Can an AI Agent Sign a Contract for You?

Under US federal law, yes, and the question was settled twenty-six years ago. The E-SIGN Act states at 15 U.S.C. § 7001(h) that a contract "may not be denied legal effect, validity, or enforceability solely because its formation, creation, or delivery involved the action of one or more electronic agents so long as the action of any such electronic agent is legally attributable to the person to be bound."

Read that clause again with an autonomous agent in mind. The defence most people reach for first, that no human at the company reviewed the terms, is not a defence. It is the exact scenario the statute was written to cover.

This is not legal advice and jurisdictions differ. It is the background you need before you point an agent at anything that can click accept.

The law did not need to be updated for agentic AI

Both E-SIGN and the Uniform Electronic Transactions Act, adopted in most US states, define an "electronic agent" as a computer program or automated means used independently to initiate an action or respond to electronic records without review by an individual. UETA goes on to provide that a contract may be formed by the interaction of electronic agents even where no individual was aware of or reviewed the agents' actions or the resulting terms.

That language was drafted for automated ordering systems and web forms. It maps onto an LLM-driven agent without any strain at all, because the operative fact is not how sophisticated the software is. It is that a person deployed it to act.

So the interesting question was never "can it". It is "when is the action legally attributable to me", and that is where the actual risk lives.

Attribution is the whole ballgame

The statute's condition is that the electronic agent's action must be legally attributable to the person to be bound. In practice, an agent you deployed, configured, and gave credentials to is going to be attributed to you in most situations. The counterparty saw your account, your API key, your domain.

Three situations where this bites in ordinary business:

Accepting terms of service. An agent that signs your company up for a service has accepted that service's terms, including its arbitration clause, its liability cap, and its data processing terms. Nobody read them. They still apply.

Purchasing. An agent with a payment method that buys compute, credits, or a subscription has entered a contract. If it buys $9,000 of something at 3am, the argument that you did not authorise that specific purchase is a question about your internal controls, not about whether a contract exists.

Committing on your behalf in writing. An agent handling inbound email that replies "yes, we can deliver by the 14th at that price" may have created an enforceable commitment depending on the surrounding facts. This one worries people least and probably should worry them most, because it is the one with no spend limit attached.

What actually reduces your exposure

Since you cannot rely on "a machine did it", the controls have to be real.

Scope credentials to the agent

An agent should have its own account and its own credentials, never a human's. That gives you an audit trail, a revocation path, and a clear boundary on what it could possibly have done. It also means a compromised agent does not carry a person's full authority. We covered the reasoning in should an AI agent have its own user account.

Put a hard ceiling on spend

Not a prompt instruction, a limit enforced outside the agent. A virtual card with a monthly cap. A budget in the provider's console. A payment method that simply declines above a threshold. Instructions in a system prompt are guidance; a declined card is a control. Setting spending limits for AI agents covers the mechanics.

Require human approval for the specific act of agreeing

Distinguish reading from committing. An agent that browses, compares, fills a cart and stops at the checkout button is doing 95% of the work with almost none of the risk. Approval gates are cheap when they are narrow and specific, and unusable when they fire on everything.

Log what the agent saw, not just what it did

If a dispute arises, the useful record is the terms that were on screen at the moment of acceptance, not a line saying POST /accept 200. Capture the page, the version, and the timestamp. This is the difference between reconstructing what happened and guessing.

Sandbox anything exploratory

Agents that are being tested, tuned, or run against unfamiliar sites should not have live credentials at all. How to sandbox an AI agent covers isolating the blast radius.

The direction the other way

There is a second exposure that gets less attention: agents acting against you. If your own product has a signup flow, an agent can complete it, and the resulting contract is attributable to whoever deployed that agent, not to the agent. That is fine legally and awkward operationally, because your terms may assume a human read them.

If your product can be bought, configured or cancelled by software, it is worth deciding deliberately whether you want that, and saying so in your terms. "Automated agents may transact on behalf of an authorised account holder" is a different posture from prohibiting them, and either is better than not having thought about it.

The realistic summary

An AI agent can form a contract that binds you. The technology is new, the legal treatment is not, and the phrase "nobody at our company reviewed this" describes the statutory case rather than an exception to it. Everything that reduces your risk is a control you build outside the model: scoped credentials, hard spend ceilings, a narrow approval gate on the act of agreeing, and logs that capture what was agreed to.

For the broader question of accountability when automated systems get things wrong, see who is responsible when AI makes a mistake, and our overview of AI risks covers where this sits among the others.

FAQ

Is a contract signed by an AI agent legally binding?

Under US federal law, a contract is not invalid merely because an electronic agent formed it, provided the agent's action is legally attributable to the party to be bound. Whether it is attributable in a specific case depends on the facts, including whose credentials were used and what authority the deployer gave. Jurisdictions outside the US treat this differently, so take local advice.

Can I argue that I did not authorise a specific purchase my agent made?

You can argue it, and it is a question about your internal authority and controls rather than about whether a contract was formed. The statutes anticipate that no individual reviewed the transaction, which removes the simplest version of that argument. Enforced spend limits are a far more reliable protection than an after-the-fact dispute.

Should an AI agent ever click accept on terms of service?

For low-value, standard-terms services where you have already decided to use the product, this is a reasonable convenience with a spend cap behind it. For anything involving data processing, exclusivity, auto-renewal or a meaningful liability cap, put a human in the loop on the acceptance step specifically.

Does the EU treat AI agents forming contracts the same way?

Not identically. EU contract formation is largely a matter of national law rather than a single federal statute, and the EU AI Act adds transparency obligations around interacting with AI systems rather than rules about contract formation itself. If you operate in the EU, this needs local advice rather than an extrapolation from E-SIGN.

What records should I keep of an AI agent's transactions?

At minimum: which agent identity acted, the timestamp, the full content of what was agreed to as it appeared at that moment, the human who authorised the agent's scope, and any approval given for that class of action. Capturing the terms themselves is the part most teams skip and the part that matters in a dispute.