There is no single person who is automatically responsible when an AI system causes harm. Liability depends on the country, the type of decision, the injury or loss, and what each participant controlled. A developer or provider, the organization that deployed the system, a manufacturer or supplier, or another party may be responsible under different legal routes. Regulators can investigate and punish breaches, but that does not automatically compensate the person who was harmed.
Start by separating responsibility from liability
People use “responsibility” to mean several different things. An engineering team may be responsible for designing a model, a company may be responsible for putting it into a hiring or lending workflow, and a regulator may be responsible for enforcing public rules. Legal liability is narrower: it is the obligation to pay damages, provide another remedy, or accept a sanction under a particular law.
As an Amazon Associate I earn from qualifying purchases.
The same incident can therefore produce more than one proceeding. A national authority might investigate whether an AI provider or deployer breached a regulatory duty. Separately, the affected person might bring a civil claim based on defective products, negligence, discrimination, privacy law, contract, employment law, or another cause of action. A regulatory finding can help establish facts, but it is not itself a damages award.
EU materials considered for this question do not identify the AI system itself as the defendant. The legal analysis is directed at people, companies, public bodies, and other organizations that developed, supplied, selected, controlled, or used the system.
#1 Best Overall
The actors who may carry legal exposure
Provider or developer
Under the EU AI Act, a provider is the person or organization that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. This role can include a software company, an internal business unit releasing a system under its own brand, or another organization that assumes the provider role.
Provider conduct becomes important when the alleged harm relates to the system’s design, training, documentation, instructions, conformity work, monitoring, updates, or a known limitation that was not addressed. A provider is not automatically liable merely because its software produced an unwanted output. The claimant still needs a legal route and evidence connecting the provider’s conduct or a product defect to recognized damage.
Deployer or user organization
The AI Act uses “deployer” for an organization or public authority that uses an AI system under its authority. The definition has an exception for personal, non-professional use. A deployer decides why the system is used, what data or prompts it receives, how much human review occurs, and whether staff treat an output as a recommendation or as an automatic decision.
Those choices can be decisive. A company that uses a ranking tool to reject applicants may have a different exposure from the provider that built the tool, particularly if the company selected an unsuitable purpose, supplied poor data, ignored warnings, or allowed staff to rubber-stamp outputs. Conversely, a deployer that followed required controls may still face a claim if the applicable law imposes duties independent of the provider’s conduct.
Manufacturer, importer, distributor, or supplier
The revised EU product-liability framework covers software and AI. It treats software developers or producers, including AI system providers, as manufacturers for that framework. The European Commission states that “the manufacturer of the defective product is the primary person from whom a victim can claim compensation.” Depending on the circumstances, an EU-based importer, authorized representative, fulfilment provider, or distributor can also become relevant in the supply chain.
This route concerns a defective product, not every bad outcome from an AI-assisted decision. The claimant generally must establish a defect, legally recognized damage, and a causal connection between them. The revised rules also provide court evidence procedures and proof presumptions in defined situations, which can matter when technical information is concentrated in the provider’s systems.
Regulator
A regulator enforces public-law requirements; it is not normally the party that pays the injured person. The European Commission describes EU AI Act enforcement as shared among the Commission’s AI Office, the European Data Protection Supervisor (EDPS), and national competent authorities designated by Member States.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe AI Office handles specified matters involving general-purpose AI models and related cases. National authorities handle other AI systems according to the allocation in the Act, while the EDPS covers systems used by EU institutions. A regulator can order corrective action or impose a fine, but a person seeking compensation generally must use the civil, employment, consumer, privacy, or other route that applies to the harm.
The affected person or claimant
The claimant must connect four facts: what the system did, what damage occurred, which legal duty or product rule applies, and why the named defendant is responsible for the loss. A harmful-looking output is not, by itself, proof of compensable damage or causation. The answer may also change if several organizations jointly decided the purpose, supplied data, or controlled the final decision.
Two EU questions that must not be confused
Was a regulatory rule breached?
The AI Act is a risk-based regulatory framework with role-specific obligations for providers and deployers. The relevant authority may examine prohibited practices, system classification, documentation, human oversight, data governance, monitoring, or other duties that apply to the particular system and date.
Rank #3
The Commission’s enforcement overview, updated 6 October 2026, lists maximum penalties of up to €35 million or 7% of worldwide annual turnover for prohibited-practice infringements, whichever is higher. That figure is a statutory ceiling, not a typical fine, an average outcome, or evidence of how often enforcement occurs.
Recommended Free Tools
Is there a compensation claim?
A compensation case asks a different set of questions. Depending on the facts, it may allege that a product was defective, that an organization acted negligently, that a contract was breached, or that the decision violated employment, equality, consumer, data-protection, or sector-specific law. The defendant, burden of proof, limitation period, available damages, and required evidence vary with the route.
A regulator’s conclusion can be useful evidence, but it does not eliminate the claimant’s need to show legally recognized damage and causation. Likewise, the absence of a regulatory penalty does not necessarily defeat a private claim.
What the revised EU product-liability rules change
The revised Product Liability Directive entered into force on 8 December 2024. EU countries had until 9 December 2026 to transpose it into national law, and the framework applies to products placed on the market from 9 December 2026. The 1985 directive remains applicable to products placed on the market before that date. It is therefore incorrect to apply the new rules automatically to every earlier AI product or every injury involving software.
For a covered claim, the central questions are:
- Defect: Did the product provide less safety than a person was entitled to expect, considering factors such as its presentation, reasonably foreseeable use, and the time it entered the market?
- Damage: Is there a type of loss that the applicable national law recognizes for this claim?
- Causation: Did the defect cause the damage, rather than merely appear in the same chain of events?
- Defendant: Is the named party the manufacturer or another supply-chain actor against whom the directive permits a claim?
Technical evidence may be difficult for an individual to obtain because model logs, version histories, prompts, and evaluation records are often held by the provider or deployer. The directive’s evidence procedures and presumptions are intended to address defined proof problems, but they do not turn every unexplained output into automatic liability.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is not yet binding law
AI Liability Directive proposal
The European Commission presented an AI Liability Directive proposal on 28 September 2022 to address evidentiary difficulties in non-contractual claims. The Commission page describing it still presents it as a proposal, not as an enacted, generally applicable liability rule. It should not be cited as though it already determines who pays in an individual case.
European Parliament resolution
A 2020 European Parliament resolution proposed an operator-focused civil-liability approach and said that autonomous activity alone should not excuse the operator. That resolution is useful policy history, but it is not the same as current binding law. The applicable national rules and any enacted EU measures control the outcome.
How to analyze a real harmful decision
- Identify the decision and the harm. Record exactly what happened: a rejected application, denied benefit, incorrect diagnosis, blocked account, unsafe recommendation, discriminatory ranking, financial loss, physical injury, or another outcome. Separate measurable damage from frustration or suspicion.
- Name every participant. List the model or system provider, the organization that bought or configured it, the staff member or public body that made the final decision, and any manufacturer, importer, distributor, or contractor in the chain. Do not assume the person who clicked “deploy” is the only relevant party.
- Determine the system’s role. Was the output advisory, or did it automatically trigger the result? What data went in? Who could override it? Was a human required to review the result, and did that review actually occur?
- Preserve contemporaneous evidence. Keep notices, decision letters, screenshots, account records, prompts, outputs, dates, system names, model versions, appeal correspondence, contracts, and any explanation supplied by the organization. Do not alter the original files; retain metadata where possible.
- Locate the governing law. Identify the country, the sector, where the provider and deployer are established, where the decision occurred, and when the product was placed on the market. Employment, health, credit, insurance, education, public benefits, consumer, privacy, and safety rules may lead to different defendants and remedies.
- Choose the legal route. A regulator complaint, data-access request, employment grievance, consumer claim, product-liability action, negligence case, or contractual claim may each require different evidence and deadlines. More than one route may be available, but they are not interchangeable.
- Get jurisdiction-specific advice. A qualified lawyer or authorized legal service can test limitation periods, forum rules, disclosure options, and the strength of causation evidence. A general explanation cannot predict the result without the underlying facts.
The evidence that usually decides the dispute
| Question | Useful evidence | Why it matters |
|---|---|---|
| Who supplied the system? | Purchase orders, terms, invoices, product documentation, branding, deployment records | Helps distinguish provider, deployer, manufacturer, and supply-chain roles. |
| What version made the decision? | Model identifier, release date, update history, logs, configuration files | AI behavior can change after updates; the relevant version must be identified. |
| What data and instructions were used? | Input records, prompts, data sources, workflow rules, validation reports | Shows whether the result arose from the model, an input error, or the surrounding process. |
| Was there meaningful human oversight? | Review policies, staff notes, override records, approval timestamps, appeal outcomes | Shows who exercised control and whether review was genuine or merely formal. |
| What loss occurred? | Medical records, wage statements, rejected applications, repair bills, financial statements | Connects the event to a legally recognizable injury or economic loss. |
| Could another cause explain the outcome? | Comparable decisions, independent records, alternative eligibility reasons, expert analysis | Tests causation instead of assuming that an AI output caused the entire loss. |
Why geography and timing change the answer
The concrete rules above are principally European Union rules. In the United States and elsewhere, outcomes can depend on local statutes, common-law negligence, product-liability doctrines, contract terms, discrimination law, privacy rules, sector regulators, and constitutional or administrative law. There is no worldwide rule assigning every AI mistake to the developer.
Timing matters inside the EU as well. The AI Act takes effect on a phased timeline, so the duty applicable to a system may depend on the provision and date. Product-liability treatment depends on when the product was placed on the market: the revised framework applies from 9 December 2026 for covered products, while the earlier directive continues for products placed on the market before then.
| Date | Event | Practical significance |
|---|---|---|
| 28 September 2022 | Commission presented the AI Liability Directive proposal | Policy proposal, not a generally applicable enacted liability rule. |
| 2020 | Parliament adopted an operator-focused civil-liability resolution | Nonbinding policy history, not controlling law. |
| 8 December 2024 | Revised Product Liability Directive entered into force | Starts the EU legislative transition. |
| 9 December 2026 | Transposition deadline and application date for products placed on the market from this date | New product-liability rules should not be applied automatically to earlier products. |
| 6 October 2026 | Commission AI Act enforcement overview updated | Describes the current allocation among the AI Office, EDPS, and national authorities as of that update. |
Possible outcomes and remedies
- Regulatory action: investigation, orders to stop or change a practice, corrective measures, or an administrative fine.
- Compensation: payment for qualifying economic, physical, property, or other legally recognized damage under the relevant claim.
- Decision correction: a new assessment, human review, account restoration, benefit reconsideration, or removal of an inaccurate record where another law provides that remedy.
- Injunction or compliance order: a court or authority may require a practice to stop or controls to be implemented.
- Contractual relief: a refund, service remedy, or damages claim where a supplier failed to meet contractual commitments.
These remedies can coexist, but success in one does not guarantee success in another. A fine paid to the state is not automatically distributed to victims, and a private settlement does not necessarily determine whether a regulator breached the AI Act.
Common mistakes that weaken an AI-harm claim
Blaming only the developer
The deployer may have chosen the purpose, supplied biased or incomplete data, ignored a warning, or made the final decision. Leaving that organization out can hide the strongest evidence of control.
Blaming only the operator
A deployer may have followed the provider’s documentation while a defect, misleading limitation, unsafe update, or inadequate product design caused the result. The supply chain and product version still need examination.
Treating an inaccurate output as proof of damage
An erroneous answer can be evidence of a problem, but a claim normally also needs a recognized injury and a causal link. Preserve records showing what changed in the person’s finances, health, rights, employment, access, or property.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Using the wrong date or legal label
Calling a proposal “law,” applying the revised product rules to a pre-9 December 2026 product, or treating a regulatory fine as compensation can send a claim down the wrong path. Confirm the applicable rule, effective date, and remedy before filing.
Bottom line for people affected by an AI decision
Begin with the organization that made the decision and the organization that supplied or configured the system, then trace who controlled the purpose, data, review, and final action. Preserve the technical and outcome records before they disappear. Next identify the country, sector, date, type of damage, and legal route. Those facts—not the mere presence of AI—determine whether a provider, deployer, manufacturer, supplier, or another actor may owe a remedy.
For a live dispute, seek advice in the relevant jurisdiction, especially where there is physical injury, a lost job or benefit, discrimination, significant financial loss, or a short filing deadline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
