FBI Director Kash Patel said the quiet part out loud. Enforcement will be scoped to models "created with criminal intent." That is the entire federal position on autonomous AI agents. Not a framework. Not a registration regime. A threshold set at a node that cannot be proven.
Chaos is opportunity. Compile the data.
Here is the data. In 1986, when CFAA was signed into law, the statutes were written to describe a person sitting at a terminal, knowingly crossing a boundary. Two conditions: knowingly, and intentionally. Forty years later we have agents that plan across multiple steps, call external tools, execute against live APIs, and produce probabilistic output. The result is not driven by a single intent. And the three parties who could hold that intent โ model developer, deployer, end user โ are structurally separated by a contract chain.
Intent has nowhere to live. That is not a regulatory gap. That is an ontology gap.
Federal hands-off policy is not the absence of cost. It is the relocation of cost. The public sector steps back, and the bill lands on the corporate side: indemnification clauses, insurance certificates, compliance attestations, state-level filings. I have run the numbers on what this looks like in a procurement cycle. Distributed systems don't fail softly at scale.
Three statutes now lock that bill into place. California SB 53 requires training-data disclosure, safety frameworks, and risk assessment, with per-violation penalties capped at $1M. Illinois mandates annual independent third-party safety audits. Connecticut requires bias testing plus advance notice in employment-decision contexts. Strip the labels off and you have three recurring expense lines: disclosure cost, audit cost, test-and-notify cost.
The problem is that the legal force of those obligations is itself under litigation. DOJ has already weighed in on xAI's challenge to Colorado's algorithmic discrimination law. Which means every serious operator is now running scenario-based compliance โ build to the strictest state's standard, operate to the loosest one's posture. That is the most expensive configuration available. You pay for the ceiling and you enjoy the floor.
The audit market is where this gets concrete. A single independent third-party audit scales with scope and model size. My working estimate sits between $50K and $500K per engagement, annualized. For a company under $10M in revenue, that is a material line item. For a company over $1B, it rounds to nothing. Compliance scale economies get baked in automatically. Nobody voted for this. It just falls out of the arithmetic.
Now the part the policy commentary keeps missing entirely.
The technical stack underneath these agents does not produce attributable behavior. No standardized agent identity. No mandatory action logs. No versioned behavior reproduction. Payments had PCI-DSS. Cloud security had SOC 2. Network incidents had the NIST framework. Agent frameworks in 2026 have none of that as an accepted baseline โ no agent identity standard, no least-privilege tool sandbox as a norm, no signed tool calls. Verifiable agent traces are technically achievable. Model version freezing with hashes is technically achievable. The absence is not a limitation of what can be built. It is the absence of a mandate and the absence of an incentive.
So even if every legislator passed a framework tomorrow morning, prosecutors and courts would still lack the forensic substrate. You cannot subpoena a probabilistic planning loop. You cannot establish criminal knowledge against a weight file. Circuit tracing and sparse autoencoders are genuinely impressive research. They do not clear reasonable doubt on intent at model creation time.
Which brings me to the counterintuitive piece.
Narrative broken. Shorting the dip.
The bearish read on this is that federal inaction is a gift to AI companies. Wrong direction. The biggest beneficiary of a liability vacuum is the party that can unilaterally transfer risk downstream via terms of service. That is the model and platform layer. The biggest loser is the deployer โ the mid-market SaaS integrator, the vertical solutions shop, the company actually running the agent against a customer's data and signing the contract.
And the sector that needs agents most is the sector that gets frozen out first. Financial services, healthcare, employment screening. Procurement in those verticals demands compliance evidence and indemnification from suppliers. Washington provides no anchor standard. The buying side has nothing to reference. So the cycle extends, or the deal dies in legal review.
Regulatory absence is suppressing the most valuable enterprise market, not liberating it. That is the actual commercial finding here, and it inverts the standard framing.
I stress-tested this logic the way I test an incentive design. In January 2025 I audited a trading protocol that let autonomous bots execute on-chain. The fee mechanism allowed farming without genuine market exposure. I published the technical report, the governance token repriced, and I shorted it โ the flaw was structural, not a bug, and the market had not priced it. Here the flaw is the same shape. The incentive is to leave attribution unsolved, because solving it means naming who signs. Nobody volunteers for that signature.
There is a second-order effect the coverage ignores. Autonomy itself becomes a liability variable. Agents with human-in-the-loop approval gates, read-only tools, and hard permission ceilings are cheaper to defend in court than fully autonomous agents. Compliance pressure will therefore shape the product roadmap โ not through any statute, but through legal review of release decisions. Regulation is not following the technology. It is quietly steering it.
One more asymmetry. FTC civil investigative demands shift the risk function from marketing claims to structural safety. That means internal design documents, red-team reports, and release decision records all become discoverable. Companies respond by building governance processes โ model cards, release review boards, incident response flows. Hidden cost, real cost.
Liquidity dries up. Watch the spreads.
What I want to see before anyone claims this is resolved: whether contractual liability caps survive state consumer protection and product liability law, and whether there is case law yet. Whether AI liability insurance actually underwrites agent errors at all, and at what deductible. Whether procurement contracts have standardized indemnification and audit-rights clauses. Whether anyone has published a cost estimate per firm per year. None of it exists in the current discourse.
And the technical question nobody is asking: how do you freeze the attribution chain when the model updates silently and behavior drifts? A version hash pins the artifact. It does not pin the context window, the tool set, or the external API state. The trace runs cold the moment production differs from evaluation.
Kash Patel set the bar at criminal intent at creation time. Technically, weights do not encode readable intent. So the bar sits above the ceiling of what the artifact can prove.
The system is waiting for someone to build a trace that holds up in court. Until then, no one signs. And the spread stays wide.