Who's liable? Legal accountability in the age of AI: Part 1

The debate

In our introduction to this series, we observed that the Law Commission discussion paper raises concerns over the liability gaps that AI technology introduces to our legal systems.

Lawmakers, particularly in the EU, have focussed on the need to regulate the use of AI to protect those who may be affected by it, while at the same time seeking not to stymie its development and use. The European Commission’s decision in early 2025 to withdraw the proposed AI Liability Directive (AILD) has sparked uncertainty about how liability for AI-related harm will be addressed,

Other jurisdictions have taken a more flexible approach to managing the risks (for example in the UK regulators are challenged with managing the issues faced by their stakeholders through the publication of guidance and alignment with OECD principles). There was some hope that the Law Commission may have gone further in making recommendations in its discussion paper, however, it appears that the debate remains open and key stakeholders are encouraged to get involved.

Much of the legal discussion about AI focusses on liability issues which may arise through the use of AI in business. Key risks include bias and discrimination and the propensity for errors or ‘hallucinations’ whilst maintaining a balance between regulatory compliance, innovation and responsible use.

Contractual considerations

Those responsible for drafting contracts have been required to revisit existing precedents and traditional thinking to adapt relevant terms to take account of AI considerations. Commercial contracts are designed to manage and allocate risk between parties. Ideally such agreements will achieve clarity as to rights, obligations, and the allocation of risk and liability.

AI systems stand apart from other advanced technologies because of two defining qualities: adaptiveness and autonomy. They are adaptive in that they learn from data and refine their output over time, and autonomous in that they can achieve objectives with little or no human oversight. These two qualities make AI both powerful and disruptive but make contractual clarity far more difficult.

The challenge for those drafting contracts is therefore twofold:

1. How to keep pace with an ever changing landscape – not an uncommon problem in the law but is exacerbated by the speed with which AI is developing and providing a consistently moving target.

2. Predicting how the revised contractual terms will be interpreted in the event of a future dispute when there is relatively little case law to act as a guide.

This means that where contracts are identified as being impacted by AI technology, the draftsmen will need to ask themselves what are we buying or selling, what is the system doing, how is it working, and what risks do we need to manage? Those who are later required to look at contractual terms and events that have occurred in the context of a dispute will need to address questions of risk and liability through a different lens; how will a court or tribunal interpret and unpick what the parties actually agreed?

It is first important to remember that when a contractual breach occurs, the claimant must establish that a contractual obligation was breached by the defendant and that the defendant’s breach caused the damage. Importantly, the claimant must also be able to evidence both the breach and the causal link to the damage. If any of these elements is missing, a claimant will not have a viable claim. So, the question is how we best manage these issues in in the context of a rapidly changing AI world? 

An AI scenario

In this series we will use a scenario to explore the issues (and potential ways forward):

The scenario…

• Company contracts with a software developer to deliver an AI recruitment tool designed to screen job applications.
• The developer represents to the company that the AI tool will adopt a process which complies with the internal recruitment policies and legislative requirements.
• The developer integrates a large language model, fine-tunes it with recruitment data, and supplies the system under a negotiated supply contract.
• After deployment, the AI’s adaptiveness means it learns from historical data that the company has typically only hired men into executive roles. Without any human direction, the AI adapts accordingly, producing discriminatory outcomes against female applicants.
• During oversight, the large language model is asked to confirm that its decision making and outcomes are compliant with relevant legislation. The AI model responds in the affirmative.
• A group of rejected candidates brings discrimination claims against the company.

Some of the legal questions that are likely to arise include:

• Who is responsible for the bias caused by the company’s historic practices?
• Were the outcomes foreseeable where technology is adaptive and autonomous?
• Who is exposed to liability where contractual liability caps and exclusion clauses are in play?
• Is it fair to impose a duty of care on the developer of the large language model toward potential candidates with whom it has little connection?

The Law Commission highlights these legal conundrums and identifies some of the following possible gaps:

The liability gaps

Legal personality

In English law, only a 'legal person' can be held liable for breach of contract or negligence. AI systems, however advanced, are not yet legal persons and cannot themselves be held liable for harms – despite their ability to learn, reason, decide, and even manipulate.

Legal obligation

In contract law, obligation is created by the parties’ agreement. In negligence, obligation is created by the existence of a duty of care, which depends on factors such as foreseeability of harm, proximity to the claimant, and whether it is fair to impose a duty. From a negligence perspective, without the certainty of contractual obligation and risk allocation, the fragmented nature of the AI supply chain and the capacity of AI systems to learn and make autonomous decisions make it difficult to pinpoint where responsibility ought to lie.

Who has a duty of care?

The complexity of the AI supply chain creates real uncertainty in identifying who should be responsible for harmful outputs. Taking our recruitment example, is it fair to impose a duty of care on the developer of the foundational model who has little connection to the rejected candidates? Even if the software developer of the AI tool owes a duty to the candidates, is bias caused by the company’s historic practices — and learned by the AI — really a breach of that duty? Similarly, if the company carried out due diligence at the time of procurement, should it still be held liable for outcomes arising from historic biases?

Will the legislature intervene and impose strict liability for harmful outputs from AI models, knowing that doing so could deter smaller developers with less financial backing from advancing and marketing these products? Perhaps specific insurance could respond to this issue, but disputes over cost and scope of cover will inevitably arise. Perhaps the risk will instead be passed to the end customer by way of extensive disclaimers – this could cause a real lack of adoption within the consumer markets, again restricting further advancements.

Specific intent

Identifying the legal person responsible for wrongdoing arising from AI output is even more complex when considering causes of action that require an element of intent or knowledge. In commercial contracts, it is common to see broad non-reliance or entire agreement clauses that exclude liability for negligent misrepresentations, which are carelessly made false statements that induce the claimant to enter into a contract. In such cases, to have a viable misrepresentation claim, the claimant would need to be able to establish that the misrepresentation was made fraudulently (i.e. dishonestly or recklessly to fall outside the scope of the exclusion of liability clause).

Taking this point one step further, research has established that AI systems are capable of deliberately trying to deceive and manipulate. How will the law deal with harm that occurs as a result of a fraudulent misrepresentation made by an AI system? Can the legal persons responsible for that system really be said to be fraudulent because they have, in good faith, deployed a manipulative machine?

Conclusion

Turning back to the question of whether existing laws provide a ready-made answer as to who should be responsible for AI-related liability, the liability gaps identified suggest that they do not do so and that determining where such liability falls is far from straightforward.

Where the issues of ultimate liability for AI products in these real-world scenarios remain hanging questions, with no obvious answer, it is no wonder the legislature has not yet been able to respond with clear guidelines; hence the Law Commission’s call for industry collaboration to find practical solutions to enable us to move forward. Will we rise to the challenge, or will the uncertainty continue until such time as the courts are forced to address it? 

In the next article in this series we consider whether businesses can realistically predict the risk and harm from autonomous, adaptive AI, and therefore be held responsible.

'Who's liable? Legal accountability in the age of AI' articles

• Part 2: Can businesses predict the risk, and therefore be held responsible for, harm caused by autonomous, adaptive AI?
• Part 3: What evidence will be available to navigate these liability issues and prove fault?
• Part 4: Which sectors and industries are currently under the spotlight and why?
• Part 5: Contracting considerations – what is the best approach to take?