AI liability

How AI liability works: 3 legal routes

AI liability uses older legal routes. Each route asks a different question.

Route	Question	Example
Negligence	Did the party take reasonable care?	Moffatt v. Air Canada, 2024
Product liability	Was the product defective?	EU Directive 2024/2853, Garcia v. Character Technologies
Professional duty	Did the clinician or institution do its duty?	Medical AI, with scarce law

A JD Supra article on California AB 316 names these four parties in the AI supply chain:

Why AI liability matters: 4 changes to monitor

AI liability shows who pays when an AI system causes damage. These four results from 2024 to 2026 show the direction of the law.

1. Tribunal, Canada, 2024. Air Canada had to pay 650.88 in damages, 36.14 in interest and 125 in fees after an incorrect chatbot answer.
2. Court, US, May 2025. In Garcia v. Character Technologies, a judge let product claims continue. The defect must be in the app design, not in ideas or expressions in the app. This decision did not end the case. The parties agreed to settle in January 2026, and the terms were not immediately available.
3. Withdrawal, EU, July 2025. The Commission confirmed the end of the AI Liability Directive and cited “no foreseeable agreement”. Some MEPs and member states opposed this.
4. Statute, California, January 2026. AB 316 stops a defendant who “developed, modified, or used” AI from the defence that the AI “autonomously caused the harm”.

Who is liable when medical AI harms a patient

No rule gives one answer. Price, Gerke and Cohen call explicit legal consideration “relatively scarce” (2024). They name three places of liability:

• Healthcare providers
• Healthcare institutions
• Developers of AI systems

Two studies show different parts of the problem:

Study	Population	Result	Limit
Mansi and Riedl, preprint 2025	31 US entries, 2021 to 2024: 12 cases, 19 harms	No malpractice claim about a decision made with AI	Small, US only, not full
Tobia, Nielsen and Stremitzer, 2021	2,000 US adults, March 2020	A doctor who accepts AI advice for standard care gets lower judged liability. A doctor who rejects nonstandard advice gets no equal protection	No jury trial, no expert testimony on both sides

The Mansi and Riedl entries show other parties:

• Health insurers used AI to deny claims.
• State health departments used AI to give benefits.

The authors give possible causes for the result. A small number of physicians use AI at work. Patients possibly do not know that an AI system was in use. This result does not show that a doctor is safe.

What the EU Product Liability Directive changes for AI

Directive (EU) 2024/2853 updates the EU rules on strict liability for defective products. Member states must make it national law by 9 December 2026. It applies to products placed on the market or put into service after that date.

• Scope. AI software is a product. Free and open source software that is not commercial is excluded.
• Fault. The regime is strict liability, so a claimant does not have to show fault.
• Damage. Death, injury with medically recognised psychological harm, property, and data that is not for professional use.
• After release. Manufacturers stay liable for defects from updates, for cybersecurity vulnerabilities with no fix, and for AI self learning.
• Proof. Defendants must share their technical documentation. If not, a court can assume that the product is defective.
• Complexity. A court can presume a defect or causal link if a claimant has “excessive difficulty in establishing proof due to technical or scientific complexity”.
• Time. Three years to start a claim. Liability lasts 10 years, or 25 years for latent personal injury.

In practice: 4 records security teams keep

These four points are the synthesis of AI Matter from the sources above. They are not legal advice.

1. Technical documentation. The Directive can turn missing documents into an assumed defect.
2. Patch records. A vulnerability with no fix can make a manufacturer liable. Read this with the Cyber Resilience Act.
3. Checks of public chatbot answers. The tribunal found that Air Canada “did not take reasonable care to ensure its chatbot was accurate”.
4. Records of model changes. Updates and self learning stay in scope after release.

Trade-offs: what the rules do not decide

• Development risk. The defence stays in the Directive, and a producer can use it.
• “Excessive difficulty”. Fenwick says “it remains to be seen what will constitute” this test.
• Other defences in California. Causation, foreseeability and comparative fault stay in AB 316. The law does not make strict liability.

Where definitions disagree

The primary difference is if software is a product.

• EU: The Directive says yes, in its text.
• US: Fenwick says that courts are usually hesitant to call software a product. Garcia let a design claim continue past a motion to dismiss. The parties then agreed to settle, and the question stays open.

Questions and answers

Who is liable if AI causes damage to a patient?

No single rule answers this. The possible parties are the clinician, the hospital and the developer. A review of 31 US entries from 2021 to 2024 found no malpractice claim against a doctor. Claims went to parties such as insurers and state health departments.

Can a company say that its AI acted alone?

That defence is weak. A tribunal in British Columbia rejected it for an Air Canada chatbot in 2024. California law AB 316 bars it in civil actions from 1 January 2026.

Does the EU have an AI liability law?

The EU has no separate AI liability law, because the Commission withdrew its proposal in 2025. The revised Product Liability Directive covers AI software for products placed on the market after 9 December 2026.