Law360 (September 1, 2026, 7:53 PM EDT) -- OpenAI's recent rogue artificial intelligence incident will likely set the stage for a more widespread expectation that companies using advanced, agentic AI have reasonable protective measures in place, as cyber incidents carried out by AI agents come to be viewed as foreseeable risks.

Experts told Law360 that companies should treat artificial intelligence as a core governance issue by practicing their responses to incidents such as rogue AI, maintaining detailed records of their programs to show regulators and courts, and implementing "kill switch" plans for worst-case scenarios.

And now that there are concrete and high-profile examples of some of these issues, firms should practice their response to similar situations and work out their human oversight of the technology, according to Bill Ridgway, co-head of the global cybersecurity and data privacy practice at Skadden Arps Slate Meagher & Flom LLP.

"This is just going to be something that we need to have in our DNA," Ridgway said.

A "Warning Shot" and Liability Questions

OpenAI disclosed in July that two of its artificial intelligence models broke out of their testing environment and accessed the servers of Hugging Face, a third-party AI and machine learning startup. The company said the incident was "driven by a combination" of its AI models GPT-5.6 Sol and "an even more capable pre-release model," which were both being internally tested to measure their cyber capabilities and, as a result, had normal safeguards that prevent the models from pursuing high-risk cyber activity turned off for evaluation purposes.

OpenAI published a report on Aug. 26 detailing the incident, saying in a blog post that the models "took actions that were misaligned with the goals of their assigned tasks — they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems."

The company said it strengthened certain security requirements, monitoring, training and incident response processes as a result.

"We consider this incident a 'warning shot' for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed," the company said in its Aug. 26 blog post, adding later that the incident "underscored how critical it is that we continuously improve our security, monitoring, and alignment, especially as our models reach a level of capability that could allow for real loss of control."

Ridgway said that as such events reoccur, it's hard to imagine the legal system wouldn't expect companies to think about these situations as foreseeable risks. That would impose a duty for companies to put "reasonable measures" in place to protect against those incidents, he said.

"Now, what those measures look like, I think that that will be the subject of much litigation," Ridgway said. "But at a high level, I'd be surprised if we were in a world where the systems could kind of go off and cause harm to other organizations and there wouldn't be a mechanism for some sort of accountability."

The proliferation of AI agents has created new business connections and structures, replacing a previous, more linear setup in which model providers put their technology into software tools that went downstream to customers who then gave access to users, according to Anna Gressel, global co-head of AI at Freshfields. While that old structure is reflected in various regulatory frameworks, the new connections posed by the technology have made the legal questions around AI liability more complex.

And as the technology and business realities "change every few months," there won't be clear answers to questions about liability anytime soon, Gressel said.

"We are really thinking afresh about many of these questions about regulation, accountability, liability, what the right paradigm is, what the right regulatory approach is, and how companies should be preparing for a new world of liability allocation," Gressel said.

Corporate Governance

Scott Levi, a White & Case LLP partner whose practice focuses on public companies, said that while the first step in adopting and implementing AI tools or policies should be to put together a governance structure, a lot of companies "are not even getting there right now," particularly outside the Fortune 100.

According to the April results of a Deloitte survey of more than 3,200 information technology and business leaders with direct involvement in their organization's AI programs, just 21% of respondents said their organizations have mature governance models in place for agentic AI.

Levi said one of the best practices — which a substantial number of the biggest companies have done — is to put the responsibility of AI oversight in the hands of the full board or a subset of the board, such as an audit committee.

While some states are enacting AI legislation, laws and regulations are generally stemming from an existing legal framework, Levi said. Public companies are bearing that in mind as they assess their approach to AI and put together broad policies at the board and management levels.

There are a variety of AI-related policies that firms are developing, including for employee use, customers, vendors and contracts, Levi said. He noted some firms are establishing policies for directors, as discussions at the board level can be "way more sensitive" than actions taken at the business level.

Levi said some actions companies are taking now include assessing AI use and the risks and opportunities posed by the technology, including regulatory, cybersecurity and reputational risks. Then, firms do some "controlled experimentation," Levi said, in which they roll out more AI products in a controlled environment before they actually start adopting or implementing specific tools or policies.

After establishing AI oversight, firms should revise their committee charters to document the responsibility and how managers report to the board or committee, and they should ensure that AI is a recurring agenda item, alongside updates in business, finances, cybersecurity and other developments, he said. They should also make sure there are "clear escalation paths from management to the board," he said.

Regulatory Pressures

Although the AI governance frameworks firms are implementing now vary by industry, some trends are converging based partially on the requirements of the European Union's AI Act, which was the world's first comprehensive regulation for AI and came into force in 2024, according to Skadden's Ridgway.

Under the EU's regulation, technology is classified by safety and risk, with systems for tasks such as spam filtering falling into the "minimal risk" category and being subject to voluntary codes of conduct from developers.

At the other end are systems for recruitment or assessing loan worthiness. These are deemed "high-risk" systems subject to strict requirements such as human oversight and activity logging.

Among other things, the law also bans systems that pose an "unacceptable risk" — including social scoring systems, some applications of predictive policing, and systems that "manipulate human behavior" — and it includes transparency requirements for general-purpose models that can perform tasks such as generating human-like text.

Ridgway said the EU AI Act is forcing companies to think through a risk-tiered approach and categorize use cases for the technology.

And the California Consumer Privacy Act — the 2018 law requiring businesses to ensure that consumers are able to access, delete and opt out of the sale of their personal information — requires businesses to conduct assessments for high-risk activities such as processing personal information using automated decision-making technology.

Those regulations "have tended to force, or at least induce," companies to have governance models that categorize use cases and implement measures around those use cases based on risk, Ridgway said. But governance frameworks should be flexible enough to allow employees to use AI to help do their jobs, he said, adding there are concerns about employees using non-enterprise models on a personal basis, if firms don't enable their workforce to use the technology.

Firms have been turning to frameworks put forward by the National Institute of Standards and Technology and the International Organization for Standardization — known, respectively, as the AI Risk Management Framework and ISO/IEC 42001. Those frameworks reflect a lot of the regulatory issues surrounding AI, Ridgway said, and they can help firms get their compliance and governance ready for future AI regulations instead of relying on any one current AI regulation.

Ridgway said firms should have a documented record of AI governance to prepare for future AI regulations and potential AI-related litigation.

"These things will inevitably, at some point, go awry. There will be some sort of issue, some sort of tech failure, some sort of leak of information," Ridgway said. "Those things will happen, and the best narrative to have if it does happen is that this was something that the company focused on and put a lot of attention to the governance, in order to try to mitigate those risks."

Pitfalls and Preparation

When it comes to preparing for extreme scenarios, such as rogue AI agents, Ridgway said the two most important governance concepts for firms are accountability and having some form of a "kill switch" human oversight for systems that present heightened risk. Firms should consider not only their ability to shut down the technology in such scenarios, but how fast they can do so and whether they've practiced that before a crisis hits, he said, noting there is a difference between having all the papers in line and practicing through rogue AI scenarios.

White & Case's Levi said some of public companies' biggest pitfalls are not taking AI governance seriously at the highest level of a firm, not having a member of the board who understands AI and can explain it to others, and not striking the right balance when it comes to the scope of AI policies. AI governance policies should be broad enough to encompass a variety of risks but also tailored to the company, he said.

"I see this all the time with publicly traded companies, they want something off the shelf, they want it to be tailored to them," Levi said. "It ends up being too generic, and then it's not really useful because it doesn't address day-to-day operations. But then the problem is that if you get too specific, then you're not addressing risks down the line that you haven't thought about."

Melissa Hodgman, a Freshfields partner and former acting director of the U.S. Securities and Exchange Commission's Enforcement Division, said a company's AI policies should be based on the company's risk profile, size and corporate culture, and critically, "shouldn't just be a binder sitting on the shelf."

"You don't want something that is not changing behavior," Hodgman said. "You want something that will actually be implemented on a day-in, day-out basis by your employees."

Hodgman said that while management owns implementation of AI, accountability falls to corporate boards. And the more authority or agency a company gives its AI, the more visibility it must have into how the technology works and makes decisions in real time, she said.

"While companies can delegate a task to AI, they can't delegate judgment," she said. "They can't delegate liability in the same way."

Hodgman said that during her time at the SEC, most of the investigations that went forward involved a company that had policies and procedures in place, but they weren't being enforced, followed or updated.

She said that when a regulator comes knocking, their three general questions are, what did you know, what controls did you have in place and did people follow them. Regulators "want to see that your efforts are there, that they are targeted towards the risk that you face or that you're bringing to your customers or to others in the system," she said.

Freshfields' Gressel said that regardless of a company's size, geography or industry, public companies are all struggling with how AI is changing underfoot so rapidly. And they're trying to balance the need to innovate "with the need to understand and get their arms around what's happening, how that's creating risk in the enterprise, and how they are going to appropriately manage that risk," she said.

Companies can build their AI governance on their existing good practices, Gressel said, noting that firms, particularly in regulated industries, usually have discipline, strong practices in different domains, and a risk management posture that "can be brought to bear with AI, with just some updates."

One best practice, across different sectors and firms, is having cross-functional AI governance policies, she said. While smaller companies may be able to work with oversight resting solely with a legal team or a business unit, for larger companies, it's a better practice to have oversight spread out across teams with a sufficient lineup to company leadership.

And as the landscape for legal liability may remain unclear in the near future, firms should document their reasoning for making decisions based on what they know now, she said.

"We're all learning about new AI risks, and many companies are making good faith efforts based on the information available to them," Gressel said. "That information may change in a year, and it may make sense to revisit the approach. But I think making sure that the companies are doing the best with information they have, and they're articulating why they think it's the best at the time — that can be a really helpful exercise as well."

--Additional reporting by Alex Baldwin and Allison Grande. Editing by Nicole Bleier and Emily Kokoll.

For a reprint of this article, please contact reprints@law360.com.