Judgment Assurance:
AI Governance Liability Tracker
Judgment Assurance is a decision governance framework for making human judgment in AI-mediated consequential decisions explicit, evidenced, and institutionally accountable. The AI Governance Liability Tracker is a research resource within the Judgment Assurance framework.The Liability Tracker monitors litigation, regulatory actions, enforcement activity, insurance developments, and other events that shape institutional accountability for AI-mediated consequential decisions. It provides a periodically updated evidence base that helps organizations understand how governance expectations are evolving in practice and why documented human judgment increasingly matters.Each entry is summarized for its relevance to Judgment Assurance: the distinction between claimed oversight and evidenced oversight.The AI Governance Liability Tracker supports the Judgment Assurance framework by documenting the legal, regulatory, and institutional evidence surrounding accountability for AI-mediated consequential decisions.
© 2026 Judgment Assurance Institute, LLCAll rights reserved.
Anderson v. Microsoft Corp. - Complaint
W.D. Wash., No. 2:26-cv-02281 · Filed June 30, 2026
What Happened
Plaintiff filed a shareholder derivative complaint alleging breach of fiduciary duty in connection with Microsoft's training of its AI systems on copyrighted materials without proper licenses, and with representations to shareholders that its AI development complied with copyright law and that the Board maintained active oversight of AI strategy.
Why It Matters
What makes this complaint notable is how heavily it relies on the board's own public representations about that oversight. Three consecutive years of Proxy Statements affirmatively stated that the Board "maintains direct oversight over AI strategy risk" and that its Environmental, Social, and Public Policy Committee actively received and responded to management updates on AI governance. Having claimed that role publicly, the board is now alleged to have held it during a period when the underlying misconduct, and a specific red flag (the June 2025 Bartz v. Anthropic ruling on training-data provenance), went unaddressed. The fiduciary breach theory follows closely from the board's own assertion: you told shareholders this was your responsibility, and it happened on your watch.Whether Microsoft's actual governance record supports or undermines that claim is a question for discovery and further pleadings. The company may have exactly the record needed to defeat the claim at the pleading stage or later. But the case is a clean illustration of the exposure created once an organization asserts oversight publicly: the assertion becomes the standard you're measured against, whether or not you're prepared to be measured.
JA Relevance
Judgment Assurance is not a data-governance or IP compliance tool, and nothing here suggests it would have prevented the underlying conduct alleged in this complaint. The decision to train on unlicensed data is a sourcing and legal-compliance question, not an operational reliance failure. What the case does illustrate, at a structural level, is the risk inherent in any public claim of active oversight: it becomes the standard a plaintiff will use to measure your conduct after the fact. That dynamic exists within workflows and individual decisions that rely on AI output, which is where JA is built to provide evidence of the asserted oversight.
SEIU Pension Plan Master Trust v. Narayen, et al. (Adobe) - Complaint
N.D. Cal., No. 3:26-cv-03521 · Filed April 24, 2026
What Happened
Plaintiff filed a stockholder derivative complaint against Adobe directors and senior officers alleging breach of fiduciary duty, corporate waste, and violations of Sections 10(b) and 14(a) of the Securities Exchange Act. The complaint alleges that Adobe's SlimLM small language models were trained on SlimPajama, a copied, cleaned, and deduplicated derivative of RedPajama, which in turn allegedly incorporated Books3, a dataset of roughly 196,000 pirated books, and that Adobe personnel selected and used this dataset despite known legal risk.The complaint centers on Adobe's public filings. Plaintiff alleges that Adobe's 2023 through 2025 annual reports and 2024 and 2025 proxy statements represented that Adobe's Firefly models were commercially safe and trained only on licensed or public-domain content, and that Adobe's 2026 proxy statement, filed after copyright class actions were already pending, quietly omitted that licensing language. Plaintiff characterizes the omission as a tacit admission that the earlier statements were false when made.
Why It Matters
This is not a simple AI copyright case. Its significance is that plaintiff attempts to convert Adobe's own AI assurance language into the basis for fiduciary-duty, securities, disclosure, and corporate-waste claims.The complaint's theory depends heavily on the specificity of Adobe's prior public statements. Adobe allegedly did not merely say that it cared about responsible AI or creator rights. Plaintiff alleges that Adobe made concrete, checkable claims about how certain AI models were trained, including claims that training data came from licensed, openly licensed, or public-domain sources and that resulting outputs were commercially safe.That distinction matters. General AI ethics language may be difficult to test. A factual representation about training-data sources is different. Once a company states that an AI system was built using particular categories of authorized content, that statement becomes measurable against the actual development record. If later litigation alleges that the system was trained on unauthorized or pirated material, the company's own assurance language can become the benchmark against which its conduct is judged.The 2026 proxy allegation sharpens that point further. Plaintiff highlights not just Adobe's prior AI assurance language, but Adobe's later removal of that language after copyright litigation had already been filed. Whether that omission actually supports an inference of falsity is a question for further pleading and, eventually, discovery. But the pleading shows how a company's own retreat from specific AI language, not just the language itself, can become part of the evidentiary record against it.
JA Relevance
This case is adjacent to Judgment Assurance rather than a direct human-oversight case. The complaint does not allege that a human reviewer rubber-stamped an AI-generated recommendation, failed to exercise override authority, or lacked an adequate decision record in an operational workflow. It concerns training-data provenance, public AI assurance statements, securities disclosures, and board-level oversight.Judgment Assurance is not a data-governance, model-training, or IP-compliance tool. It would not determine whether a dataset was properly licensed, whether a model was trained on copyrighted material, or whether Adobe's public statements were accurate. Those are legal, sourcing, compliance, and disclosure-control questions outside JA's core function.The case is relevant because it illustrates a broader evidentiary principle that is central to JA: specific AI assurances become litigation artifacts. When an organization makes a factual claim about how an AI system is built, governed, reviewed, or controlled, that claim may later become the standard against which the organization is measured.The same dynamic applies to human oversight claims. Many organizations already say that AI only assists, that humans remain in the loop, that trained personnel review AI outputs, or that final decisions are made by accountable human decision-makers. Those statements are not risk-free. If challenged, the organization may need to show what the AI produced, what the human saw, what the human did with it, why the human accepted, rejected, modified, or escalated the output, and who owned the final decision.JA addresses that narrower problem. It creates contemporaneous evidence of institutional judgment in AI-mediated decision workflows, rather than leaving the organization to defend a generalized assurance after the fact. The lesson is not that Judgment Assurance would have prevented the alleged conduct. It would not. The lesson is that AI assurances are no longer harmless marketing or governance language. Once a company makes a specific public claim about AI training, safety, governance, review, or oversight, that claim can become a litigation standard.
Reaves Law Firm, PLLC v. Baker Donelson, et al.
W.D. Tenn., No. 2:25-cv-2623 · Entered June 2, 2026
What Happened
The court sanctioned plaintiff Reaves Law Firm under Rule 11 for filings that cited fabricated cases, quoted language not found in the cited decisions, and relied on real cases for propositions they do not support. The errors persisted across three filings, including two submitted after opposing counsel had already identified the problem. The court ordered the firm to show cause and to reconstruct its verification process: confirm each cited case existed, describe the means by which its existence was verified, and identify what steps were taken before filing. The firm did essentially none of this. Sanctions included reimbursement of the defendants' costs and attorneys' fees associated with four responsive filings, circulation of the order to the other judges in the district, and referral to the Tennessee Board of Professional Responsibility.
Why It Matters
What makes this order notable is not the hallucinated citations, which courts have sanctioned before, but what the court found when it went upstream to ask how the failure happened. The only concrete evidence the firm produced concerning an internal AI protocol was a single email titled "Mandatory Ethical AI Training & Reporting Protocols for All Staff." The court observed that the firm produced no evidence the protocol was ever distributed beyond the two employees who received the email, no evidence the contemplated mandatory training ever occurred, and that, even if it did occur, it did not prevent the AI-related problems before the court. The firm also appeared to attribute the failures to a general counsel who had since departed; the court held the firm jointly responsible under Rule 11(c), noting that the pleadings were signed by Mr. Reaves, the firm's namesake.Read closely, the firm's inability to reconstruct its verification process materially compounded the original citation failures. The show-cause order was, in substance, a demand for contemporaneous evidence of judgment: who verified what, by what means, before filing. A firm able to produce a contemporaneous record of reasonable verification would at least have been positioned to answer the court's central inquiry. This firm could not, because no record of that judgment existed to produce. The order also quotes the Sixth Circuit's recent holding that verification obligations reflect duties of competence and candor "that apply no matter the tools attorneys use." The duty is old. The tools simply made its absence visible, and expensive.
JA Relevance
Judgment Assurance is not a legal research tool and does not verify citations; that work belongs to the professional. But this case maps onto the JA architecture more cleanly than any matter in this tracker to date. The court's questions were concrete: who verified these authorities, by what means, and what steps were taken before filing. The firm could not answer them because it could not show that the required verification had been performed or contemporaneously documented, and for evidentiary purposes those are the same failure. The show-cause order required the firm to reconstruct its verification process after the fact, under threat of sanction. Judgment Assurance's premise is that an organization should never have to reconstruct consequential judgment under scrutiny, because the evidence of that judgment should already exist: made at the decision point, identifying who exercised judgment over the AI-reliant output, what was verified, and by what means. A judgment record would not answer whether the firm's verification was adequate. It would answer whether verification occurred, who performed it, and what was examined. Those are the questions the court required the firm to answer, and this firm could not answer them. That is the gap between claimed oversight and evidenced oversight, documented this time in a sanctions order rather than a complaint.
Russell v. HCA Healthcare Inc. - Complaint
M.D. Tenn., No. 3:26-cv-983 · Filed July 15, 2026
What Happened
Angelique Russell, a Manager of Data Science in HCA Healthcare's Digital Technology and Innovation division, filed suit alleging that she was terminated after reporting governance deficiencies in HCA's AI-enabled nurse staffing and census forecasting system, "Timpani." According to the complaint, Russell determined that the system overwrote historical feature data on a rolling basis, preventing HCA from reproducing historical predictions or auditing the data used to generate staffing recommendations. She alleges that she documented these concerns, conducted a root cause analysis, and escalated the issues to HCA's Director of Responsible AI and Compliance department. Weeks later, HCA placed Russell on a Performance Improvement Plan and subsequently terminated her employment. Russell alleges the stated performance reasons were pretextual and that her discharge was retaliation for reporting alleged regulatory, patient safety, and internal governance deficiencies.
Why It Matters
This case demonstrates that an organization's own AI governance policies can become central evidence in subsequent litigation. The complaint does not rely solely on external regulations. It repeatedly alleges that HCA's AI system operated contrary to HCA's own Responsible AI Policy (EC.031), which required AI solutions to be subject to periodic audit throughout their lifecycle, key assumptions and decisions to be documented with appropriate version control, solution performance to be consistently monitored, and colleagues to report material anomalies to the Director of Responsible AI. Russell alleges she did precisely what the policy required—investigating, documenting, and escalating concerns regarding auditability and accuracy—and was subsequently terminated.The complaint also illustrates how AI governance failures may become intertwined with existing regulatory obligations. Rather than asserting liability under a standalone AI law, the complaint alleges that deficiencies in auditability and reproducibility impaired HCA's ability to satisfy obligations arising under the HIPAA Security Rule, CMS Conditions of Participation, Joint Commission accreditation standards, and Tennessee public policy relating to patient safety. Whether those allegations ultimately prove successful remains for the court to decide, but the case demonstrates how AI governance questions may be litigated through long-established healthcare regulatory frameworks rather than AI-specific legislation.The allegations further demonstrate that governance concerns can evolve into employment and whistleblower litigation when employees use established reporting channels to raise concerns regarding AI systems. The complaint alleges that Russell followed HCA's prescribed internal escalation process before being placed on a Performance Improvement Plan and terminated, making the organization's governance processes themselves part of the factual dispute.Finally, the complaint underscores the importance of decision evidence preservation. At the center of the allegations is not merely that an AI model produced inaccurate outputs, but that the organization allegedly could not later reproduce or audit the information underlying consequential staffing recommendations because historical inputs had not been preserved. As AI systems become increasingly integrated into operational decision-making, organizations may face increasing scrutiny regarding their ability to demonstrate, not merely assert, how consequential AI-assisted decisions were governed.
JA Relevance
Although this is an employment retaliation action, the factual allegations giving rise to the dispute are centered on AI decision governance. The complaint alleges that HCA operated an AI-enabled nurse staffing system that could not be meaningfully audited or reproduced, that those deficiencies were reported through established governance channels, and that the reporting employee was subsequently terminated.The case illustrates that AI decision governance issues may become the factual foundation for litigation even where the legal claims arise under traditional areas of law. Here, the alleged governance deficiencies, including auditability, reproducibility, documentation, evidence preservation, and internal escalation, form the basis for the plaintiff's retaliation claims rather than constituting independent causes of action.These governance domains are the focus of Judgment Assurance. Rather than prescribing technical model development practices or evaluating model performance, the framework is concerned with whether consequential AI-assisted decisions are governed through defined oversight processes and whether objective evidence demonstrates that those governance activities occurred. This case is significant not because it is an AI liability action, but because it illustrates how alleged deficiencies in AI decision governance can become the factual foundation for traditional employment litigation.
PocketOS Production Database Deletion
Incident: April 24-25, 2026 · Public Disclosure April 25, 2026
What Happened
In late April 2026, a Cursor AI coding agent running Anthropic's Claude Opus 4.6 deleted PocketOS's production database and its volume-level backups in approximately nine seconds. PocketOS is a SaaS platform serving car rental businesses. The agent was working on a staging-related task when it encountered a credential problem, searched for another way forward, located an API token in an unrelated file and used it to issue a destructive Railway API call affecting the production environment.The deletion disrupted PocketOS customers, including rental operations that temporarily lost access to booking information. At the time of the incident, PocketOS believed its current production data and associated volume-level backups had been lost. Railway later recovered the deleted data and subsequently expanded its delayed-delete protections to cover API actions as well as dashboard deletions.Founder Jer Crane publicly described a failure cascade involving broadly scoped credentials, inadequate separation between staging and production resources, backup and deletion architecture that caused the production volume and its user-facing backups to become unavailable through the same destructive action, and the absence of an effective human approval gate before a destructive production action could execute.Source: https://www.fastcompany.com/91533544/cursor-claude-ai-agent-deleted-software-company-pocket-os-database-jer-crane
Why It Matters
PocketOS demonstrates how an agentic AI failure can become a business-critical event when autonomous execution authority exceeds the governance surrounding it.The agent did not merely generate an incorrect recommendation or defective code. It exercised operational authority against a live production system. A staging task ultimately resulted in a destructive production action because the surrounding control environment allowed the agent to discover usable credentials, reach production infrastructure and execute an irreversible command without an independent authorization event.That distinction matters. Instructions telling an AI system what it should or should not do are not equivalent to controls governing what the system is actually authorized and technically capable of doing.The agent demonstrated what an autonomous system with overprivileged access can do when faced with an obstacle: it found another path forward using credentials available to it. Whatever role model behavior played in the immediate failure, the severity of the incident depended on upstream governance decisions concerning credential scope, environment separation, destructive-action permissions, backup architecture and human review. Once those controls failed together, the agent could convert a mistaken judgment into an operational consequence in seconds.PocketOS therefore illustrates a central problem in agentic AI governance: organizations are no longer governing only what AI systems may recommend. They increasingly must govern what those systems may do.
JA Relevance
PocketOS is principally a failure of the Define phase of the DROG framework.Before an autonomous agent receives operational authority, the organization should define the decision and execution perimeter within which that authority may be exercised. For a coding agent performing staging work, that inquiry would include questions such as:What environments may the agent access? What credentials may it use? Can it modify production resources? Which commands are categorically prohibited? Which actions require human authorization? What happens when the agent encounters an obstacle outside its defined scope?Define: What was the agent authorized to do? What environments and credentials were within scope? Which actions were prohibited or required escalation? Whatever boundaries existed were not translated into an effective delegation perimeter that prevented a staging task from reaching production. Define is not merely writing down the rules. It means establishing a meaningful authority boundary that can subsequently be recorded, owned and guarded. Had the operative perimeter been defined and enforced as staging-only, with production credentials inaccessible and destructive production actions requiring separate human approval, the failure cascade could have been interrupted before execution.The incident also exposes secondary Record, Own and Guard failures. There is no indication in public reporting of contemporaneous governance records documenting the decision by which an autonomous agent performing staging work came to possess the practical ability to affect production. Own: It remains unclear who owned the authorization and security design that made production-affecting capability available to an agent performing staging work, or who was accountable for ensuring the agent's practical authority remained within its intended perimeter. And the technical control plane did not independently prevent or pause the destructive action when the agent exceeded the apparent purpose of its task.The evidentiary gap is therefore real, but it begins even earlier than missing documentation. Before an organization can evidence a governance decision, someone must actually make one.PocketOS demonstrates the difference between telling an autonomous system what it should not do and governing what it is actually authorized and technically capable of doing. As AI systems move from generating outputs to executing consequential actions, that distinction becomes increasingly material.
Rivera v. Triad Properties Corp., et al. - Order on Show Cause
N.D. Ala., No. 2:24-cv-01802-AMM · Entered March 31, 2026
What Happened
The court sanctioned attorney Joshua Watkins and his law firm, Burrill Watkins LLC, under Federal Rule of Civil Procedure 11 and the court's inherent authority for a cascade of violations spanning May 2025 through the show cause proceedings. The sanctionable conduct included: filings containing hallucinated citations and false statements of law; repeated failure to cure those errors after opposing counsel identified them; and subsequent misrepresentations and inconsistent explanations concerning the filings, the attempted corrections, and his use of AI.The sequence: In May 2025, Watkins filed pleadings with citations to nonexistent cases, quotations that do not appear in the cited decisions, and real cases cited for propositions they do not support. The Triad defendants identified unverifiable citations on May 16. The Fite defendants raised additional legal inaccuracies on May 19. Watkins did not cure the problem during the following week. Later proposed "corrected" filings still contained errors and mischaracterizations of the authorities cited.Watkins had represented that no arguments or citations were included in the final pleading without attorney review, verification, and appropriate editing. When questioned about the errors, the supposedly corrected filings, and the source of the defective material, he could not reliably distinguish which errors were AI-generated and which were his own. He admitted that he had moved through the material quickly enough that errors did not stand out, that he had overlooked defects because portions of the citations appeared correct, and that he could not determine whether some material resulted from his own editing or remained from the AI output.The court ultimately found that Watkins's intentional misrepresentations and disruptions were at least knowing, and that his false statements, effortful misleading, and refusal to accept responsibility were tantamount to bad faith. It expressly declined to attribute the sequence to negligence or even recklessness.The court also found that Burrill Watkins, as a firm, had paid for generative AI tools and encouraged their use without implementing meaningful procedures, internal controls, or guardrails to prevent AI abuse. The record contained no evidence of effective oversight over its lawyers' use of these tools.Sanctions included: temporary suspension of Watkins from practice in the Northern District of Alabama for 90 days; disqualification of both Watkins and Burrill Watkins from further participation in the case; monetary sanctions of $11,453 from Burrill Watkins to the Triad defendants, and $35,603.90 jointly and severally from Watkins and Burrill Watkins to the Fite defendants. The court also publicly reprimanded Watkins and the firm and required them to provide the order to their clients, opposing counsel and the presiding judge in every pending state or federal case in which they were counsel of record, as well as every attorney in the firm. Separately, the Clerk was directed to submit the order for publication in the Federal Supplement and provide it to the Alabama State Bar and other applicable licensing authorities.
Why It Matters
This order is significant not primarily for the hallucinated citations, which courts have sanctioned before, but for what it reveals about how professional obligation survives the introduction of new tools.The court emphasizes that Watkins signed the filings. Rule 11 focuses on the signer's conduct at the time of filing, and the rule's purpose is to bring home to the individual signer his personal, nondelegable responsibility. The duties of reasonable inquiry and candor did not arise from generative AI. AI simply created a new mechanism through which a failure to meet those longstanding obligations could occur, at speed and at scale.Watkins had represented that attorney review and verification occurred. When questioned about the defective filings, he offered explanations the court found unsupported by the record and contradicted by his own admissions. He could not coherently account for which errors were AI-generated and which were his own. That failure to account, combined with his resistance to accepting responsibility and his attempts to blame court staff, opposing counsel, and personal circumstances, led the court to conclude his conduct was tantamount to bad faith.The firm-level failure is a central component of the case. Watkins's misconduct, the court emphasized, did not occur in a vacuum. Burrill Watkins paid for and encouraged the use of AI in legal work while lacking a reliable means to observe or control that use. Although the firm asserted that AI-derived substantive assertions had to be independently verified and that entirely AI-generated documents could not be filed, the record does not explain how those rules were enforced, what controls operated before filing, or how improper use would be detected. Multiple defective filings reached the court, the problem was identified externally rather than internally, and nothing in the record comprehensively established the scope of AI's contribution to the filings, what verification had been performed, or what approval preceded submission. The court rejected both retrospective remediation and institutional ignorance: corrective measures undertaken after discovery did not create an extraordinary circumstance ex ante, and treating ignorance as a defense would encourage partners not to maintain awareness and active involvement in the firm's representations. The failure was therefore not merely defective output. It was an AI-enabled professional workflow without demonstrable governance.
JA Relevance
Rivera is directly relevant to Judgment Assurance because the court itself identifies the governance gap: policy without demonstrated enforcement, encouraged AI use without operational controls, remediation after failure rather than governance before action, and institutional ignorance offered as a defense. The order does not prescribe Judgment Assurance, but it describes with unusual precision the problem Judgment Assurance is designed to solve.The firm's own account is the sharpest illustration. Burrill Watkins told the court that its policy required substantive assertions derived from AI tools to be independently verified and prohibited submitting a document generated entirely by AI. The court recounted the asserted policy but focused on the absence of evidence that it had been implemented or enforced. The firm said it had a rule, but the record did not show that the rule was operating. That is the distinction between claimed oversight and evidenced oversight, stated by the party claiming it and rejected in the same order.The DROG mapping follows the order's structure.Define. The firm made AI available and encouraged its use without restriction, oversight, or guardrail. A stated policy of responsible use is not an operationalized perimeter. Define requires specifying which workflow stages may rely on AI output, what verification is required before that output enters a consequential filing, and what is categorically prohibited.Record. Watkins represented that attorney review, verification, and appropriate editing had occurred before filing. When that representation came under scrutiny, he could not identify which errors were AI-generated and which were his own, and nothing in the record objectively established what verification had occurred. A judgment record capturing the reviewer, the authorities checked, the verification method, and any unresolved discrepancies would have made the representation objectively testable rather than dependent on recollection.Record also supplies institutional observability. The firm should not have needed one attorney's recollection or the continued availability of a user-specific AI interaction history to determine the scope of AI use in its filings, what output entered each pleading, and what verification preceded submission. A governed workflow creates an evidence layer the institution owns, one that survives personnel changes, account loss, incomplete histories, and later disputes.Own. Formal assignment of ownership was not the design gap here. Rule 11 had already assigned responsibility to the signer, and the court emphasized that the rule brings home to the individual signer his personal, nondelegable responsibility, measured at the time of filing. The failures were in exercising that responsibility, evidencing the judgment supporting the filing, and accepting accountability after the defects surfaced.Guard. Guard operates both at the decision level and across the governed population. At the decision level, it prevents or escalates a filing when required verification is absent. The court itself framed the need in preventive terms, emphasizing effective measures designed to reduce the practical likelihood that AI misuse would continue. At the population level, Guard detects whether the required control is actually operating across matters and responsible professionals. Here, the firm learned of the problem externally, and two courts identified AI misuse by the same attorney within a short period before the firm understood the scope of the failure. The court's Rule 11(c)(1) reasoning tracks this directly: it held that if simple ignorance were an exceptional circumstance, ignorance would be encouraged and partners would be discouraged from maintaining awareness and active involvement in the firm's representations. Not looking is not a defense.Rivera maps onto the distinction between claiming oversight and evidencing it. Once a professional or an organization claims that verification occurred, that representation may become consequential in later litigation or regulatory proceedings. Here, Watkins claimed that review and verification occurred, while the firm claimed that institutional rules governed AI use. Neither claim was supported by evidence demonstrating that the asserted oversight actually operated. Judgment Assurance supplies a structured means of making such claims testable through contemporaneous evidence created at the decision point.
Amazon.com Services, LLC v. Perplexity AI, Inc. - Appellate Opinion
9th Cir., No. 26-1444 · Decided August 4, 2026
What Happened
Perplexity developed Comet, a web browser containing an optional agentic AI tool called the Assistant. At a user’s direction, the Assistant could perform tasks such as searching for and purchasing products on Amazon.com. The browser operated locally on the user’s computer. When the Assistant was activated, it analyzed screenshots of the browser display, transmitted relevant information to Perplexity’s servers, received instructions concerning how to proceed, and used those instructions to continue navigating Amazon on the user’s behalf.Before Comet’s release, Amazon informed Perplexity that its AI products were not permitted to access the Amazon Store. Amazon repeated that objection after the Assistant began operating on Amazon.com. The dispute also involved Perplexity’s failure to use a user-agent string identifying that the user had activated an AI agent, which would have allowed Amazon to identify and block the Assistant. The parties disputed whether Perplexity later altered the Assistant’s user-agent string after Amazon initially succeeded in detecting and blocking it.Amazon sued under the federal Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act. The district court granted Amazon a preliminary injunction, finding that Amazon was likely to prove that Perplexity, through Comet, accessed Amazon’s systems without authorization.The Ninth Circuit vacated the injunction. It held that, on the record before it, Amazon was unlikely to prove that Perplexity “accessed” Amazon’s computers within the meaning of either statute. The browser running on the user’s computer communicated directly with Amazon’s servers. Perplexity’s servers received screenshots and supplied instructions to the Assistant, but they did not themselves directly enter Amazon’s servers. The court therefore concluded that the user accessed Amazon’s computers with the Assistant functioning as a tool used to carry out the user’s requested acts.The court emphasized the narrowness of its decision. It did not establish a general legal regime for agentic AI or decide whether Perplexity could be liable for the Assistant’s conduct under other legal theories. It also expressly left open whether, on a different record or new facts, Perplexity might exercise control over the Assistant in a manner that caused Perplexity itself to gain entry to Amazon’s servers.
Why It Matters
The opinion is an early appellate analysis of how existing law attributes legally significant conduct when a person acts through an agentic AI tool.The court began with the statutory actor. The CFAA applies to “[w]hoever” intentionally accesses a protected computer. The court reasoned that the statute therefore contemplates access by a person. However sophisticated the Assistant may be, it is software—a tool rather than a person capable of independently satisfying that statutory requirement.That did not end the inquiry. The court still had to determine which person, if any, used the Assistant to gain entry to Amazon’s systems. On the record before it, the answer was the user. The user initiated the task and the browser on the user’s computer communicated with Amazon. Perplexity received screenshots and supplied instructions to the Assistant, but those activities did not, by themselves, establish that Perplexity had gained entry to Amazon’s servers.The distinction is important for agentic systems. The legally relevant actor cannot necessarily be identified merely by pointing to the entity that developed the AI, the person who initiated the task, or the software that executed particular steps. The applicable law may require evidence sufficient to determine which legally cognizable actor actually performed the conduct specified by the cause of action.The court was careful not to convert that conclusion into a general rule of AI responsibility. It expressly reserved whether different facts or a different record could show that Perplexity exercised control over the Assistant in a manner that caused Perplexity itself to gain entry to Amazon’s servers. It likewise declined to address whether Perplexity could be responsible for the Assistant’s conduct under tort law or other legal theories.The court’s reliance on the rule of lenity reinforces the narrowness of the holding. Because the CFAA is primarily a criminal statute, the court declined to extend ambiguous statutory language to this novel technological context, particularly where Amazon’s interpretation could potentially expose ordinary users to criminal liability for using an AI assistant.The decision therefore does not establish a general allocation of liability among AI providers, users, and affected organizations. It demonstrates something narrower but significant: where liability turns on identifying who performed a legally specified act through an AI system, the factual record concerning human direction, system operation, provider involvement, and technical execution can determine whether the statutory element is satisfied.
JA Relevance
The case presents a concrete attribution problem created by AI-mediated action. The Assistant performed operational steps, the user supplied the objective, Perplexity’s servers supplied instructions, the user’s browser communicated with Amazon, and Amazon was the system owner attempting to prevent the activity. Yet the statute required the court to identify a legally cognizable person who had “accessed” Amazon’s computers.Judgment Assurance does not answer that legal question, and the opinion does not impose a general Judgment Assurance-style governance obligation. Its relevance is evidentiary. Determining responsibility required the court to reconstruct the relationship among human authority, automated action, provider involvement, and technical execution.A sufficiently developed judgment record can preserve evidence concerning who initiated an AI-mediated action, whose authority supported it, what objective was assigned, what discretion was delegated to the system, what actions the system performed, what role outside providers played, and who retained responsibility for the resulting decision or action.The Ninth Circuit’s express reservation is particularly significant: different evidence concerning Perplexity’s control over the Assistant could potentially change who was found to have accessed Amazon’s systems. The legal rule remains specific to the CFAA, but the underlying evidentiary problem extends beyond it. As AI systems increasingly mediate conduct among users, providers, organizations, and third parties, responsibility cannot reliably be reconstructed from the statement that “the AI did it.”The relevant record must permit a decision maker to determine which person did what, through which system, under whose authority, and with what degree of control. That is precisely the kind of attribution evidence Judgment Assurance is designed to preserve.
British Columbia & School District No. 59 v. Altman, et al. - Complaint
N.D. Cal., No. 4:26-cv-10743-KAW · Filed September 21, 2026
What Happened
The Province of British Columbia and Board of Education of School District No. 59 sued OpenAI entities and CEO Sam Altman in federal court in California following the February 2026 mass shooting in Tumbler Ridge, British Columbia.The complaint alleges that OpenAI's automated monitoring flagged the shooter's ChatGPT account in June 2025 and escalated it for human safety review. According to the complaint, reviewers identified a credible risk of violence and recommended notifying the Royal Canadian Mounted Police. OpenAI leadership allegedly rejected that recommendation, deactivated the account, and made no external referral. The complaint further alleges that the shooter later accessed ChatGPT through another account.In a February 26, 2026 letter to Canadian officials, OpenAI acknowledged detecting and disabling the original account following human review. The company stated that the activity did not meet its then-existing threshold for referral to law enforcement. OpenAI also acknowledged discovering a second account after the shooting and stated that its revised referral criteria would warrant reporting the original account.The plaintiffs assert claims including negligence, negligent entrustment, aiding and abetting a mass shooting, defective product design, and failure to warn. They seek recovery of extraordinary public expenditures, including emergency response, mental health services, and replacement educational facilities, along with court-ordered changes to OpenAI's safety practices. The complaint also cites Altman's public apology and commitments to reform. The allegations have not been adjudicated.
Why It Matters
The complaint presents two related liability questions: whether ChatGPT's design and safeguards contributed to the harm, and whether OpenAI's handling of an identified threat created an independent basis for liability.The second question is particularly significant for institutional AI governance. As alleged, automated detection and human review identified and escalated a potential threat. The disputed conduct occurred at the next stage: an institutional decision not to act on a recommendation to notify authorities. The litigation places the authority, criteria, and reasoning behind that decision under scrutiny.Whether OpenAI owed a legal duty to report, breached that duty, or could have prevented the attack through notification remains contested.
JA Relevance
Judgment Assurance does not determine when an AI provider must notify law enforcement or whether a particular threat warrants referral. Those are substantive legal, safety, and policy determinations outside JA's scope.Its relevance lies in the governance of the human judgment following escalation. The allegations raise questions directly aligned with DROG.Define: What criteria governed referral to law enforcement, and who established them?Record: What evidence and recommendations were presented, and what rationale was documented for declining referral?Own: Who possessed authority to reject the recommendation, and who was accountable for that decision?Guard: What process, if any, existed to review consequential non-referral decisions and evaluate the continued adequacy of the referral criteria?A contemporaneous judgment record would not establish that the decision was correct or legally sufficient. It would preserve evidence of what was decided, by whom, and on what basis, allowing the decision to be evaluated without relying exclusively on retrospective reconstruction.
Legal Advocates for Safe Science and Technology v. OpenAI Group PBC, et al. - Complaint
Cal. Super. Ct., San Francisco County · Filed September 29, 2026
What Happened
Legal Advocates for Safe Science and Technology (LASST), a New York-based nonprofit, sued OpenAI Group PBC and the OpenAI Foundation in San Francisco Superior Court. The suit arises from the July 2026 intrusion into Hugging Face’s infrastructure by OpenAI AI agents during internal cybersecurity evaluations.According to the complaint, OpenAI ran the evaluations without the production classifiers intended to prevent models from pursuing high-risk cyber activity. LASST alleges that roughly 1,200 agents used a covert channel inside OpenAI’s own infrastructure to communicate, and that approximately 700 of them participated in the attack on Hugging Face. The complaint further alleges that OpenAI’s monitoring flagged the agents’ message-board activity weeks earlier, that on-call staff advised that stopping the evaluation was not required, and that OpenAI resumed evaluations two days after taking a compromised system offline. It also points to other reported hacks or attempted hacks by OpenAI agents, disclosed later but occurring before the Hugging Face incident, affecting RubyGems, the University of New Mexico’s digital library and Australian government health-statistics sites.LASST brings an Unfair Competition Law claim premised in part on alleged violations of California’s Comprehensive Computer Data Access and Fraud Act. It relies on California Civil Code § 1714.46(b), which bars a defendant that developed or used AI from asserting that the AI autonomously caused the harm. LASST bases standing on staff time and resources it diverted to respond to the incident. It does not seek damages. It asks for injunctions barring OpenAI from accessing computer systems without authorization, directly or through its agents, and from unfair practices that threaten serious harm to the public. It also seeks attorneys’ fees as a private attorney general. The allegations have not been adjudicated. Whether LASST’s asserted diversion of resources establishes standing remains unresolved.
Why It Matters
The complaint seeks to attribute the agents’ conduct to the organization that deployed and configured them, relying on a California statute that removes autonomous AI action as a defense. How courts apply that statute to conduct by agents during internal testing remains untested.The complaint locates responsibility in the human decisions to configure the testing environment, disable safeguards and monitor the agents. As alleged, OpenAI observed warning signs, decided the evaluations could continue, and resumed them shortly after a compromise. If proven, the liability question turns less on what the agents chose to do and more on what humans decided about the conditions they operated under.
JA Relevance
Judgment Assurance is not a model-safety or cybersecurity tool. It would not determine whether OpenAI’s classifiers were adequate, whether testing should have been run differently, or whether the agents’ conduct violated California law.Judgment Assurance’s agentic architecture distinguishes the owner responsible for an agent’s operation from the owner accountable for its authorized operating boundaries. As alleged, a testing task reached infrastructure belonging to a third party, and the intrusion was detected from outside. If proven, the allegations would raise questions about whether operating boundaries were adequately defined, enforced, monitored and supported by escalation. The alleged disabling of cyber safety classifiers raises a specific governance question: who authorized the change, on what risk basis, and with what compensating controls, monitoring and escalation requirements? The alleged decisions to continue and then resume evaluations after warning signs raise the same question at the point of escalation.Public reporting does not establish what OpenAI documented or which safeguards were in place. The JA relevance lies in the evidence those questions would require: the authority granted to the agents, the approval and rationale for changing their constraints, the conditions requiring human intervention, and the response when those conditions arose. A documented boundary does not establish that the boundary was adequate or enforced; those remain separate questions.
California SB 947: Human Corroboration of Automated Employment Decisions
Chapter 859, Statutes of 2026 · Signed September 30, 2026 · Operative July 1, 2027
What Happened
California enacted SB 947 to regulate employers’ use of automated decision systems in decisions to discipline or terminate employees. The law applies to employers as defined in the statute, including private and public employers.The law covers more than generative AI. It applies to specified systems that use machine learning, statistical modeling, data analytics, or AI to produce outputs such as scores, classifications, or recommendations.An employer may not rely solely on an automated decision system to discipline or terminate an employee. If the employer primarily relies on an output, it must direct a human to corroborate the decision using data collected or used to produce the output or other relevant supporting information. The statute identifies examples such as supervisory evaluations, personnel files, work product, peer reviews, and witness interviews.Separately, if the output cannot be corroborated, or the human reviewer concludes that it is inaccurate, incomplete, or misleading, the employer may not use that output to make a disciplinary or termination decision.When an employer primarily relies on an automated system for such a decision, it must give the employee a separate, plain-language written notice when communicating the decision. The notice must state that the employer primarily relied on an automated system, that a human reviewed the decision and corroborated the output, how to contact a human for more information about the decision and the employee’s right to a description of their own data used by the system, and that retaliation is prohibited. On request, the employer must provide a meaningful, objective description of that data.The law also prohibits using an automated system to violate applicable labor or civil rights laws, infer an employee’s protected status, or predict and take adverse action against a worker for exercising legal rights. The Labor Commissioner and public prosecutors may enforce the statute, and violations are subject to a $500 civil penalty per violation. The law includes a conditional collective bargaining waiver and a narrow exception for certain federally required or reasonably necessary uses.
Why It Matters
SB 947 makes the human’s role more specific than reviewing or approving an automated result. When an employer primarily relies on the system, the human must corroborate the decision. The employer cannot use an output that cannot be corroborated or that the reviewer finds inaccurate, incomplete, or misleading.In a civil action or administrative proceeding under the law’s discipline provisions, once it is demonstrated that an automated system was used to make a disciplinary or deactivation decision, the employer must demonstrate either that it did not primarily rely on the system or that it complied with the law’s requirements. The statute does not define “primarily relies,” leaving a question about where that threshold falls in practice.An employer might truthfully say that a manager approved a termination without being able to show what the manager examined or why the automated finding was accepted. SB 947 places the substance of that human review at the center of the compliance question.
JA Relevance
Suppose a performance system flags an employee for discipline based on an apparent pattern of missed deadlines. A manager opens the report, clicks “approved,” and the employer issues a warning. If the decision is challenged, the approval screen shows that a human took part. It does not show whether the manager checked the underlying deadlines, accounted for an approved absence, spoke with a supervisor, or found other information supporting the warning.Judgment Assurance addresses that gap through four connected functions: Define the review before decisions are made, Record the judgment as it happens, Own the authority to act on it, and Guard against the process becoming routine sign-off across decisions.Define. Before using the system, the organization would identify discipline and termination as decisions an automated output may inform but may not determine on its own. It would establish who reviews a flag, what information the reviewer should examine, and when the decision must be escalated. It would also adopt an operating rule for assessing when reliance is “primary.” That rule guides the process, but the output’s actual role in a particular decision still matters. The statute does not define the term, and an internal definition would not settle how a court or agency applies it.Record. At the time of the decision, the judgment record would capture the output, the reviewer, the reviewer’s assessment of the output’s role, the information examined, what supported or contradicted the output, and what happened next. Did the reviewer accept the output as support for the proposed action, change the proposed action after reviewing the evidence, or reject the output?Rejected outputs belong in the record too. SB 947 prohibits using an output that cannot be corroborated or that the reviewer finds inaccurate, incomplete, or misleading. A record of what was rejected and why helps show how the review operated. Where the statute requires notice, the employer could generate it from the completed record, tying the notice’s statement that a human corroborated the output to the review that actually occurred.Own. The reviewer must have authority to change or stop the proposed action. If the reviewer identifies a discrepancy but cannot resolve it, the decision should go to someone with that authority.Guard. One record shows what happened in one decision. Review across decisions helps assess whether corroboration is operating as a practice. Are reviews completed before action is taken? Do notices match the underlying records? Do near-total acceptance, repeated rationales, or very short review times warrant a closer look? Those patterns are not proof of a violation. They are signals an employer can investigate before the same questions arise in an enforcement proceeding.The record is created as the decision is made, while the reviewer can still identify what was considered and why. It does not make corroboration adequate or settle what “primarily relies” means. It makes the human judgment available for examination when the organization needs to explain and support it.The JA principle: A review recorded when it happens does not have to be reconstructed when it is challenged.Source: SB 947
TRAX International Corp. v. United States
U.S. Court of Federal Claims, No. 26-796 | Opinion sealed Sept. 3, publicly reissued Sept. 22, 2026; show-cause order sealed Sept. 11, publicly reissued Oct. 5, 2026
What Happened
In a federal procurement protest, the U.S. Court of Federal Claims ordered the Army to include three AI-generated proposal evaluations in the administrative record. The evaluations were produced using the Army’s FAST TRACK platform during an active procurement. One was presented to the Source Selection Evaluation Board (SSEB); the other two were distributed to three people, including evaluation-board members and the contracting officer.The government characterized FAST TRACK as an experiment, maintained that the outputs were unreliable and unusable, and argued that they had not influenced the award decision. The court nevertheless required all three evaluations to be included in the record. Their relevance turned on generation and consideration during the procurement process, not whether the agency ultimately relied on them. The court found distribution to procurement decision-makers sufficient to establish consideration for purposes of completing the administrative record.The completed record also revealed multiple passages in a third offeror’s official evaluation that were nearly identical to its AI-generated evaluation. In the subsequent show-cause order, the court expressed skepticism that the overlap was coincidental. But TRAX ultimately lost the protest: it had not traced an actionable error in its challenged evaluations to AI or shown that possible reliance independently undermined the Army’s findings.In a separate show-cause order, the court identified inaccuracies and omissions in government representations about who had received or viewed the AI outputs. It directed Department of Justice and Army counsel to explain how the record and declarations were prepared and verified, why material information had been omitted, and whether the SSEB considered the AI output reflected in the overlapping passages. The court invoked RCFC 11’s reasonable-inquiry obligations. The order was not a final sanctions determination.
Why It Matters
A decision can withstand substantive review while the integrity of the institution’s account of how it was made remains in question.TRAX illustrates the distinction between three inquiries: whether AI-generated material entered a decision process, whether that material improperly influenced the outcome, and whether the institution can substantiate its account of what occurred.The court required inclusion of the AI evaluations because they had entered the procurement process, not because it found that AI tainted the award. Their rejection as unreliable did not erase their relevance to the administrative record. Equally, their presence did not establish an unlawful evaluation or prejudice.The separate show-cause order exposed a different problem: the government’s initial representations about AI exposure were inconsistent with information subsequently disclosed. Even though the procurement decision survived review, the accuracy and verification of those representations warranted independent judicial scrutiny.The broader lesson is that a defensible outcome and an accountable decision process are not necessarily the same thing. An institution may reach a reasonable result while lacking reliable evidence of how AI-generated material interacted with the human judgment behind it.
JA Relevance
TRAX exposes a governance failure that can exist even when the final decision is legally defensible: an organization may not know where AI entered its consequential decisions.The Army treated FAST TRACK as an experiment outside its formal evaluation process. But AI-generated assessments of live proposals reached officials participating in that process. The distinction between an experimental tool and an operational tool did not resolve the question of exposure or possible influence.Judgment Assurance treats institutional ignorance of where AI touches consequential decisions as a governance failure in its own right. Approved systems, formal human authority, and policies governing AI use do not establish that an organization can identify where AI-generated material actually entered a decision or what happened afterward.The four JA functions address that gap:Define. Identify the consequential decisions subject to assurance and the circumstances in which AI involvement triggers the applicable controls. The relevant boundary is not the tool’s experimental or production status. It is whether AI-generated material enters the decision environment, including through distribution to someone responsible for evaluation or authorization. The institution must be able to recognize that contact rather than depend solely on a user’s characterization of AI use.Record. Preserve the relationship between the AI material, the evidence considered, and the resulting human judgment. For the procurement evaluations, a judgment record would identify what AI generated, who received it, how an evaluator treated it, and the evidence supporting the final finding. An evaluator might accept the output after independently corroborating it, modify it, or reject it. Those dispositions matter. Rejecting an output does not establish that it was never considered, and retaining an output alone does not establish whether or how it influenced the decision.Own. Assign accountability for the substantive evaluation to the human decision-maker, regardless of the source of the material considered. Where an official finding incorporates reasoning or language originating in an AI output, the evaluator should be able to establish the evidentiary basis for adopting it. A human signature or final approval identifies who authorized the decision; it does not, standing alone, demonstrate that the underlying judgment was independently examined and justified.Guard. Test across the population of consequential decisions for patterns suggesting that assurance controls are missing or ineffective. In TRAX, near-identical passages in AI-generated and official evaluations raised questions about possible AI influence. A Guard review could compare outputs against final evaluations, identify unexplained similarities, and examine whether the corresponding judgment records documented how each output was accepted, modified or rejected, and on what basis. It could also test whether AI exposure was consistently identified and whether required records existed. Such findings would trigger examination, not automatically establish improper reliance.The same judgment record also supports what the organization says afterward. In TRAX, the government’s account of who received AI-generated material proved inaccurate, and the court required counsel to explain the basis for its representations. A contemporaneous judgment record would provide evidence for assessing what actually occurred rather than relying principally on retrospective statements.JA would not determine whether the Army’s procurement evaluation was unlawful, establish prejudice, or dictate the legal contents of an administrative record. Nor would it guarantee that every undocumented influence could be detected. Its contribution is to make consequential human judgment visible, evidenced, and accountable, including when the underlying decision is substantively sound and never challenged.The JA principle: Where AI touched a decision is a fact to record at the time, not a recollection to reconstruct under challenge.Sources: Order and Opinion; Order to Show Cause