No one knows who’s liable if a program goes haywire, as regulators struggle to keep pace