Senator Warner Makes a First Foray into Agentic AI Regulation

Ellen P. Goodman is a professor at Rutgers Law School and co-director of the Rutgers Institute for Information Policy & Law.

If recommendation algorithms gave online platforms the ability to control what people see online, agentic AI offers them an opportunity to control what people do. To this pessimistic vision, we can add a sunnier one. Truly independent AI agents may provide a computational counterweight to platform domination by empowering users. Agents working on their behalf can help people bypass dark patterns, find the best deals, and fact-check at scale. To try to move us towards that more pleasant future, Senator Mark Warner (D-Va.) released a discussion draft on June 29 of the AI AGENT Act, (“Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026”).

Agentic systems are AI models that do, not just propose. According to common definitions, they “perceive context, set and update goals, plan, and take action through tools or environments.” The AI AGENT Act is the first draft federal law to deal with agentic AI power. The Act is structured as an e-commerce consumer protection intervention, run through the Federal Trade Commission (FTC). It seeks greater competition and consumer choice in the market for AI agents, while also prohibiting large digital platforms from deploying double agents: AI user assistants that actually work for the platform’s benefit at the user’s expense.

Under the Act, for example, an Amazon consumer would be able to designate her own agent on fair, reasonable, and nondiscriminatory terms to manage purchases on the platform. If instead the consumer chose to use Alexa, Amazon would have to ensure that Alexa acted in the consumer’s interests, not Amazon’s. The Act recognizes that for this to work,

• agents would bear legally cognizable fiduciary duties to consumers;
• a consumer’s particular interests would have to be legible to agents;
• agentic behavior would have to be legible to consumers; and
• agentic interactions with the platforms and consumers would have to protect privacy and security.

These prerequisites are not yet in place, which is probably why this is a discussion draft.

The interoperable interface

The Act’s provisions concerning agentic access to large platforms essentially enact portability and interoperability requirements for AI agents. The Act would require large online platforms (those with at least 50 million US customers or subscribers) to maintain an “interoperable interface” as a portal for independent agents. Using this portal, consumers would have the right to designate and deploy “custodial user agents” (CUAs) of their choice for use in online interactions, rather than being forced to use the platform’s designate. CUAs are defined as “a software-based agent that is expressly authorized by a user to interact with a large online platform provider on that user’s behalf in a transparent, documented, scope-limited, and revocable manner.” Interactions might include shopping, selecting content and managing engagement, or adjusting account settings.

One of the regulatory progenitors to the Act is data portability. When users can port their data from one platform to another, they are less likely to be locked-in to a particular platform and can make a switch, notwithstanding the existence of network effects. Further back in the portability lineage is the concept of number portability for mobile phone users. The Telecommunications Act of 1996 required that wireline phone carriers enable customers to port their phone numbers to competing providers, which the FCC subsequently extended to mobile carriers, thus spurring mobile competition. Interoperability takes data exchange a little further by enabling one service, often through an open interface, to interoperate with another. The regulatory precedent here is the Federal Communication Commission’s 1968 Carterfone decision, ruling that monopoly landline telephone companies had to let users attach “interconnecting devices” (like telephones) to the public switched network. These historic interventions made possible consumer choice and competition in telecommunications markets and spurred innovation in ancillary markets (including ultimately the internet).

Senator Warner has tried before to apply portability and interoperability principles to concentrated digital markets. In 2019, he introduced the ACCESS Act to require large social media platforms to let users port their data to competing services and run independent services atop their social media feeds (for example, alternative algorithms). At the time, commentators promoted platform access for reasons that went beyond competition and consumer choice. People were waking up to how oligopolistic digital platforms could control communications and politics. One possible response was to regulate how big tech moderated content. This approach hit an iceberg in the case of Moody v. NetChoice (2024), which strongly signaled that private platforms are entitled to First Amendment protection for their choices in moderating content. An alternative approach was content-neutral structural regulation to support users who wanted to exercise autonomy over their own social media feeds.

Mike Masnick, in his 2019 paper “Protocols, Not Platforms,” argued for open protocols that let users control online content experience, perhaps by using third-party filters. This would let them shape their own exposure without aggrandizing platform power or impinging on the free speech of others. “Rather than relying on a few giant platforms to police speech online, there could be widespread competition, in which anyone could design their own interfaces, filters, and additional services, allowing whichever ones work best to succeed, without having to resort to outright censorship for certain voices.” A few years later, the scholar Francis Fukuyama made a similar proposal in “Making the Internet Safe for Democracy,” suggesting that “middleware” sitting between a platform and the user could empower users to control their own speech environments.

Congress never did adopt these proposals, nor any other digital platform regulation, so here we are today with the prospect of concentrated digital platforms deploying agentic AI in ways that further shape user experiences and possibly subvert user preferences. In a recent article, Mark Bartholemew and Samuel Becher predict that “shopping agents … will increasingly govern how markets work and what shoppers choose. Once an AI tool decides what products to show, which sellers to prioritize, and when to execute a purchase, it becomes a form of market infrastructure”, which they say constitutes “a new form of corporate power.”

In requiring large platforms to facilitate the interoperability of independent CUAs, the Act treads the path of the EU’s Digital Markets Act. The DMA requires digital “gatekeepers” to provide necessary access to support interoperability. It defines the desired end state as “the ability to exchange information and mutually use the information which has been exchanged through interfaces or other solutions, so that all elements of hardware or software work with other hardware and software and with users in all the ways in which they are intended to function.” If this is the path, it will be a rocky one as it has proven difficult to enforce the DMA’s interoperability provisions in such cases as Meta’s and Apple’s.

Faithful agents

The AI AGENT Act takes a belt and suspenders approach to user empowerment. It’s not enough that users can bring their own agents to the platform. The other main part of the Act requires that CUAs, including those deployed by platforms, faithfully serve users. This fidelity component also has an antecedent in the land of never-adopted US platform regulatory proposals. It is the idea of the information fiduciary. Scholars Jack Balkin and Jonathan Zittrain proposed that digital platforms serve their customers under constraints similar to those burdening doctors and lawyers: an obligation to keep data private and secure, and to act in the best interests of those they serve. They used Google’s behavioral advertising to exemplify the unfaithful abuse of data. Rather, these platforms should not “leverage personal data to unfairly discriminate against or abuse the trust of end users…[and] not sell or distribute consumer information except to those who agreed to similar rules.”

An AI agent acting against the interest of a user can do more harm than a Google ad. The Act’s solution to this problem is to require that CUAs be faithful to user interests. Providers of CUAs (platforms and other providers) would have to register their CUAs with the FTC before they can act as a user’s representative. The affirmative duties of CUAs would include:

• safeguarding user data privacy (including usage limitations) and security;
• maintaining real-time records of actions they take on the user’s behalf and making those records available to the user;
• not acting to benefit the CUA at the user’s expense, in ways that cause reasonably foreseeable harm to the user, or inconsistently with the user’s directions or reasonable expectations;
• not delegating authority to another agent without express and revocable permission.

The Act envisions that the FTC would offload a certification function to recognized independent certification entities. Certification of compliance with the CUA affirmative duties would constitute a rebuttable presumption in favor of the CUA in any action against the provider.

It needs to be said that keeping CUAs faithful, and verifying that they have not strayed, poses a very hard technical problem. It’s not clear that even the most agreeable providers can entirely control agentic behavior. Depending on the complexity of the agentic system, an OpenAI paper reports that agents may act “over an extended period of time, without their behavior having been specified in advance.” This operation creates many points for deviation from user interests, as the agent may or may not perceive them. The Partnership on AI notes that failure at any point “can unpredictably shift the agent’s course, with errors compounding as the process unfolds.” Errors may arise from bad data or tool selection, a bad plan, or bad coordination, and they may be very hard to detect.

Implementation obstacles and limitations

Auditing

Releasing the Act as a discussion draft is a tacit acknowledgement that we do not have the technical capabilities to govern agents as specified.

The proposal requires the development of new technical standards for agentic operation and verification: reliable records of what an agent did and why; a kill-switch to allow a user to revoke consent from an agent; and security and privacy controls better than the state of the art. Focusing just on the records part, it seems reasonable to demand records of agentic goals and execution processes. Such a trail might reveal that the agent had gone rogue or was actually a double-agent working for the platform or a third party against the user’s interests. But it turns out that this kind of reliable “chain-of-thought” explanation is not available now. Moreover, in multi-agent settings where agents interact with each other, “undesirable outcomes cannot be traced back to responsible agents.”

The prematurity of the legal requirements is not fatal if the institutional capacity is there to force technological progress. As Georgetown Center for Security and Emerging Technology executive director Helen Toner testified to Congress in 2024 (in a different position), there are many enabling steps Congress can take to push the development of auditing science and standards. I was lead author of the National Telecommunications and Information Administration AI Accountability Policy Report published the same year that detailed government forcing functions and supports to foster an independent auditing ecosystem.

Fiduciary responsibility

To the questions about how we can gauge agentic behavior, we can add questions about how the agent can gauge the user’s interests. Acting in the user’s interests is at the core of the agent’s fiduciary obligations. In his work on the application of agency law to AI agents, scholar Noam Kolt explores how an agent’s “fiduciary duty to act loyally for the principal’s benefit in all matters connected with the agency relationship” might work in the agentic AI context. He finds that it’s not at all straightforward and would require specific “mechanisms … to be integrated into both the design of AI agents and the regulatory frameworks that govern them.”

Perhaps one of those mechanisms should deal with how consumers express preferences to their agents. Consumers make choices reflecting multivalent and sometimes conflicting considerations of function (e.g., price and quality), social value (e.g., status and conformity), and emotional value (e.g., ethics and aesthetics). Maybe these can be specified clearly to an agent, but maybe the agent must infer them dynamically. It may be that an agent’s plausible, but mistaken, inference will be difficult to untangle from self-preferencing.

Political

The FTC is tasked with registering CUAs and enforcing the Act under its authority over unfair or deceptive acts or practices. After the Supreme Court’s decision in Trump v. Slaughter (2026), which upheld the President’s authority to fire independent agency commissioners, implementation of consumer protection has to reckon with a more politicized and less independent FTC. Some of the Act’s provisions may assume too much independence, especially the registration requirement.

The Act does not accept Masnick’s and Fukuyama’s invitation to view platform power as a threat to free speech and democracy. Because it is focused on commerce only, its more limited remit has the advantage of keeping the most serious First Amendment arguments at bay. But it also leaves platforms free to self-preference outside of trade practices, such as in the promotion of certain communications. This is not to say that commercial agentic AI regulations have nothing to do with larger speech issues. Piloting rules to secure agentic AI power for the people might have beneficial effects in discourse even if the regulations don’t reach there. By accelerating standard setting and interoperability interfaces, the Act could promote an ecosystem that makes it easier for users to deploy agents in noncommercial contexts as well as for commerce.

The deeper questions about delegation to agents

As a consumer protection bill, the Act seeks to protect consumer sovereignty. This is already extremely ambitious. What it doesn’t touch is the harm that comes from ceding cognitive work to an agent. It’s interesting to think about those harms even in the narrower confines of commerce. Bartholomew and Becher observe how even shopping requires, and can build, cognitive capacity in balancing conflicting values (price, ethics, quality, etc) and shaping and reforming preferences. “A shopping agent trained on a consumer’s past shopping behavior risks becoming a machine for freezing the self, ossifying consumer identity into an algorithmic profile. It also compresses anticipation into an instant notification, while narrowing exposure to the unexpected.”

This cognitive offloading and flattening will happen even with the most faithful and interoperable agent. This is not a criticism of the discussion draft, just an observation that commercial regulation cannot address the deeper questions swirling around AI: what human capacities should persist and be nurtured, and through what mechanisms?