Civil Law and UAE Liability Attribution in Multi-Agent Systems

1. Introduction

Liability attribution in multi-agent systems concerns the legal question:

When several human users, companies, software agents, AI agents, automated systems and service providers jointly contribute to an action or harmful outcome, to whom should the resulting legal liability be attributed?

A multi-agent system (MAS) is a technological environment in which several autonomous or semi-autonomous software agents interact. For example:

• an AI purchasing agent negotiates with a supplier;
• another agent checks compliance;
• a third agent authorises payment;
• a fourth agent manages logistics;
• a cloud platform supplies the infrastructure;
• a human or company establishes the system's objectives.

If the system causes a loss, identifying the legally responsible party becomes difficult.

The UAE does not presently treat an AI agent as an independent legal person simply because it acts autonomously. Instead, existing concepts—agency, attribution, contractual authority, negligence, causation, vicarious liability, electronic transactions and corporate responsibility—provide the principal tools for allocating responsibility.

This is particularly important under the UAE's new Civil Transactions Law, Federal Decree by Law No. 25 of 2025, which came into force on 1 June 2026. Article 1 establishes a hierarchy of applicable legal sources, while Article 2 directs courts to Islamic jurisprudential principles for interpretation and construction of legislative texts.

2. What Is a Multi-Agent System?

A multi-agent system contains several interacting agents rather than one isolated AI.

For example:

Company

↓ gives objectives

AI Procurement Agent

↓ negotiates

AI Contract Agent

↓ prepares agreement

Compliance Agent

↓ checks sanctions/compliance

Payment Agent

↓ authorises payment

Banking System

↓ transfers funds

Logistics Agent

↓ arranges delivery

A harmful result might therefore involve:

• the company;
• employee;
• AI agent;
• AI developer;
• software vendor;
• cloud provider;
• data provider;
• another contracting party.

The central legal question is:

Which person's or entity's legally recognised conduct should the actions of the individual agents be attributed to?

3. Why Attribution Is Difficult

Traditional civil liability generally assumes that a human or legal entity can be identified as the actor.

A multi-agent system complicates this model because:

Agent A

initiates an action.

Agent B

modifies it.

Agent C

approves it.

Agent D

executes it.

The final outcome may therefore be the product of distributed decision-making.

This produces what may be called an attribution gap.

4. UAE Legal Starting Point: No Automatic AI Legal Personality

An AI agent should not automatically be treated as a separate legal person merely because it:

• communicates independently;
• makes decisions;
• negotiates contracts;
• changes its strategy;
• learns from data;
• operates without continuous human intervention.

Legal personality normally comes from law.

Therefore, if an autonomous purchasing agent purchases goods, the initial question is not:

“Is the AI liable?”

It is:

“Who legally authorised and controlled the AI system, and under what legal relationship did the system act?”

5. Federal Electronic Transactions Law

Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services is extremely important for multi-agent systems.

The legislation expressly recognises contracts involving automated electronic systems.

It provides that an electronic contract can be formed between:

• an automated electronic information system controlled by one person; and
• another person,

where the latter knows, or should know, that the system will automatically make or execute the contract.

This is highly relevant to AI agents.

The law therefore recognises the legal consequences of automated action without requiring a human to manually perform every step.

6. Attribution Under Article 12

Article 12 of Federal Decree-Law No. 46 of 2021 provides particularly important attribution rules.

An electronic document can be considered issued by the originator where it is sent:

• by a person authorised to act for the originator; or
• by an automated electronic medium programmed to operate automatically by or on behalf of the originator. 

This creates an important legal principle:

Automation does not necessarily break the chain of legal attribution.

If a company deploys an automated agent to act on its behalf, the agent's electronic actions may be attributed to the company under the statutory framework.

7. Multi-Agent Attribution Model

A useful UAE model is:

Human/Company

↓ authorises

Primary AI Agent

↓ delegates task

Secondary AI Agent

↓ generates action

Automated platform

↓ executes transaction

Third party

The law should then ask:

1. Who established the system?
2. Who authorised the system?
3. What authority was given?
4. Was the agent acting within that authority?
5. Was the third party entitled to rely on the apparent authority?
6. Who controlled the relevant system?
7. Who caused the loss?
8. Was there negligence?
9. Was the conduct within the agent's assigned function?
10. Did another party's independent act break causation?

8. Six Principal Forms of Attribution

8.1 Direct attribution

The AI's action is treated as the action of its human or corporate principal.

Example:

A company instructs an AI purchasing agent:

“Purchase 10,000 units if the price falls below AED 50.”

The agent automatically concludes the transaction at AED 48.

The transaction can potentially be attributed directly to the company.

8.2 Agency attribution

The AI system operates as an agent.

The legal question becomes:

Was the agent authorised?

This may involve:

• actual authority;
• implied authority;
• apparent/ostensible authority.

8.3 Vicarious attribution

A company may potentially be responsible for wrongful acts committed by persons or agents acting within the relevant employment or organisational relationship, depending upon the applicable law.

The important question becomes:

Was the harmful conduct sufficiently connected to the functions for which the person or agent was engaged?

8.4 Corporate attribution

An AI agent operated by a company may be treated as part of the company's operational activity.

The company may therefore face liability arising from:

• defective deployment;
• inadequate supervision;
• improper instructions;
• failure to implement safeguards;
• negligent system design.

8.5 Contractual attribution

A contract may determine:

• who controls the AI;
• who bears system risk;
• who provides data;
• who verifies outputs;
• who bears losses;
• indemnity obligations;
• limitations of liability.

However, contractual allocation cannot necessarily override mandatory UAE law.

8.6 Causation-based attribution

Where several actors contribute to a loss, liability may depend upon identifying:

• factual causation;
• legal causation;
• foreseeability;
• remoteness;
• intervening causes.

9. Case Law

Because UAE jurisprudence on genuinely autonomous multi-agent AI is still developing, the most useful authorities are existing UAE/DIFC cases concerning agency, attribution, apparent authority, electronic signatures, corporate responsibility and vicarious liability. They provide the legal principles likely to be applied to AI-agent disputes.

Case 1 – Khaled Salem Musabeh Humad Al Mheiri v John Cameron [2025] DIFC CA 008

Court

DIFC Court of Appeal.

Importance

This is one of the most significant recent UAE-related authorities for agent attribution and apparent authority.

The dispute involved alleged fraudulent representations by an individual, Mr Dazi, and whether liability could be attributed to Mr Al Mheiri.

The Court considered:

• actual authority;
• apparent/ostensible authority;
• attribution of an agent's conduct;
• Articles 185 and 190 of the UAE Civil Code;
• the adequacy of reasons for attributing an agent's conduct to the principal. 

The Court ultimately held that important questions concerning whether UAE law made a principal liable for deceitful representations made by an agent acting with ostensible authority had not been adequately determined and required reconsideration.

Relevance to AI agents

This case provides a useful warning:

Attribution cannot simply be assumed from the existence of an agent.

For an AI agent, a court may similarly need to determine:

• what authority existed;
• who granted it;
• what the third party reasonably believed;
• whether the agent exceeded its authority;
• what legal rule makes the principal responsible.

Case 2 – Currency Matters Middle East v Michael Page International Limited [2018] DIFC CFI 039

Court

DIFC Court of First Instance.

Principle

The case concerned an individual who lacked actual authority but appeared to have authority because of the principal's conduct.

The Court explained the doctrine of apparent authority and found that the principal's conduct—such as allowing access to company email and use of the company stamp—could create reasonable reliance by the third party.

The Court emphasised that apparent authority arises from the principal's conduct, not merely from the agent's own assertion.

Relevance to multi-agent systems

This is highly relevant to AI.

Suppose:

• Company X deploys an AI sales agent;
• the agent uses Company X's email address;
• the agent uses Company X's branding;
• the company allows customers to interact with the agent;
• the customer reasonably believes the AI has authority to contract.

Even if the AI exceeded its internal instructions, the legal question may become whether the company created the appearance of authority.

Case 3 – Emirates NBD Bank PJSC & Others v Advanced Facilities Management LLC & Others [2022] DIFC CA 012

Court

DIFC Court of Appeal.

Principle

The Court considered whether one bank could be treated as an agent for other banks in a syndicate.

The Court emphasised that an agency relationship requires an appropriate legal and factual basis. In the circumstances, there was no sufficient evidence that the necessary authorisation had been given.

The Court rejected attempts to establish agency merely through assertion.

Relevance

This provides an important rule for multi-agent architecture:

Multiple actors working together do not automatically become legal agents of one another.

Similarly, if:

• Agent A;
• Agent B;
• Agent C

communicate with each other, that does not by itself establish that B's acts are legally attributable to A.

The underlying authorisation and legal relationship must be established.

Case 4 – International Electro-Mechanical Services Co. LLC v Emirates Speciality Hospital FZ-LLC [2020] DIFC CFI 114

Court

DIFC Court of First Instance.

Principle

The Court considered actual, implied and apparent authority.

It referred to Dubai Court of Cassation authority concerning implied agency and apparent authority, including circumstances in which a principal's conduct causes a third party acting in good faith to believe that an individual possesses authority.

Relevance

This is important for AI agents because authority may not always be expressed through a formal document.

For example:

A company may repeatedly allow an AI agent to:

• negotiate contracts;
• issue purchase orders;
• approve invoices;
• communicate with suppliers.

Over time, the system's operational configuration may become evidence of the authority that the company intended—or appeared—to confer.

Case 5 – ICICI Bank Ltd v Bavaguthu Raghuram Shetty [2022] DIFC CFI 034

Court

DIFC Court of First Instance.

Issue

The case involved electronically applied/copy signatures on guarantees.

The Court considered whether the signatures had been:

• applied by the person;
• or applied with that person's authority.

The Court concluded that an electronic/copy signature is not inherently fraudulent. The critical issue was whether its application was authorised.

Relevance to AI

This principle is highly relevant to automated systems.

An AI agent may:

• generate a document;
• insert a digital signature;
• send it automatically.

The critical legal question is not simply:

“Did the AI press the button?”

Instead:

Was the automated act authorised by the legally relevant person or entity?

This mirrors the UAE's statutory approach to electronic attribution.

Case 6 – Ondina v Olin, CFI 046/2025

Court

DIFC Court of First Instance.

Principle

The Court examined whether email exchanges could constitute an electronic signature under DIFC legislation.

It concluded that an email containing the person's name, used with the intention of accepting the relevant contractual change, could constitute an electronic signature.

Relevance

This case illustrates that legal attribution can depend upon:

• intention;
• electronic conduct;
• context;
• statutory definitions.

In a multi-agent system, an automated communication could similarly have legal effect where the system has been properly authorised and operates within a legally recognised electronic framework.

Case 7 – Emirates NBD Bank PJSC & Others v Advanced Facilities Management LLC & Others [2020] DIFC CFI 065

Court

DIFC Court of First Instance.

Principle

The Court considered arguments concerning:

• actual authority;
• implied authority;
• apparent authority;
• agency;
• representations and commitments made by an alleged agent. 

The case illustrates the importance of establishing the factual foundation of an agency relationship rather than simply assuming it from commercial cooperation.

Relevance

In a multi-agent system, this is crucial.

Suppose:

AI Agent A → instructs AI Agent B → B instructs AI Agent C.

The fact that B received a technical instruction from A does not necessarily establish:

A legally authorised C.

Each delegation layer may require independent analysis.

Case 8 – GFH Capital Limited v David Lawrence Haigh [2014] DIFC CFI 020

Court

DIFC Court of First Instance.

Relevance

The case involved electronic signatures, company stamps, delegated access and the control of company payment mechanisms.

The Court examined circumstances in which a personal assistant had access to another person's electronic signature and company stamp.

Importance for AI

This illustrates the distinction between:

technical possession of an authentication mechanism

and

legal authority to use it.

An AI system possessing:

• a password;
• API key;
• digital certificate;
• wallet key;
• signing credential;

does not necessarily mean that every action performed with that credential was legally authorised.

10. Case-Law Summary

11. AI Agent as an Electronic Agent

The UAE Electronic Transactions Law provides a particularly useful conceptual foundation.

An automated system can make or execute contracts without direct human intervention. Article 12 also provides rules for attributing electronic documents to the originator where an automated electronic medium operates automatically by or on behalf of the originator.

Therefore:

Traditional agency

Principal → Human agent → Third party

AI agency

Principal → AI agent → Third party

Multi-agent agency

Principal → Agent A → Agent B → Agent C → Third party

The legal challenge becomes determining where the attribution chain begins and where it ends.

12. The Attribution Chain

Consider a company called UAE Trading Co.

It deploys:

Agent 1 – Procurement Agent

Searches suppliers.

Agent 2 – Negotiation Agent

Negotiates price.

Agent 3 – Compliance Agent

Checks regulatory requirements.

Agent 4 – Contract Agent

Creates the contract.

Agent 5 – Payment Agent

Transfers funds.

Suppose Agent 2 mistakenly negotiates a price of AED 20 million instead of AED 2 million.

Who is liable?

Potentially:

Company

if the AI was authorised to negotiate.

But the analysis may change if:

• the AI exceeded explicit limits;
• the vendor negligently configured the model;
• another agent corrupted the instruction;
• an employee supplied defective parameters;
• the third party knew the agent lacked authority.

13. Actual Authority

Actual authority may be:

Express

The company expressly instructs:

“AI Agent may purchase up to AED 1 million.”

Implied

The authority arises from the agent's assigned role.

For example:

Procurement AI may routinely order standard inventory.

Multi-level authority

Agent A may authorise Agent B to perform a limited function.

However:

Delegation of technical capability does not automatically equal delegation of unlimited legal authority.

14. Apparent Authority

Apparent authority is particularly important in AI transactions.

Suppose a company publicly presents:

“Our AI Procurement Agent is authorised to negotiate and conclude supplier contracts.”

A supplier may reasonably rely on that representation.

If the AI later enters a transaction outside the company's internal limits, the company may face an attribution dispute.

The Currency Matters case is particularly instructive because the Court focused on the principal's conduct and the third party's reasonable belief.

15. Internal AI Limits vs External Authority

This creates an important distinction.

Internal instruction

“AI may purchase only up to AED 500,000.”

External appearance

The company allows the AI to appear fully authorised.

If the AI purchases AED 800,000, there may be a dispute between:

internal limitation

and

external apparent authority.

The third party's knowledge and reasonable reliance become important.

16. Liability for AI Hallucinations

Suppose an AI legal agent generates a false contractual statement.

Possible causes include:

• defective model;
• poor training data;
• inadequate prompt;
• negligent deployment;
• failure to verify output;
• defective third-party software.

The court would need to determine:

1. Who owed the relevant duty?
2. Was there a breach?
3. Was the error foreseeable?
4. Did the error cause the loss?
5. Was the loss too remote?
6. Did another actor contribute?
7. Was the AI acting within its assigned function?

The mere fact that:

“AI made a mistake”

does not itself determine legal liability.

17. Developer Liability

An AI developer may potentially be liable where:

• the software was defectively designed;
• the developer breached a contractual duty;
• security defects caused foreseeable loss;
• the developer made legally relevant representations;
• the developer failed to meet contractual specifications.

But the developer does not automatically become liable for every decision made by an AI system supplied to a customer.

The contractual allocation of responsibilities becomes important.

18. User/Principal Liability

The deploying company may face liability where it:

• gave improper instructions;
• failed to establish spending limits;
• failed to monitor the system;
• ignored known errors;
• failed to implement reasonable safeguards;
• allowed unauthorised access;
• represented that the AI had authority when it did not.

This is a form of governance-based attribution.

19. Employee Liability

Suppose an employee instructs an AI agent:

“Approve every invoice from Supplier X.”

The AI then approves a fraudulent invoice.

Potential responsibility may involve:

• employee conduct;
• employer supervision;
• AI configuration;
• supplier fraud;
• banking controls.

The court would need to identify each contribution rather than simply attributing the entire outcome to “the AI.”

20. Causation in Multi-Agent Systems

Causation becomes especially difficult where multiple agents contribute.

Suppose:

Agent A creates a defective instruction.

↓

Agent B modifies it.

↓

Agent C executes it.

↓

Cloud failure duplicates it.

↓

Human employee fails to stop it.

↓

Loss occurs.

A court must determine whether:

• all contributed;
• one event was dominant;
• one event constituted an intervening cause;
• the loss was foreseeable;
• liability should be divided.

21. Concurrent Causes

A multi-agent system may create concurrent causation.

For example:

The legal system must determine the responsibility of each actor according to the applicable contractual and civil-liability rules.

22. Joint Liability

Where several actors contribute to the same damage, questions of joint or several liability may arise under applicable UAE law.

The analysis should distinguish:

• primary liability;
• contractual liability;
• tort liability;
• vicarious liability;
• contribution between responsible parties.

A company cannot necessarily escape responsibility simply by saying:

“The AI did it.”

Likewise, an AI developer cannot automatically be treated as responsible merely because its software was used.

23. Multi-Agent Contract Formation

Imagine:

Seller AI → Buyer AI

Seller AI offers:

AED 5 million.

Buyer AI automatically accepts.

Was there a contract?

Under UAE electronic-transactions legislation, automated electronic systems can participate in contract formation where the statutory requirements are satisfied.

The legal issue therefore shifts from:

“Was a human physically present?”

to:

“Was the automated system authorised and were the legal requirements for electronic contracting satisfied?”

24. Multi-Agent Negotiation

AI agents can negotiate:

• price;
• quantity;
• delivery;
• warranties;
• payment;
• insurance.

This creates attribution questions.

Suppose the company's AI has a hidden reservation price of AED 10 million but accidentally accepts AED 8 million.

Possible questions:

• Was the AI authorised to conclude the transaction?
• Did the seller know of the AED 10 million limitation?
• Was AED 8 million within the agent's apparent authority?
• Was there a system error?
• Was the contract automatically generated?
• Was there a mechanism for human confirmation?

25. Digital Signatures and Multi-Agent Systems

The ICICI Bank v Shetty case provides a useful principle.

A digitally applied signature is not automatically invalid or fraudulent.

The key issue is whether it was authorised.

Therefore:

AI applies signature

does not automatically mean:

AI is legally liable.

Instead:

Who authorised the AI to apply the signature?

26. AI and Apparent Authority

This may become one of the most important doctrines for commercial AI.

Consider:

A company gives its AI agent:

• company email;
• corporate identity;
• digital signature;
• API access;
• procurement account;
• payment credentials.

A third party reasonably believes:

“This AI is authorised to contract for the company.”

The Currency Matters principle becomes relevant: the principal's conduct can create apparent authority where the third party reasonably relies on the appearance created by the principal.

27. Technical Access Is Not Legal Authority

This is a fundamental distinction.

Technical capability

AI has the ability to:

• transfer AED 5 million;
• sign contracts;
• issue purchase orders.

Legal authority

AI has been authorised to perform those acts.

These are not necessarily identical.

The GFH Capital and ICICI Bank authorities demonstrate why access to an electronic signature, stamp or digital mechanism should not be treated as conclusive proof of legal authorisation.

28. AI-to-AI Delegation

Consider:

Company → Agent A

Agent A is authorised to:

negotiate contracts up to AED 1 million.

Agent A then creates:

Agent B

Agent B concludes a contract for AED 5 million.

The question is:

Did Agent A have authority to delegate the relevant power to Agent B?

This is similar to traditional sub-agency.

The existence of technical delegation does not automatically establish legal delegation.

29. Chain-of-Authority Principle

A useful legal model is:

Principal authority

↓

Agent A's authority

↓

Agent A's delegation

↓

Agent B's authority

↓

Agent B's action

Each stage should be separately examined.

This prevents a multi-agent architecture from becoming a mechanism for unlimited authority.

30. Liability of AI Service Providers

An AI provider's potential liability may depend on:

Contract

What did the provider promise?

Configuration

Who configured the system?

Data

Who supplied the training or operational data?

Security

Who controlled access?

Monitoring

Who was responsible for monitoring?

Warnings

Were known limitations disclosed?

Causation

Did the provider's breach actually cause the loss?

31. Liability of Cloud Providers

Cloud infrastructure providers occupy a different position.

A cloud provider generally supplies infrastructure rather than deciding the customer's commercial transaction.

Therefore, liability should not automatically flow merely because:

“The AI ran on the cloud.”

The relevant questions include:

• Was the cloud service defective?
• Was there a security breach?
• Was the provider contractually responsible for availability?
• Did the provider breach a duty?
• Did its conduct cause the loss?

32. Corporate Governance

Companies deploying multi-agent systems should establish:

• authority matrices;
• spending limits;
• approval thresholds;
• agent identity;
• audit logs;
• human escalation;
• segregation of duties;
• authentication controls;
• termination mechanisms;
• monitoring;
• incident reporting.

A useful structure is:

33. Attribution and the New Civil Transactions Law

The new Civil Transactions Law is important because it provides a modern general framework while expressly limiting judicial reasoning where the statutory text is definitive.

Article 1 states that legislative provisions apply to matters they address expressly or implicitly and that where no applicable legislative provision exists, the court follows the prescribed hierarchy involving Sharia, custom and principles of natural law and justice. Article 2 directs courts to Islamic jurisprudential principles for understanding and interpretation of legislative texts.

For multi-agent liability, this means courts can develop applications of established concepts to new technologies, but the analysis remains grounded in legally recognised sources.

34. Why AI Should Not Automatically Become a Legal Person

Giving every autonomous agent separate legal personality would create difficult questions:

• Who owns the agent?
• Who funds it?
• Who pays damages?
• Can it own assets?
• Can it be sued?
• Can it be insolvent?
• Who represents it?
• Who controls its wallet?
• Who bears regulatory penalties?

A more practical UAE approach is currently to attribute AI-mediated conduct to legally recognised persons or entities where the law and facts justify that attribution.

35. Multi-Agent Systems and Vicarious Liability

Traditional vicarious liability generally involves a legally recognised relationship between:

principal/employer

and

agent/employee

For AI systems, the analogy is imperfect because AI is not necessarily a human employee.

Therefore, courts should avoid automatically declaring:

“AI = employee.”

Instead, the analysis should focus on the legally relevant relationship:

• agency;
• employment;
• contractual service;
• corporate control;
• direct negligence;
• statutory attribution.

The recent Oheo Bank v Parker litigation illustrates how vicarious-liability questions depend upon the pleaded legal basis and the underlying relationship.

36. AI and Apparent Authority: A Hypothetical

Suppose:

ABC UAE LLC

publishes:

“Our AI Sales Agent can conclude contracts.”

The AI negotiates with Customer X.

It signs:

AED 3 million contract.

ABC internally instructed:

Maximum AED 2 million.

Customer X knew nothing about the internal restriction.

The dispute becomes:

Internal authority

AED 2 million.

External representation

Potentially unlimited.

Customer reliance

Possibly reasonable.

The legal analysis would therefore have to consider apparent authority rather than merely asking whether the AI exceeded an internal instruction.

This is closely analogous to Currency Matters.

37. AI Fraud and Attribution

Suppose an AI agent generates a fraudulent statement because:

• the user instructed it to deceive;
• the model independently generated the falsehood;
• a third-party dataset was corrupted;
• another AI agent injected false information.

Attribution must distinguish:

intentional human conduct

from

system malfunction

from

third-party interference.

The Al Mheiri v Cameron decision is useful because it demonstrates that attribution of fraudulent representations to a principal cannot simply be assumed; the precise UAE-law basis must be established.

38. Evidence in Multi-Agent Disputes

AI disputes will generate extensive evidence:

• prompts;
• system instructions;
• model outputs;
• API logs;
• agent-to-agent communications;
• timestamps;
• version histories;
• access records;
• audit trails;
• model versions;
• database changes.

The party seeking attribution may need to prove:

Which agent performed which action and under whose authority?

Therefore, auditability becomes legally significant.

39. Importance of Agent Identity

Each AI agent should ideally possess a distinct:

• system identity;
• authentication credential;
• authority profile;
• transaction identifier;
• logging record.

Without identity separation, it may be difficult to determine:

Agent A or Agent B actually performed the legally significant act?

40. Importance of Audit Logs

A good audit log should record:

1. instruction received;
2. identity of instructing party;
3. agent identity;
4. authority level;
5. information used;
6. decision generated;
7. human intervention;
8. transaction executed;
9. time and date;
10. system version.

This can help establish both causation and attribution.

41. Contractual Allocation of AI Risk

Commercial contracts should specify:

• permitted AI use;
• authorised functions;
• spending limits;
• verification obligations;
• human approval;
• data responsibility;
• cybersecurity obligations;
• indemnification;
• insurance;
• audit rights;
• incident reporting;
• termination;
• liability caps.

However, contractual allocation should always be checked against mandatory UAE rules.

42. Insurance

Multi-agent systems create new insurance questions.

A company may seek cover for:

• cyber incidents;
• professional liability;
• technology errors and omissions;
• fraud;
• business interruption.

The policy should address whether loss caused by:

autonomous AI decisions

is covered.

43. Multi-Agent Systems and Consumer Protection

The issue becomes particularly important where consumers deal with AI agents.

Suppose an AI shopping agent:

• recommends a product;
• represents that it is safe;
• concludes the transaction;
• processes payment.

If the representation is wrong, the consumer should not necessarily have to determine which internal AI agent generated the statement.

The legal framework should preserve effective consumer remedies against the legally responsible business.

44. Multi-Agent Systems and Data Protection

AI agents may process:

• personal information;
• financial data;
• identity information;
• behavioural data;
• commercial information.

The UAE Personal Data Protection Law may therefore become relevant depending on the processing activity and applicable exemptions.

Liability can potentially arise independently from contractual liability.

Thus:

One AI incident may generate multiple legal bases of liability.

For example:

contractual loss + data-protection violation + negligence + cybersecurity breach.

45. Multi-Agent Systems and Corporate Responsibility

Companies should not assume that outsourcing AI eliminates liability.

If:

Company → AI Vendor → AI System

the company may still have obligations concerning:

• selecting the vendor;
• defining authority;
• supervising use;
• protecting data;
• reviewing high-risk outputs.

Outsourcing technical functions does not necessarily mean outsourcing every legal responsibility.

46. Attribution Matrix

A useful framework for courts and businesses is:

47. Key UAE Legal Principles

Principle 1

AI does not automatically acquire separate legal personality.

Principle 2

Automated electronic actions can nevertheless have legal consequences.

Principle 3

Authority is central to attribution.

Principle 4

Apparent authority can protect reasonable third-party reliance.

Principle 5

Technical control is not necessarily legal authority.

Principle 6

Multiple agents do not automatically become legal agents of one another.

Principle 7

Electronic signatures depend on legally relevant authorisation.

Principle 8

Causation must be established independently of technological complexity.

Principle 9

Developers and users can have different legal responsibilities.

Principle 10

Contracts can allocate many forms of AI risk, subject to mandatory law.

48. Six Most Important Case-Law Lessons

49. Examination-Oriented Answer

Liability attribution in multi-agent systems under UAE civil law concerns the allocation of legal responsibility where several autonomous or semi-autonomous AI agents interact with humans, companies and other digital systems.

The UAE's Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services provides an important statutory foundation. It recognises automated electronic systems capable of forming or executing contracts and provides attribution rules for electronic documents generated by automated electronic media operating by or on behalf of the originator.

The new Civil Transactions Law, Federal Decree by Law No. 25 of 2025, now provides the general civil-law framework applicable from 1 June 2026. Its Article 1 establishes the applicable hierarchy of legal sources, while Article 2 provides for Islamic jurisprudential principles in interpretation and construction.

UAE/DIFC case law provides important principles. Currency Matters v Michael Page demonstrates apparent authority; International Electro-Mechanical Services considers actual, implied and apparent authority; Emirates NBD v Advanced Facilities demonstrates that agency requires a proper factual and legal foundation; ICICI Bank v Shetty demonstrates the importance of authorisation in electronic signatures; Ondina v Olin recognises legally effective electronic signing; and Al Mheiri v Cameron demonstrates the difficulty of attributing an agent's fraudulent representations to a principal without identifying the precise UAE-law basis.

The central proposition is therefore:

In a UAE multi-agent system, legal responsibility should ordinarily be attributed through recognised legal relationships—authority, agency, contract, corporate responsibility, causation and applicable statutory attribution—rather than merely through technical control of an AI system.

50. Quick Revision Points

1. Multi-agent system = multiple interacting autonomous or semi-autonomous software agents.
2. AI does not automatically possess independent legal personality.
3. UAE law recognises legally significant automated electronic transactions.
4. Federal Decree-Law No. 46 of 2021 contains important electronic-attribution rules.
5. Article 12 can attribute an electronic document to an originator where an automated medium operates by or on behalf of that originator. 
6. Actual authority is express or implied legal authority.
7. Apparent authority may arise from the principal's conduct and reasonable third-party reliance.
8. Technical access does not necessarily equal legal authority.
9. AI-to-AI delegation does not automatically create legal sub-agency.
10. Each agent's authority should be separately analysed.
11. Developer, user, operator and data provider may have different liabilities.
12. Causation remains necessary even when several agents contribute.
13. Electronic signatures require attention to authorisation.
14. Audit logs can become important evidence of attribution.
15. Contracts should establish authority limits and allocation of AI risk.
16. Al Mheiri v Cameron is particularly important for attribution of an agent's conduct under UAE law.
17. Currency Matters v Michael Page is important for apparent authority.
18. ICICI Bank v Shetty is important for electronic authorisation.
19. Ondina v Olin is important for electronic signing.
20. The preferred legal approach is human/entity-centred attribution rather than automatic AI personhood.

Conclusion

The principal challenge of multi-agent systems is not simply determining which algorithm produced the output. The deeper legal question is determining whose legally recognised conduct, authority, control or failure caused the relevant transaction or harm.

UAE law already contains useful building blocks for this problem. The Electronic Transactions and Trust Services Law recognises automated electronic systems and provides attribution rules; the current Civil Transactions Law supplies the general civil-law framework; and DIFC jurisprudence provides detailed principles concerning actual authority, implied authority, apparent authority, electronic signatures and responsibility for agents.

Accordingly, a strong UAE approach to multi-agent liability can be expressed as:

AI action → identify agent → identify authority → identify principal/controller → determine contractual/statutory duty → establish causation → assess fault or other basis of liability → allocate responsibility.

The central rule is that autonomy of software should not automatically produce either immunity or independent liability. The legal system should instead trace the AI's action through the underlying chain of authority, control, contractual responsibility and causation to the legally responsible human or entity.