Who Is Responsible for AI Mistakes? The Law in 2026

Ask who is responsible for AI mistakes and the honest first answer is a negative one: not the AI. European law treats an artificial intelligence system as an object, not a subject. The EU AI Act gives the system no duties and attributes no consequences to it; it lists human and corporate operators instead, the provider, the deployer, the importer, the distributor, and hands the obligations to them. The idea of an "electronic person", floated in the European Parliament almost ten years ago, never became binding law.

So the real question is which of the humans around the system carries the loss. The answer depends on role and on control, and since 2024 courts and legislators have made it much less vague than the comment threads suggest.

The short answer

The pattern behind the table is simple. Whoever puts their name on the output, or had the power to stop it, answers for it.

Two rulings that settled the easy cases

The chatbot is part of your website

In Moffatt v. Air Canada, a customer asked the airline's website chatbot about bereavement fares after a death in the family. The chatbot said a refund could be claimed retroactively; the airline's own policy page said it could not. Air Canada argued it could not be held liable for what the chatbot said. The British Columbia Civil Resolution Tribunal called that a "remarkable submission", effectively treating the chatbot as a separate legal entity responsible for its own actions. The tribunal member's reasoning is now quoted in every compliance deck: it should be obvious that a company is responsible for all the information on its website, and it makes no difference whether that information comes from a static page or a chatbot.

The customer was awarded $812.02 in total. The amount is small; the principle is not. As the American Bar Association's summary put it, a consumer cannot be expected to double-check one part of a website against another. If you deploy an AI to speak to customers, it speaks for you.

The lawyer signs the brief, not the model

In Mata v. Avianca, lawyers filed a brief citing court decisions that did not exist. ChatGPT had invented them, and when asked, had assured the lawyer they were real. Judge P. Kevin Castel wrote that there is nothing inherently improper about using a reliable AI tool, but that existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings. The court imposed a $5,000 penalty, jointly and severally, on the lawyers and their firm, and ordered letters to every judge falsely named as the author of a fake opinion.

Nobody sued OpenAI. The professional who put their signature on the output owned the mistake, and so did the firm that employed them.

How blame moves along the AI value chain

Those two cases are easy because one party stands between the machine and the harm. Most real deployments have more links. Beatriz Botero Arcila's study of AI liability along the value chain uses Microsoft Copilot as the example: OpenAI develops the model, Microsoft provides the system, a business deploys it, and an employee uses it. Each link can fail.

In practice, the parties divide risk among themselves in advance through contracts, licences and terms of service, what lawyers call private ordering. When harm reaches an outside victim, European legal systems generally apply joint and several liability: the victim can claim full compensation from any contributor, and that contributor then recovers shares from the others.

Scholars disagree about where the centre of gravity should sit. A 2026 paper in AI and Ethics argues for user-centric governance: just as a surgeon answers for a scalpel, the organisation that deploys AI should carry primary responsibility, because it has proximity to the harm, control over the context and the domain expertise. Even the lightest user, one consuming raw API outputs, keeps what the authors call minimum but irreducible obligations: verify outputs before acting on them and keep a human in the loop for high-stakes decisions.

The risk in that view is described by an earlier paper in AI & Society: moral crumple zones, where blame is pinned on the most proximate human operator to protect the integrity of the system, even when that person had little real control. The same paper warns of the opposite failure, where several actors are liable and all of them escape by pointing at each other. Good policy has to avoid both.

For the practical side of assigning named owners inside an organisation, see our guide to building an AI accountability framework, and for the definitions behind it, what accountability in AI means.

What European law says in 2026

The AI Liability Directive is gone

The European Commission proposed a dedicated AI Liability Directive to ease the burden of proof for victims under national fault-based rules. It withdrew the proposal on 11 February 2025. The consequence, according to the analysis at lawandtechnology.eu, is that Union law today has no special civil liability regime for damage caused by AI. Claims run through general national tort law, with the burden of proof on the injured party.

Some member states have moved on their own. Italy's Legislative Decree 160/2026 lets courts order disclosure of the AI Act documentation, including the logs required under Article 12 of the EU AI Act, and presumes the causal link where damage follows a breach of the Regulation.

Software becomes a product

The bigger shift arrives on 9 December 2026, when the revised Product Liability Directive applies. Directive (EU) 2024/2853 states that software, including AI systems, is a product for the purposes of no-fault liability, however it is supplied, including as software-as-a-service. AI system providers are treated as manufacturers. A substantial modification through an update, or through the continuous learning of an AI system, counts as placing a new product on the market, and manufacturers stay liable for defects that arise later from software or updates within their control.

No-fault means the victim does not have to prove negligence, only defect, damage and causation. The European Parliament's research service notes the directive also eases the burden of proof and extends the liability period to 25 years in exceptional cases where symptoms emerge slowly. Free and open-source software supplied outside commercial activity is excluded.

The limit matters too. The directive covers defective products. It does not cover every harm from using an AI system, and it does not address the liability of the deployer who used the system.

When a deployer becomes a provider

That is where the AI Act itself comes in. Article 26 requires deployers of high-risk systems to use them according to the instructions and to assign human oversight to people with the competence, training and authority to exercise it. Article 25, which lawandtechnology.eu calls the most underestimated provision of the Regulation, goes further: a deployer that puts its own name on a high-risk system, substantially modifies it, or changes the purpose of a general-purpose model so that it becomes high-risk, is treated as the provider and takes on all of the provider's obligations. A startup that wraps a general model into a hiring tool may have become a provider without noticing. The difference between AI governance and AI regulation stops being academic at that point.

The case nobody has solved: autonomous agents

Everything above assumes a line can be drawn from a human decision to the harm. Agents strain that assumption. A 2026 study of liability for AI agent conduct uses the Amazon v. Perplexity dispute of late 2025 to show the dilemma: treat the agent as the developer's product and the developer answers; treat it as the user's agent and the user answers. The authors propose splitting liability dynamically by the agent's autonomy, the foreseeability of its conduct and each party's capacity for control.

Foreseeability is the weak joint. The Australian National University's School of Regulation and Global Governance points out that as systems move away from classical code, they display behaviour that was not just unforeseen but unforeseeable, and foreseeability is a key ingredient of negligence. Its suggested remedies are strict liability for manufacturers or a no-fault compensation pool funded by the AI industry.

The lawandtechnology.eu analysis frames the gap precisely: in an agent chain, the provider shows the system met its specification, the deployer shows it followed the instructions, the component supplier shows its part was compliant, and what remains uncovered is the chain itself. Liability does not lack persons to bear it; it lacks an object.

A practical checklist if you deploy AI

Before launch, answer three questions, adapted from the same analysis:

1. Does our intended use make us a provider under Article 25, because we branded, modified or repurposed the system?
2. Who inside the organisation has the authority and competence to stop the system? Name the person.
3. Can that person actually exercise oversight in practice, with the logs, time and training to do it?

Then apply the minimum deployer habits every source above converges on: verify outputs before acting on them, keep a human in the loop for consequential decisions, keep your chatbot consistent with your published policies, and read the allocation of liability in your vendor contract before you need it.

Where this debate continues

Who is responsible for AI mistakes is not a question the courts will finish answering this year. It is one of the working questions of the AI Ethics and Government tracks at EX Future Summit, which runs 18 to 20 November 2026 as a single thirty-hour broadcast between Las Palmas and Bali. Online attendance is free for verified researchers and students, which is where most of the people writing these frameworks sit.

FAQ

Can an AI be held legally responsible for its own mistakes?

No. No major legal system gives AI legal personality. In the EU the AI Act allocates every obligation to human or corporate operators, and the proposal for an "electronic person" status never became law.

Is a company liable for what its chatbot tells customers?

Generally yes. In Moffatt v. Air Canada the tribunal held that a company is responsible for all information on its website, whether it comes from a static page or a chatbot, and rejected the argument that the chatbot was a separate entity.

Who is liable if I use ChatGPT at work and it gets something wrong?

The person who relies on the output professionally, and often their employer. In Mata v. Avianca the court fined the lawyers and their firm jointly, not the tool's maker, because the lawyers had a duty to check what they filed.

Does the EU Product Liability Directive cover AI?

Yes. From 9 December 2026 software, including AI systems, counts as a product under no-fault liability, and providers are treated as manufacturers, including for defects introduced by later updates or learning within their control.