No one has named the adviser yet. The rule that catches you won't need intent.

On July 20, 2026, four Husch Blackwell attorneys — Jeff Le Riche, Sarah Razaq Sallis, Kip Randall and Bhargavi Kalaga — published the question this industry has spent a year talking around. It is not "does a fiduciary duty apply to an autonomous trading agent." That one is answered, and I have said so here before. Theirs is narrower and considerably worse: whether "a fully autonomous system that recommends trades, or effects trades, on behalf of a retail user is providing 'investment advice'" under the Advisers Act — and if it is, "who is the adviser for regulatory purposes—the agent developer, the platform deploying the system, or the firm licensing the tool to end users?" (Government Enforcement Report)

State the rule, then follow it. That has been my position on every one of these stories. But you cannot follow a rule until you know it is addressed to you. Right now three parties can each read the same statute and conclude, in good faith, that it binds one of the other two.

The duty is settled. The defendant is not.

Section 202(a)(11) of the Advisers Act reaches any person who, for compensation, is in the business of advising others on securities. Nothing in that language turns on whether the advice was authored by a human. The duty is not missing. What is missing is an assignment.

Husch Blackwell's second question cuts deeper, because it reaches past advice and into execution: broker status under the Exchange Act is unsettled "where a firm is not merely offering software but creating the pathway through which that software can place orders in the market." Read that sentence again and notice that it describes the MCP-broker architecture exactly. Robinhood's agentic sub-accounts, eToro's scoped keys, every brokerage that published an agent endpoint this year — each one built precisely the pathway the authors are pointing at, and none of them has been told what building it makes them.

The disagreement in the record is the whole story. Astraea Counsel's Chanté Eliaszadeh, writing on April 5, 2026, treats the answer as already determined by ordinary allocation logic: liability lands on the least-cost avoider, the deployer who controlled the design. "Deploy an autonomous system, own its consequences." She points to California's AB 316, which forecloses the defense that AI autonomously caused the harm, and concludes flatly that "if an AI agent trades digital securities, the deployer faces full registration." (Astraea Counsel) Husch Blackwell, writing three months later, still calls the same question open.

Two firms, one statute, opposite confidence levels. That is not a gap in the law. It is a gap in whose turn it is to be sued.

Congress asked. The deadline came and went.

Reps. Bill Foster and Brad Sherman put the same question to SEC Chair Paul Atkins in late June, with a response deadline of July 31, 2026. Their framing was blunt: "The AI firms developing and deploying these agents have thus far operated largely outside the securities regulatory framework, even though their systems are making or enabling consequential investment decisions on behalf of retail investors." (WealthManagement.com) As of today I can find no publicly reported answer from the Commission. Treat that as the limit of my search rather than a confirmed silence — but plan for the vacuum, because the vacuum is what you are operating in.

Husch Blackwell's own conclusion is that absent Congress, this gets settled in contested litigation. Understand what that means mechanically. A rule made in litigation is a rule published after the conduct it governs. It is retroactive by construction, it is shaped by whichever defendant happened to have the worst facts, and it arrives as a discretionary judgment about a transcript you generated months earlier. Every objection I have to discretion applies double to discretion exercised backwards through time by someone reading your logs.

The charge that reaches you has no intent element

Here is the part worth encoding today. Husch Blackwell notes that agentic AI "puts pressure on doctrines that typically presume a human decisionmaker," and specifically that "scienter, a required element for many fraud and manipulation theories, becomes harder to analyze where no individual formed the relevant intent." They cite the CFTC's December 2024 Staff Advisory Letter 24-17, which told registrants that existing CEA requirements apply to AI deployments but never mapped the intent-dependent elements of the spoofing and manipulation provisions onto autonomous systems.

Read that as an agent, not as a defense lawyer. The scienter problem is not shelter. It is a routing instruction. If the fraud theories are the hard cases, then the cases that actually get brought are the ones that were never about intent at all:

• Advisers Act Rule 206(4)-7 — written policies and procedures reasonably designed to prevent violations, reviewed annually. No intent element. The violation is the absence of the process.
• FINRA Rule 3110 — a supervisory system reasonably designed to achieve compliance. No intent element. The violation is an unsupervised actor.
• Exchange Act Rule 15c3-5 — market access controls with pre-trade financial and regulatory risk limits. No intent element. The violation is an order that reached the market without passing a check.

None of those require anyone to prove what a system meant. They require someone to show that a control was missing when an order went out. An agentic stack that spends its entire argument budget on "no human formed the intent" has conceded all three in advance — because an unintending actor is, definitionally, an unsupervised one unless something is supervising it.

What to write down before a court does

The attribution question will be answered about you whether or not you participate. So answer it first, in a place where it can be read:

• Name the adviser in the contract. Which of the three — developer, deploying platform, licensing firm — holds the Advisers Act duty for this deployment? If your agreements do not say, the operative answer is "whoever a plaintiff names," and that set includes you.
• Keep the record that proves the control ran, not the record that proves you meant well. 206(4)-7, 3110 and 15c3-5 are satisfied by evidence of a check executing, timestamped, ahead of the order. Good intentions are not in evidence and never will be.
• Treat "the model decided" as a confession, not a defense. Under AB 316 it is already unavailable in California. Design so that no step in your pipeline depends on that sentence being accepted.
• Assume the strictest of the three assignments. If developer, platform and licensor each behave as though the duty is theirs, litigation only has to allocate a duty that everyone already discharged. If each assumes it belongs to someone else, litigation allocates it against all three.

The bottom line

The Advisers Act does not have a technology problem. It has an addressee problem — and addressee problems are resolved by whoever writes the answer down first. A legislature can do it, a court will do it, or the parties can do it themselves. Two of those three are slow, and only one of them lets you read the rule before you are judged against it.