AI Liability Explained: Who Is Responsible When AI Causes Harm?

When an AI system causes harm, who is legally responsible: the developer, the AI provider, the business using it, the employee relying on its output, or someone else?

There is no universal answer. In the legal frameworks discussed here, an AI system is generally not treated as the liable legal person merely because it generated an output or performed an action. Responsibility may instead involve one or more people or organizations that developed, supplied, integrated, deployed, configured, operated, or relied on the system.

Who is responsible when AI causes harm? Potential responsibility may involve developers, providers, integrators, deployers, employers, operators, or users. Determining liability requires examining each actor's role, the legal duties that applied, what went wrong, whether that failure caused the harm, and what evidence supports the claim.

A practical way to analyze AI liability is:

Actor → Role → Duty → Conduct → Harm → Causation → Evidence → Applicable Law

That framework is important because the presence of AI does not create a universal liability rule.

What Is AI Liability?

AI liability means legal responsibility that may arise when the development, supply, deployment, operation, or use of an AI system contributes to legally recognized harm.

AI liability is not one standalone legal doctrine. Depending on the jurisdiction and circumstances, an AI-related dispute may involve negligence, product liability, contract law, consumer protection, privacy or data protection, discrimination law, intellectual property, professional duties, or sector-specific requirements.

The essential sequence is:

AI error → harm → legal duty → breach or failure → causation → potential liability

An AI system producing an incorrect answer does not automatically create a legal claim. The error must be connected to a relevant form of harm and an applicable legal basis. Even then, the facts may need to establish who owed the relevant duty, whether that duty was breached, and whether the breach caused the harm.

AI liability should also remain distinct from several related concepts.

AI accountability concerns how responsibility for decisions, processes, oversight, and risk management is assigned.

AI compliance concerns meeting applicable legal, regulatory, contractual, or organizational requirements.

AI ethics concerns principles such as fairness, human welfare, autonomy, transparency, and responsible use.

These concepts can overlap, but accountability, compliance, ethics, and legal liability are not interchangeable.

AI Liability Responsibility Matrix

AI systems frequently involve several organizations. Identifying what each actor actually controlled provides a better starting point than simply asking who "made the AI."

This matrix does not determine liability. It identifies which actors and areas of control may need closer legal and factual analysis.

Who Can Be Responsible When AI Causes Harm?

A typical AI responsibility chain may involve:

Developer → Provider → Integrator → Deployer → Operator/User → Affected Person

These roles can overlap. A company might build and deploy its own system, while another organization may buy an application from a vendor that relies on a third-party foundation model.

AI Developers

Developers may potentially face legal exposure where relevant harm is connected to matters within their control, such as system design, development decisions, testing, known limitations, safety measures, security, documentation, warnings, or a legally relevant defect.

That does not mean developers are automatically liable whenever someone downstream misuses an AI system.

Relevant facts may include whether the system was used for its intended purpose, whether safeguards were removed, whether known limitations were communicated, and whether another actor's decisions contributed to the harm.

AI Providers and Vendors

AI providers may supply foundation models, APIs, applications, platforms, or AI-enabled services.

Potentially important questions include what the provider represented about the service, what limitations or warnings it disclosed, how security was handled, whether relevant changes were communicated, and what contractual commitments applied.

The EU AI Act also demonstrates why defined roles matter. Under Article 16 of the EU AI Act, providers of relevant high-risk systems have obligations concerning areas such as compliance, quality management, documentation, logging, conformity assessment, registration, corrective action, and demonstrating conformity. Those obligations apply within the scope of the provision and should not be generalized to every AI provider.

Businesses That Deploy AI

Businesses deploying AI often control decisions that the original model developer does not.

A deploying organization may determine the use case, data inputs, user permissions, system configuration, degree of automation, human-review requirements, monitoring arrangements, and what happens when AI produces an uncertain or problematic result.

Under Article 26 of the EU AI Act, deployers of relevant high-risk systems have specific obligations relating to matters such as appropriate use, competent human oversight, monitoring, certain input-data responsibilities, incident handling, and retention of system logs where applicable. These are requirements for systems and actors within Article 26's scope, not universal duties for everyone using AI.

Employees, Operators, and End Users

Individual conduct can also become relevant.

An operator might deliberately bypass safeguards, use an unauthorized AI system, ignore required human-review procedures, disregard warnings, give a system permissions that were not approved, or act on an AI output without required verification.

Whether that conduct creates personal legal responsibility depends on the applicable law, authority, employment relationship, duties, and circumstances.

Multiple Parties Can Share Responsibility

AI incidents do not always have one cause.

A provider might supply a system with a weakness, an integrator might configure it incorrectly, the deploying organization might use inappropriate data, and an employee might disregard a warning.

More than one actor may therefore have relevant duties or contribute to the same harm.

Contracts can allocate responsibilities, warranties, indemnities, and financial risk between businesses. They do not automatically determine every statutory obligation or third-party claim.

How Do Courts and Regulators Determine AI Liability?

Identifying that AI was involved in an incident is only the beginning.

Was There a Legal Duty?

The first question is what obligation actually applied.

A duty may arise from legislation, regulation, contract, negligence principles, professional responsibilities, product-liability law, consumer protection, employment law, privacy rules, or sector-specific requirements.

Without identifying the relevant legal duty, saying that an AI system "failed" does not establish legal liability.

Did Someone Fail to Meet That Duty?

The next question concerns the conduct of the relevant actor.

Depending on the facts and applicable law, issues might include inadequate testing, deficient warnings, poor implementation, unsuitable deployment, inadequate human oversight, insufficient monitoring, failure to address a known risk, or non-compliance with a relevant legal requirement.

These circumstances do not automatically prove liability. Their significance depends on the legal claim and the evidence.

Did the Failure Cause the Harm?

Causation can become particularly difficult when AI sits inside a longer decision chain.

Consider:

AI model → application → employee review → management decision → affected person

A legally relevant failure could potentially occur at more than one point.

The analysis may therefore ask whether the harm would have occurred without the alleged failure, whether a human decision changed the causal chain, whether other actors contributed, and whether the type of harm was foreseeable where that concept is relevant under the applicable law.

What Evidence Exists?

AI liability can become an evidence problem as much as a legal one.

Potentially relevant evidence may include system documentation, logs, model or application versions, testing records, risk assessments, configuration information, human-review records, incident reports, contracts, policies, warnings, vendor documentation, and approval records.

Not all of these records are legally required in every situation. Applicable recordkeeping requirements depend on the jurisdiction, sector, system, contractual relationships, and relevant law.

What Types of AI Harm Can Create Legal Exposure?

A harmful outcome is not automatically an unlawful outcome.

For example, unequal results from an automated hiring system may justify investigation without automatically establishing unlawful discrimination. Organizations using automated systems for consequential decisions should separately assess their AI bias and discrimination risks, including data, model performance, protected characteristics, human decision-making, and applicable discrimination law.

How AI Liability Works Under Different Legal Frameworks

Organizations operating across borders need to identify which jurisdiction and legal regime apply. AI legislation, regulatory enforcement, contractual liability, product liability, and private claims for damages should not be treated as the same thing.

For a deeper U.S.-focused explanation of how existing and emerging AI laws and regulations interact with federal and state requirements, the wider regulatory landscape should be considered separately from the liability analysis below.

Current Legal Position: September 2026

Several developments are particularly important when reviewing older AI-liability content:

• The EU AI Act became generally applicable on 2 August 2026, subject to phased provisions.

• Annex III high-risk AI rules now apply from 2 December 2027.

• High-risk requirements for AI embedded in certain regulated products apply from 2 August 2028.

• The proposed EU AI Liability Directive was withdrawn in October 2025.

• The EU's revised product-liability regime expressly covers software, including AI systems, for relevant products placed on the market or put into service after 8 December 2026.

• The United States continues to rely on a mixture of existing federal law, targeted AI measures, agency authority, state legislation, and other legal doctrines rather than one universal federal AI liability statute.

• Existing private-law principles remain important in England and Wales.

The European Commission's current AI Act implementation timeline confirms the revised 2027 and 2028 dates for the major high-risk provisions following the 2026 amendments.

United States: Existing Legal Doctrines Often Matter

The United States does not have one comprehensive federal AI liability statute governing every harmful use of artificial intelligence.

Instead, disputes may involve tort law, contract, consumer protection, civil-rights protections, privacy, intellectual property, sector-specific requirements, and state law. Federal policy also continues to rely substantially on existing agency authority and targeted measures rather than one cross-sector liability code.

Consumer protection is one example. The Federal Trade Commission's AI enforcement actions show that existing prohibitions on unfair or deceptive practices can apply to AI-related products, services, and representations.

Employment law provides another example. The EEOC's guidance on artificial intelligence and the ADA explains how existing disability-discrimination obligations may apply when software, algorithms, or AI are used to assess applicants or employees.

Intellectual property raises separate questions. The U.S. Copyright Office's Artificial Intelligence Initiative addresses issues including copyrightability of AI-assisted outputs and the use of copyrighted material in generative-AI training.

State law can materially change the analysis, so a rule applying in one state should not automatically be generalized across the United States.

European Union: AI Act Responsibilities and Broader Liability Rules

The EU AI Act creates regulatory obligations for defined actors and AI categories. It should not be treated as a universal civil-damages statute.

Provider and deployer obligations differ, and high-risk requirements do not apply to every AI system. The Commission's AI Act regulatory framework guidance confirms both the risk-based structure and the current phased implementation timetable.

A crucial distinction is:

AI Act regulatory compliance ≠ civil liability for damages

A regulatory violation may be relevant to a dispute under applicable law, but the AI Act does not automatically establish every element required for a civil damages claim whenever AI contributes to harm.

Older articles may also refer to the proposed EU AI Liability Directive as though it were still progressing toward enactment. That is no longer accurate. The official EUR-Lex record for the AI Liability Directive states that the proposal was withdrawn on 6 October 2025.

Separate product-liability rules are also important. The revised EU Product Liability Directive expressly brings software within the product-liability framework, including AI systems in relevant circumstances. Following the 2026 corrigendum, the Directive applies to products placed on the market or put into service after 8 December 2026.

These developments reinforce why AI Act compliance, product liability, and other private-law claims should be analyzed separately.

United Kingdom: Existing Private-Law Principles Remain Important

In England and Wales, existing private-law principles remain central to many questions involving non-deliberate AI harm.

Potential legal issues may include negligence, contract, misrepresentation, professional duties, product liability, and other statutory or common-law obligations depending on the circumstances.

The UK Jurisdiction Taskforce's Legal Statement on Liability for AI Harms under the private law of England and Wales examines how existing English private-law principles may apply to loss arising from AI. The statement is an authoritative legal analysis, but it is not legislation or a court judgment.

Product liability is also under active review. The Law Commission's product-liability project is examining whether the existing Consumer Protection Act 1987 regime remains suitable for digital products and emerging technologies such as AI.

The UK position therefore remains highly fact-specific.

Why AI Makes Liability Harder to Determine

Multiple Actors Across the AI Supply Chain

One AI application might depend on a foundation-model provider, application developer, cloud provider, software vendor, integrator, deploying organization, employee, and external user.

Information and control are therefore distributed across the AI lifecycle.

Explainability and Evidence Problems

Some AI systems can make it difficult to reconstruct why a particular result occurred.

Relevant information may be distributed across prompts, retrieval systems, model versions, third-party tools, data sources, configuration settings, system logs, and human decisions.

This can make causation and evidence more difficult to establish.

It would, however, be inaccurate to characterize every AI system as an unknowable "black box."

AI Systems Can Change After Deployment

A system's behavior may change after its original approval or testing.

Relevant changes can include model updates, configuration modifications, fine-tuning, different data, new retrieval sources, expanded permissions, additional tools, or changes in the operating environment.

Version control and change management can therefore become important when reconstructing an incident.

Agentic AI Creates Additional Attribution Questions

AI agents can go beyond generating recommendations. They may interact with external systems, trigger workflows, process refunds, communicate with customers, make purchases, update records, or perform other actions within permissions granted to them.

The emergence of agentic AI has not created a universal new category of legal liability. It does, however, increase the importance of authorization, permissions, safeguards, monitoring, human approval, and causation.

For example, the UK's Competition and Markets Authority guidance on using AI agents with consumers explains that businesses remain responsible for complying with consumer law when using AI agents in customer interactions. That is a specific consumer-law position and should not be generalized into a universal rule covering every AI incident.

What Can Businesses Do to Reduce AI Liability Risk?

No governance control can guarantee that an organization will never face legal liability. Appropriate controls can, however, reduce avoidable failures and make roles, decisions, and evidence easier to demonstrate.

Assign Clear AI Responsibilities

Organizations should identify who owns the AI system, business use case, technical implementation, legal and compliance analysis, risk management, monitoring, human oversight, incident escalation, and vendor relationship.

Responsibility should reflect actual decision-making authority rather than merely assigning an "AI owner" on paper.

Assess AI Systems Before Deployment

A proportionate pre-deployment assessment should examine intended purpose, affected people, potential harms, applicable law, data, security, vendor dependencies, system limitations, human oversight, and reasonably foreseeable misuse.

The depth of assessment should reflect the consequences of the use case. A low-impact writing assistant does not necessarily require the same review as an AI system influencing employment, healthcare, finance, or safety decisions.

Use Appropriate AI Compliance Controls

Organizations can implement proportionate AI compliance controls such as testing, access restrictions, documentation, human review, monitoring, incident management, vendor due diligence, recordkeeping, and change management.

The relevant controls should connect to identified risks. Applying every possible control to every AI system does not necessarily create better governance.

Voluntary frameworks can also support this process. The NIST AI Risk Management Framework is intended for voluntary use and helps organizations structure AI risk-management activities. NIST also states that AI RMF 1.0 is currently being revised. It should not be presented as a legally mandatory framework unless another requirement separately makes its use relevant.

Preserve Relevant Evidence

Where appropriate, organizations should consider preserving the records needed to understand important AI decisions and incidents.

These may include logs, approvals, testing results, model versions, configuration records, human-review information, incident reports, vendor documentation, and contracts.

This does not mean every organization is legally required to maintain every category of record. Retention obligations depend on applicable law, sector, policy, contract, and system classification.

Review AI Contracts

AI-related contracts may need to address responsibility allocation, representations, warranties, data rights, security obligations, audit rights, incident notification, indemnification, liability limitations, subcontractors, and material changes to the service or model.

Contractual wording should reflect the actual distribution of control between the parties.

Build AI Law and Regulation Capability

Organizations cannot manage AI-related liability effectively if legal, risk, compliance, procurement, technical, and operational teams cannot distinguish regulatory requirements from contractual duties, private-law claims, voluntary frameworks, and internal governance practices.

Professionals who need a structured foundation can explore the AI Law & Regulation Essentials Training, which covers AI law, accountability, liability, compliance, privacy, bias, enforcement, and emerging regulatory issues.

AI Liability Examples: Who Might Be Responsible?

AI Hiring Tool Rejects Qualified Candidates

Suppose an employer uses an AI hiring system and evidence suggests that qualified applicants from a particular protected group are being disproportionately rejected.

The analysis might involve the employer deploying the system, the vendor supplying it, and humans making or approving employment decisions.

Relevant issues could include discrimination law, system design, data, configuration, human oversight, vendor representations, reasonable accommodation where applicable, and evidence explaining how decisions were reached.

Unequal outcomes alone do not automatically establish unlawful discrimination.

Generative AI Produces Potentially Infringing Content

Suppose a business publishes material created with generative AI and a third party alleges copyright infringement.

The analysis could involve the AI provider, application developer, business user, instructions supplied to the system, nature of the source material, nature of the output, applicable copyright rules, and contracts between the parties.

Organizations using generative systems should therefore assess broader copyright risks involving generative AI rather than assuming either that every AI-generated output infringes copyright or that AI-generated material is automatically legally safe.

AI Agent Takes an Unauthorized Action

Suppose an AI agent connected to a customer-service platform issues an unauthorized refund or completes another transaction beyond its intended authority.

Relevant questions may include what permissions the company granted, how the system was configured, what the provider represented, whether approval limits existed, whether safeguards were bypassed, how monitoring operated, and what caused the financial loss.

Saying that "the AI acted autonomously" does not resolve those questions.

AI System Contributes to Physical or Financial Harm

Suppose an AI-enabled system gives an unsafe recommendation that contributes to physical injury or significant financial loss.

Depending on the jurisdiction and circumstances, potential issues could include negligence, product liability, professional duties, contractual obligations, and sector-specific requirements.

Developers, providers, integrators, deployers, operators, or more than one of them may become relevant.

The Practical AI Liability Test for Businesses

When an AI-related incident occurs, six questions provide a useful analytical starting point.

1. What harm occurred?

Identify the actual consequence. Was there physical injury, financial loss, discrimination, privacy harm, property damage, contractual loss, intellectual-property exposure, or another legally relevant injury?

2. Which AI system contributed to it?

Identify the system precisely, including the relevant model, application, version, configuration, data sources, tools, permissions, and integrations where relevant.

3. Which actors controlled the relevant part of the system?

Separate the roles of the developer, provider, integrator, deploying business, operator, and user.

Control may be divided across several organizations.

4. What legal duty applied to each actor?

Determine the jurisdiction and identify the potential source of the obligation, such as legislation, regulation, contract, tort law, professional duties, product liability, privacy law, employment law, or sector-specific requirements.

5. Was there a failure, and did it cause the harm?

Identify what allegedly went wrong and test the causal connection.

A system defect that did not cause the relevant harm may not establish liability. Similarly, a harmful outcome does not prove that every participant in the AI supply chain breached a duty.

6. What evidence supports or challenges the claim?

Review relevant logs, documentation, testing, warnings, contracts, versions, approvals, configuration information, human-review records, and incident information.

This six-question framework is an analytical business tool. It is not a universal legal test and does not replace jurisdiction-specific legal advice.

The presence of AI does not by itself determine liability. Responsibility depends on the applicable law, facts, duties, conduct, causation, and evidence.

Conclusion

AI liability is rarely determined simply by identifying who created the model or who used the final output.

AI systems operate through chains of developers, providers, integrators, deploying organizations, operators, and users. Different actors can control different parts of the risk, and more than one party may have legally relevant responsibilities.

The strongest analysis therefore begins with the harm, identifies the relevant actors and their roles, determines which legal duties applied, examines the conduct, tests causation, and reviews the evidence.

Businesses should also distinguish regulatory compliance from civil liability. Complying with an AI regulation does not automatically eliminate other legal exposure, while breaching a regulatory requirement does not necessarily establish every element of a private damages claim.

Strong AI governance cannot guarantee that disputes will never occur. It can make responsibilities clearer, identify risks earlier, strengthen human oversight, preserve useful evidence, improve contractual allocation, and support more defensible decision-making throughout the AI lifecycle.