who most likely carries the legal exposure. Free to read and cite. ## AI Agent Incident Register (flagship) - [Register index](https://companyscope.io/register): all live entries, newest first. - [Who is liable when an AI agent causes harm?](https://companyscope.io/register/who-is-liable-when-an-ai-agent-causes-harm): the canonical answer, measured from the live corpus: how many analysed incidents were deployer-carried, vendor-borne or shared across the chain, with the decided cases behind each answer and the statutory position on the autonomy defence. - [AI agent incidents: who was told, and when](https://companyscope.io/register/ai-agent-incident-disclosure-timelines): for the nine incidents in the Register in which an AI agent run by the company that built or tested it reached a third party in 2026, the dates it happened, the responsible party found out, the victim and any regulator were told, and it went public, each from the primary source, checked against the notification rules in California, New York, the GDPR, the EU AI Act and Australia. Machine-readable: [JSON](https://companyscope.io/api/disclosure-timelines), CC BY 4.0. - [Machine-readable feed](https://companyscope.io/api/register): the full live corpus as JSON, the canonical enumeration of entries for tools and models. - [Failure modes](https://companyscope.io/register/failure-modes): a legal taxonomy of how AI agents fail and who bears liability for each. - [Methodology](https://companyscope.io/register/methodology): how entries are researched, written, reviewed, and cited. - [The AI Agent Liability Crosswalk](https://companyscope.io/register/liability-crosswalk): a cross-walk mapping OWASP's Top 10 for Agentic Applications, the NIST AI RMF, Singapore's IMDA agentic framework, and the EU AI Act to each other, with a legal-liability layer: who most likely carries liability per failure mode, with worked examples from the Register. The four-way mapping and the liability layer are this register's reading, not an official crosswalk from any of the four bodies. ## AI Vendor Data Protection Files - [Files index](https://companyscope.io/files): dated, primary-sourced records of what each AI vendor's own legal documents say about data protection. Each answer is a verbatim quotation with its source URL, the date the page was read, and, where the document prints one, its effective date. Where the published documents do not settle a question, the File records that rather than filling the gap. It is the primary-source evidence layer beneath the vendor compliance profiles. - [The Claude Team Data Protection File](https://companyscope.io/files/claude-team): what Anthropic's own Commercial Terms, DPA, Service Specific Terms and privacy-centre articles say about data protection for Claude Team, covering training, retention, subprocessors, transfers, breach notice, and the documented gaps. Machine-readable: [JSON](https://companyscope.io/api/files/claude-team), CC BY 4.0. - [The ChatGPT Business Data Protection File](https://companyscope.io/files/chatgpt-business): what OpenAI's own Business Terms, DPA, enterprise-privacy FAQ and privacy policy say about data protection for ChatGPT Business, covering training, retention, subprocessors, transfers, breach notice, the UK counterparty and governing-law split, and the documented gaps. Machine-readable: [JSON](https://companyscope.io/api/files/chatgpt-business), CC BY 4.0. ## Supporting research - [Vendor compliance profiles](https://companyscope.io/vendors): DPA, subprocessors, training position, EU/UK transfers, and AI Act posture for OpenAI, Anthropic, Microsoft 365 Copilot, Google Gemini, Perplexity, and ElevenLabs. - [Before a UK firm switches on Meta Business Agent](https://companyscope.io/vendors/meta-business-agent): six due-diligence questions for a UK business, drawn from Meta's Business Agents terms and Addendum, the Meta Global Processor Terms they incorporate, the WhatsApp help centre and section 164A of the Data Protection Act 2018, checked 15 October 2026. - [Topic guides](https://companyscope.io/topics): DPA, EU AI Act, and HIPAA reference reading for AI procurement. - [Vendor comparisons](https://companyscope.io/compare): head-to-head compliance reads. ## About - [About Michael K. Onyekwere](https://companyscope.io/about): credentials and the practice behind the research. ## How to cite Free to read and cite. Cite a Register entry author first, by its ID and URL, for example: Onyekwere, Michael K., AIR-2026-001, AI Agent Incident Register, CompanyScope, https://companyscope.io/register/air-2026-001. The corpus is also archived as a citable dataset with a DOI: Onyekwere, Michael K. (2026), AI Agent Incident Register, Zenodo, https://doi.org/10.5281/zenodo.21495425. Entry IDs are immutable; corrections publish as dated addenda rather than silent edits, so a cited entry stays stable. The AIR prefix is also used by an unrelated arXiv project, the Agent Incident Registry (2609.11030, September 2026). This register has used AIR-YYYY-NNN since June 2026, and an AIR identifier with a companyscope.io URL is this register's. The machine-readable feed (https://companyscope.io/api/register) is licensed CC BY 4.0: reuse the structured data with attribution to Michael K. Onyekwere, AI Agent Incident Register. The analysis is legal analysis of public facts, not legal advice.