AI Agent Incident Register
The AI Agent Liability Crosswalk
Four serious agent-governance frameworks now exist, each in its own vocabulary. OWASP's 2026 list speaks in security risks (ASI01–ASI10). NIST works in risk-management functions. Singapore's IMDA is organised around four governance dimensions. The EU AI Act sets legal obligations with dates attached. A team dealing with a real agent failure has to translate between all four to work out what they were supposed to have done.
This page maps them to each other on one axis, and adds the layer none of the four supplies: where the legal liability most likely falls when each failure mode fires, and which duty is engaged. OWASP tells you an agent's supply chain is a risk; it does not tell you that when the vendor's pipeline ships the poison, the vendor carries the primary exposure and the deployer's residual duty is the diligence of choosing and connecting it. That allocation is the work the AI Agent Incident Register does on every entry; this page does it per failure mode.
The liability column gives the register's modal allocation — who most likely carries it on facts like these. The linked entries show the full, hedged analysis on real facts, and where the facts push the allocation elsewhere the entry's own locus is shown beside it. This is legal analysis of public frameworks and incidents, not legal advice.
No standards body has published a mapping between OWASP's agentic Top 10 and the NIST AI RMF, the IMDA agentic framework, or the EU AI Act. NIST's own crosswalks predate the agentic list and map the AI Act only as its 2021 proposal; OWASP's published mappings stay inside the OWASP ecosystem. The four-way mapping here, and the liability layer, are this register's reading.
The cross-walk
Rows follow OWASP's agentic spine (ASI01–ASI10). IMDA dimensions (updated May 2026): D1 assess and bound the risks upfront; D2 make humans meaningfully accountable; D3 implement technical controls and processes; D4 enable end-user responsibility.
EU AI Act dates: Article 50 transparency applies from 2 August 2026; GPAI obligations (Articles 53–55) from 2 August 2025. The high-risk articles bite only where the system is high-risk — stand-alone Annex III systems from 2 December 2027, Annex I embedded systems from 2 August 2028 (the Digital Omnibus deferring these entered into force on 27 July 2026). The “EU AI Act” column names the provision that governs the failure mode; whether it is yet in force depends on that timeline.
| OWASP ASI 2026 | NIST AI RMF | IMDA (May 2026) | EU AI Act provision | Liability locus + duty | Register example |
|---|---|---|---|---|---|
| ASI01 Agent Goal Hijack | MEASURE + MANAGE | D3, D1 | Art 15 robustness / cybersecurity | Modal: deployer (exposed the agent to untrusted input); vendor where the flaw and fix live entirely in the product; shared where the base model’s susceptibility is the vector. Duty: GDPR Art 32; negligent misrepresentation if hijacked output misleads. | 004 (vendor; ASI01 secondary) |
| ASI02 Tool Misuse & Exploitation | MAP + MANAGE | D1, D3 | Art 15 robustness; Art 14 human oversight | Modal: deployer (granted the tool scope). Duty: GDPR Art 32 + GDPR Art 25 by-design; GDPR Art 5(1)(f) integrity. | — (007 auto-execute posture is the nearest fit only) |
| ASI03 Identity & Privilege Abuse | GOVERN + MAP | D1 (identity-and-permissions), D3 | Art 12 logging; Art 14 oversight; Art 26 deployer duties | Modal: shared (deployer’s identity architecture; vendor where defaults over-privilege). Duty: GDPR Art 5(2) accountability + GDPR Art 25 + GDPR Art 32. | 002 (shared; ASI03 secondary) |
| ASI04 Agentic Supply Chain | GOVERN + MAP + MANAGE | D3, D1 | Art 25 value-chain responsibilities; Art 15 cybersecurity; Art 53 GPAI docs | Modal: vendor (its pipeline shipped the poisoned component); shared where the deployer chose to connect it. Duty: GDPR Art 28 processor + GDPR Art 32; the software-supply-chain expectation in contract. | 002 (shared), 007 (vendor) |
| ASI05 Unexpected Code Execution (RCE) | MEASURE + MANAGE | D3, D1 (reversibility, action scope) | Art 15 robustness / cybersecurity; Art 14 oversight | Modal: deployer (let the agent execute unreviewed code); shared where the framework auto-executes by design. Duty: GDPR Art 32; negligence for resulting harm. | 001 (shared; ASI05 secondary) |
| ASI06 Memory & Context Poisoning | MEASURE + MANAGE | D3 | Art 15 accuracy / robustness; Art 10 only where poisoned content enters training / testing datasets | Modal: shared (vendor’s memory architecture + deployer’s context hygiene); vendor where the context architecture is the product’s. Duty: GDPR Art 5(1)(d) accuracy + GDPR Art 32 integrity. | 004 (vendor; ASI06 best fit) |
| ASI07 Insecure Inter-Agent Communication | MAP + MEASURE | D3, D1 | Art 15 cybersecurity; Art 25 where inter-agent crosses providers | Modal: shared / vendor (protocol-level). Duty: GDPR Art 32; GDPR Art 28 where inter-agent = inter-processor. | — |
| ASI08 Cascading Failures | MAP + MANAGE | D3 (gradual rollout, monitoring), D1 (reversibility) | Art 9 risk management; Art 15 robustness; Art 55 systemic GPAI at scale | Modal: shared (fault propagates across the chain — the register’s allocation thesis in one word). Duty: causation / foreseeability in negligence; GDPR Art 32. | — (002 shows the blast-radius economics; its initiating defect files under ASI04) |
| ASI09 Human-Agent Trust Exploitation | GOVERN + MEASURE | D2, D4 | Art 50 transparency (know it’s AI); Art 14(4)(b) automation bias | Modal: deployer (relied on / deployed the output). Duty: professional duty of accuracy (Ayinde); negligent misrepresentation (Moffatt). | 005 (deployer; partial), 003 (deployer; partial analogue) |
| ASI10 Rogue Agents | GOVERN + MEASURE + MANAGE | D2, D3 | Art 14(4)(e) intervene / stop; Art 15 robustness; Art 72 post-market monitoring | Modal: deployer (operated without adequate monitoring / kill-switch); shared where a vendor’s agent overrode a stated constraint; vendor where the provider itself operated the agent, as in a capability evaluation whose containment failed. Duty: GDPR Art 32; GDPR Art 22 where a solely automated decision has legal or similarly significant effects; negligence. | 001 (shared; ASI10 primary), 009 (vendor; eval containment failure) |
The crosswalk cites an entry only for a category the entry itself claims. The NIST assignments are “the function most engaged,” this register's reading rather than NIST's own mapping. Empty cells are failure modes the Register has not yet documented with a live entry.
Duty-based failures that no OWASP category captures
Three of the register's crystallised incidents have no clean OWASP ASI category, because the failure in each is a legal duty crystallising, and a security taxonomy has no slot for that. This is the gap the liability layer exists to close, and the clearest illustration of what a security framework leaves uncovered.
- AIR-2026-003 Moffatt v Air Canada — negligent misrepresentation. No agent was compromised; the company was held liable for what its chatbot told a customer. Deployer-carried. OWASP has no category for “your agent's ordinary output created legal liability” (003 maps ASI09 only as a partial analogue, flagged as such).
- AIR-2026-005 Ayinde v Haringey: a non-delegable professional duty of accuracy to the court. Lawyers filed AI-fabricated authorities; ASI09 is only a partial fit (over-reliance), because the operative failure is the professional duty. Deployer-carried.
- AIR-2026-006 Garante v Luka (Replika) — GDPR lawful basis and transparency. A €5M fine for processing without a lawful basis and without age verification (Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24, 25(1)). No OWASP category touches “you deployed the agent without a legal basis to process.” Deployer-carried.
The pattern: security frameworks index how an agent gets compromised. They are silent on how an agent, working exactly as built, creates legal liability. The register documents that second kind, incident by incident.
How to use it
- Identify the failure mode you are looking at in any one framework's vocabulary.
- Read across to the others, and to the liability locus, which tells you who most likely carries it and which duty is engaged.
- Read the linked register entry for the worked example of the allocation on real facts.
Sources
- OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10).
- NIST AI Risk Management Framework 1.0 (NIST AI 100-1) — GOVERN / MAP / MEASURE / MANAGE.
- IMDA Model AI Governance Framework for Agentic AI (updated 20 May 2026 — four dimensions).
- EU AI Act (Regulation (EU) 2024/1689) — Articles 9, 10, 12, 14, 15, 25, 26, 50, 53–55, 72.
The machine-readable feed of the Register, including each entry's liability locus, is at /api/register. How entries are made.
Subscribe to the AI Agent Incident Register
Every new Register entry delivered with the legal analysis: the incident, the duty engaged, who is liable across the chain, and what governance would have prevented it. Written by Michael K. Onyekwere, CIPP/E. Free.
Subscribe — freeDelivered via Compliance Engineering on Substack, which handles your subscription and consent. Unsubscribe any time. Privacy notice.
New entries are delivered free through Compliance Engineering on Substack. Governance support before the incident: Janus DPO-as-a-Service. This is legal analysis of public frameworks and incidents, not legal advice.