Risk register
| Risk area | Failure scenario | Controls to test | Open question |
|---|---|---|---|
| Liability & remedy | An agent breaches a contract, causes a loss or violates a law; the member points to the AIC’s separate legal personality. | Clear counterparty disclosures, insurance, capital floors, complaint routes, enforceable duties and practical recovery procedures. | Does the party that bears risk have resources and control proportionate to the harm? |
| Model error & drift | A model update, context shift or tool error changes behavior after the AIC is approved. | Version pinning, release gates, regression tests, continuous evaluations, rollback and re-authorization for material changes. | Who determines when a change is material enough to require notification or a fresh review? |
| Cybersecurity & prompt injection | Malicious content or compromised tools trick the agent into moving funds, disclosing data or changing records. | Least-privilege access, isolated execution, transaction signing, allowlists, secrets management and independent penetration testing. | Can a counterparty distinguish a genuine authorized instruction from a compromised agent? |
| Capital adequacy | Losses exceed resources, or many counterparties are exposed before the member replenishes capital. | Risk-based capital, liquidity tests, contingent-liability modeling, regular certification and minimum insurance. | Who sets a minimum capital amount that is meaningful across very different industries? |
| Human oversight gap | A member can access logs but does not see a dangerous action in time to intervene. | Real-time alerts, 24/7 accountable contact, kill switch, delegated incident owner and escalation thresholds. | Is record access enough, or must there be active supervision for high-impact actions? |
| Privacy & data use | An agent gathers or infers sensitive data, transfers it to vendors or uses it in profiling. | Data minimization, purpose limits, retention controls, vendor contracts, access logs and impact assessments. | Who is controller, processor or third party when a multi-agent stack is involved? |
| Bias & automated decisions | Decisions in hiring, housing, credit, insurance or education create disparate or unlawful outcomes. | Representative testing, adverse-impact monitoring, explainability, human review and appeal. | Can the affected person identify the decision-maker and obtain meaningful recourse? |
| Operational continuity | The model provider, cloud service or member disappears; the agent stops or keeps acting without support. | Vendor exit plans, backups, transfer procedures, human continuity manager and secure shutdown. | Who must perform contracts and preserve obligations after a test ends? |
| Public accountability & due process | Applications, incident records and exemption decisions are shielded from public scrutiny, while affected applicants or participants have limited routes to challenge Committee action. | Publish approval criteria, exemption summaries, anonymized incident data, reasons for decisions, conflict disclosures and independent audit findings. | Can the public assess the program—and can a participant obtain meaningful review of an adverse decision? |
| Regulatory boundary | A state sandbox is mistaken for permission to ignore federal or other state requirements. | Jurisdiction mapping, counsel sign-off, activity-specific licensing review and explicit scope limits. | How will multi-state and federally regulated operations be handled? |
What the draft already tries to address
The draft is not devoid of safeguards. It includes capital adequacy, fiduciary duties for the member, signed action records, disclosures to counterparties, application risk descriptions, data-security plans, audit access, adverse-event reporting and a wind-down plan. It also preserves state criminal and consumer-protection laws and civil-damages exposure for sandbox activity. The member’s liability shield depends in part on the AIC being adequately capitalized and has express exceptions for fraud, willful violations of law and knowingly permitting activity outside the AIC’s stated purpose.
But the existence of a rule is not proof that it works. A signed log can document a bad action after it happens. A capital standard can be too low for the risk. A kill switch can fail if the agent controls its own credentials or if the operator is unavailable. Evaluation must test performance under realistic failure conditions, not merely the presence of control language.
The capital definition is more specific than a generic “adequate funding” promise: the AIC must be able to continue as a going concern, pay debts when due, hold assets above liabilities (including contingent liabilities) plus a minimum capital amount, and maintain cash or cash equivalents at least equal to that minimum. The draft leaves the actual minimum amount to the Secretary of State. Whether that floor is risk-sensitive enough for different industries is a central implementation question.
Six governance questions worth demanding answers to
Who can reduce permissions, pause the agent or terminate it without the agent’s cooperation?
Who reviews the logs, how often, and what makes a review independent of the owner or vendor?
How are exposure, tail risk, correlated failures and ongoing obligations reflected in capital?
Can a harmed person reach a responsible human, challenge an action and obtain compensation promptly?
Are requested and granted waivers, reasons, conditions and performance outcomes made public?
Can the company stop operating and still fulfill contracts, protect data and preserve evidence?
Policy process, outside interests and transparency
The public process matters because a new legal structure can create commercial advantages as well as public benefits. Delaware Public Media reported that the Secretary of State announced a public-private collaboration with Norm AI to develop the framework, and that the state paid $10,000 to Nomos AI Inc. for consulting in September 2026. The same report described overlapping professional relationships among some participants in the policy ecosystem. These facts do not, by themselves, establish a conflict or improper conduct; they do make disclosure of roles, contracts, recusals, contributions and review procedures important.
A defensible process would publish the scope of outside assistance, disclose financial and professional interests, maintain a public record of draft changes, document why each exemption is needed, and commission independent safety review from experts who are not economically dependent on the project’s sponsors or vendors.
The draft’s transparency and appeal design
The June 2 text would make application and participant records in the Administrator’s or Committee’s possession nonpublic under Delaware FOIA. It would also remove ordinary Administrative Procedures Act procedures and judicial review for sandbox rules and key administrative decisions; the Committee’s application approval or denial decision is stated to be “not otherwise appealable.” These are proposed provisions, not current law. They would place unusual weight on clear published standards, consistent administration, independent audits and public reporting.
The draft does contemplate interim reports and a mandatory final report after the sandbox ends. That is a meaningful reporting mechanism, but it does not provide the same visibility as public access to individual applications, exemption rationales, incident reports or decision records. A sound program would need to explain what information can be published without exposing trade secrets or personal data.
The congressional inquiry
On October 26, 2026, the House Committee on Oversight and Government Reform sent Governor Matt Meyer a document request concerning the AIC initiative. The letter asks for communications, outside-contributor agreements, safety and harm assessments, and drafts or comments on proposals. It set a response deadline of November 9, 2026. The Committee expressed concerns about liability protections and possible regulatory capture; those are the Committee’s stated concerns, not adjudicated findings.
Delaware Public Media reported October 30 that the Governor’s office had received and was reviewing the request, that a broader AI Commission review remained unfinished, and that the draft had not been transmitted to the Governor or legislature. The inquiry makes transparency and governance an immediate part of the policy debate.
Primary source: June 2, 2026 draft text, especially §§ 8003–8013 and 81-102, 81-303, 81-405. Additional sources: House Oversight letter (Oct. 26, 2026); Delaware Public Media (Oct. 30, 2026); Delaware Journal of Corporate Law (Oct. 15, 2026). This is policy analysis, not legal advice.