My AI agent placed an order or accepted terms on my behalf. Am I legally bound by it, and can I undo it if the agent got it wrong?

What should I check, step by step?

1. Assume an order or sign-up your agent completed with your account, card or credentials binds you, the same as if you had clicked it yourself. Plan your controls around that, not around undoing it later.

2. Write down what the agent is allowed to agree to: which merchants or services, maximum amounts, contract length, auto-renewal, and whether it may accept new terms of service at all.
3. Keep the agent from accepting terms or placing orders outside that list on its own. Route anything new (a new vendor, a subscription, a minimum term, an amount above your threshold) to a person, and bind the approval to the exact merchant, amount and terms.
4. Give the agent its own credential (a scoped key, virtual card or delegated payment token) instead of your main login, so its actions are traceable to that credential and you can cut it off.
5. Keep the merchant's confirmation page, the terms version shown at checkout, the order id and your approval together, recorded at the time and outside the agent.
6. If the agent got it wrong, act fast: tell the other party in writing that the order was a mistake and you don't intend to be bound, don't use what was delivered, and offer to return it. Then check the merchant's own cancellation and refund terms.
7. If the mistake involved a card charge, also look at the card-dispute route (billing error or merchant dispute), which is separate from whether the contract binds you.
8. If you run the merchant side, give buyers' agents and the people behind them a clear chance to review and correct an order before it's final. UETA section 10 lets an individual avoid an error made with your electronic agent when your system gave no such chance.

Is a contract or order my AI agent made legally binding on me?

The federal E-SIGN Act, 15 U.S.C. 7001(h), says a contract or record relating to a transaction in interstate or foreign commerce may not be denied legal effect, validity or enforceability solely because its formation, creation or delivery involved the action of one or more electronic agents, so long as the action of any such electronic agent is legally attributable to the person to be bound.

• UETA, a uniform state law most states have adopted, defines an electronic agent as a computer program or other automated means used independently to initiate an action or respond to electronic records, in whole or in part, without review or action by an individual. Virginia's enactment (Va. Code 59.1-480 and following) is a typical example. Section 14 (Va. Code 59.1-492) says a contract may be formed by the interaction of electronic agents of the parties, even if no individual was aware of or reviewed the agents' actions or the resulting terms, and that the terms are determined by the substantive law that applies to the contract.
• Section 9 (Va. Code 59.1-487) says an electronic record or signature is attributable to a person if it was the act of the person, which may be shown in any manner, including the efficacy of a security procedure applied to identify the person. Its effect is decided from the context and circumstances at the time, including the parties' agreement. UETA also applies only between parties that have agreed to transact electronically, which can be inferred from their conduct (section 5).
• Researchers are working on how these older rules map onto today's AI agents. Stanford CodeX's Agentic GenAI Transaction Systems project starts from the hypothesis that UETA, E-SIGN and related frameworks can address many of the issues agentic AI transactions raise, with attribution of actions to legal parties as a core problem.

Can I cancel or avoid a purchase my AI agent made by mistake?

UETA section 10 (Va. Code 59.1-488) has two error rules. If both parties agreed to a security procedure to detect errors and only one followed it, that party can avoid the effect of the changed or erroneous record. And in an automated transaction involving an individual, the individual can avoid the effect of an error they made while dealing with another person's electronic agent, if that agent gave no opportunity to prevent or correct the error and the individual promptly notifies the other person, takes reasonable steps to return or destroy what they received, and hasn't used or benefited from it. These two rules can't be varied by agreement.

• Neither rule is written for your own AI agent misreading your instructions. In that case section 10 points to other law, including the law of mistake, and to the contract itself. Outcomes depend on the facts and the state, so the merchant's cancellation policy and a fast, clear notice are often your best practical route.
• A card dispute is a separate question from whether the contract binds you. US card rules treat charges by someone you gave authority to, who then exceeds it, as authorized until you tell the issuer otherwise; see the related answer on disputing an agent's card purchase.

What records do I need if my AI agent's order or contract is disputed?

Attribution and error disputes turn on what you actually authorized and what the other side's system showed. Keep, outside the agent and made at the time: the instruction or policy the agent acted under, the limits in force, any approval for this order bound to the exact merchant, amount and terms, the merchant's confirmation page and terms version, and the order id.

• A summary the agent writes afterwards, or a chat log it can edit, is weak evidence of what it was told or shown. An approval recorded before the order, and checked against the order before it was sent, is much stronger.