Artificial Intelligence and Liability: Exploring Legal Challenges and Responsibility in AI Decision-Making and Autonomous Systems

Introduction—Overview of AI

Artificial intelligence (AI) possesses characteristics that emulate human intelligence through numerical and computational systems (Zhang & Lu, 2021). These systems are capable of forming representations, learning from data, making predictions, conducting analyses, drawing conclusions, and, in some cases, applying self-corrections. AI is designed to address a wide range of tasks, including medical prediction, planning, image visualization, voice recognition, and the acquisition of specific skills. AI systems rely on training datasets to improve predictive accuracy and to assist in solving complex problems with a high degree of precision (Kumar et al., 2023, pp. 8459–8486).

To a certain extent, AI may be understood as a scientific field concerned with the learning capabilities of intelligent machines, primarily intelligent computer programs, which generate outcomes in a manner comparable to human cognitive and attentional processes (Khaleel et al., 2024, pp. 1–21). As a rule, AI involves sequential processes of data accumulation, the creation of effective structures for utilizing acquired data, the production of definite or approximate outcomes, self-evaluation, and subsequent adjustment. Overall, AI is used to assess and advance machine-learning techniques that aim to replicate aspects of human cognition (Dong et al., 2020, pp. 1–10). AI technologies are increasingly employed to perform more accurate analyses and to generate practical and economic value. From this perspective, a range of statistical models, along with computational intelligence methods, are integrated into AI systems.

AI has seen remarkable and rapid development over the past two decades. Its subdomains—such as machine learning (ML), natural language processing (NLP), and computer vision—are progressively converging and expanding across numerous sectors of society. Artificial intelligence is increasingly embedded in human activities and, in certain contexts, is replacing human decision-making processes (Chukwuani et al., 2020, pp. 444–449). Although AI originates within computer science, it is closely connected to many other disciplines, including mathematics, cognitive science and philosophy, biology, business and logistics, engineering and manufacturing, transportation, healthcare, education, and government (Adnan et al., 2024).

The deployment of AI has enhanced productivity while reducing costs, and its effects contribute to economic development, social transformation, and individual welfare (Adigwe et al., 2024, pp. 126–146). AI aims to create digital computers or computer-operated robots capable of performing intellectual and cognitive tasks typically associated with humans, without external assistance (Markauskaite et al., 2022). These cognitive functions include acquiring knowledge, reasoning, problem-solving, perception and comprehension, and speech. A foundational aspect of AI is knowledge engineering, whereby machines are constructed using data and information about the human world so that they can act in human-like ways (McCarthy, 2022, pp. 66–90). Another major branch of AI is machine learning, in which predefined algorithms and statistical models are used to minimize or converge errors without explicit, task-specific programming (Telikani, 2021, pp. 1–35). This approach is based on the premise that machines can learn from data, identify problems, and determine solutions with minimal human intervention.

This paper offers specific recommendations to support the argument that data protection and privacy laws are essential for improving the transparency and accountability of AI systems. Nevertheless, significant issues, debates, and ongoing controversies surround the practical implementation of these rights, particularly regarding the extent to which they can be enforced and the manner of their enforcement. Moreover, current data protection laws exhibit notable limitations in their coverage of, and applicability to, AI systems. In particular, this paper demonstrates how de-identification techniques intended to circumvent legal obligations by removing personal identifiers are undermined by AI technologies, which are capable of directly re-identifying data or indirectly inferring sensitive attributes from datasets that have been anonymized.

Results

The findings indicate that the autonomous actions of AI systems cannot be adequately regulated through traditional legal frameworks that are grounded in human agency. Such autonomous action requires distinct and domain-specific regulatory consideration, particularly in sectors such as healthcare, transportation, and finance. This paper highlights the potential problem of overlapping and shared interests among AI developers, users, and manufacturers. To address these challenges, it proposes a hybrid model of liability that combines elements of strict liability with algorithmic transparency requirements. The paper concludes that global accountability is central to necessary legal reforms and suggests that, without such reforms, society will be reluctant to rely on AI technologies or to adopt them at a rapid pace.

Role of AI in Autonomous Systems and Decision-Making

Autonomous Decision-Making Systems (ADMS) are advanced computing systems capable of receiving and responding to information in both digital and physical forms, and of generating outputs that may either support or substitute human decision-making processes (Dwivedi et al., 2023). ADMS can be defined as processes that, with or without the use of AI techniques, take inputs and data received or collected from the environment and, based on predefined objectives, produce a wide range of outputs.¹

Autonomous AI represents a subcategory of artificial intelligence in which systems and tools have developed to the point where they can operate largely independently of human input (Atakishiyev et al., 2024, pp. 51182–51221). The actions performed by autonomous AI systems range from relatively simple operations to complex data analysis tasks (Bathla et al., 2022). In this respect, autonomous AI brings real-world AI systems closer to the portrayals commonly found in fictional representations of artificial intelligence (Lucci et al., 2022, p. 850).

When effectively implemented, AI systems composed of multiple interacting components can significantly enhance the operational capacity of businesses and other organizations (Dalsaniya & Patel, 2022, pp. 322–337). Some components are software-based and provide specific functionalities, such as algorithms that analyze collected data, while other components are embedded within systems to capture data from the environment and supply it to analytical processes. The term “AI” may apply to systems that still require continuous human intervention,² as well as to more advanced architectures—such as reinforcement learning, machine learning, and deep learning platforms—that are capable of processing and correlating large datasets with limited human involvement (ZainEldin et al., 2024).

Self-governing or autonomous AI represents one of the most advanced forms of contemporary AI. However, since many AI applications widely used today are not fully self-sufficient, they are commonly described as narrow AI (Perwej et al., 2024, pp. 1–32). Narrow AI refers to systems designed to perform specific tasks that generally require human oversight or guidance (Hopgood, 2021, p. 514). In contrast, artificial general intelligence (AGI) refers to a hypothetical or fictional concept in which AI systems are fully autonomous, capable of operating independently of any human operator, and able to outperform human intelligence across all domains (Mikki, 2024).

Current AI systems, including those described as autonomous, do not yet meet the criteria of AGI. Rather, autonomous AI constitutes an intermediate stage in the progression toward that theoretical goal. While such systems may rely on equipment and infrastructures that still require human intervention for data collection and system support (Paesano, 2023, pp. 1694–1723), they also incorporate advanced learning structures—such as reinforcement learning, machine learning, and deep learning—that enable the classification and analysis of large datasets with minimal direct human interaction. As such, autonomous AI is among the most complex AI concepts developed to date, marking a significant step toward greater machine independence while remaining distinct from fully autonomous artificial general intelligence.

Specialists define narrow AI as the many AI systems and tools currently in use that cannot perform certain tasks independently without human guidance (Hopgood, 2021, p. 514). By contrast, artificial general intelligence refers to an AI that can operate fully autonomously, independent of any human operator, and surpass human intelligence in all respects. Autonomous AI fits neither category, but it represents a significant step toward the development of artificial general intelligence.

An autonomous AI system requires the following two components:

• Data collection instruments, commonly referred to as sensors, which are physical devices used to gather data from the environment.³
• Algorithms. For a system to autonomously achieve a goal defined by a human, the collected data must be processed by computer algorithms (Lehmann et al., 2023). In the ideal case, where all components are smoothly integrated, an autonomous AI agent can operate independently of human input, make its own decisions, and perform tasks autonomously. An autonomous AI agent may be understood as a tool that receives a goal from a human and develops a strategy for achieving that goal through a set of tasks and actions (Sado et al., 2023, pp. 1–41).

It is evident that several potential benefits can be derived from ADMS-based systems (Salvini et al., 2023), although attitudes toward the acceptability of ADMS vary depending on the application and the end user (Aysolmaz et al., 2023). Human decision-making capacity is inherently limited and varies across individuals, as a single person can respond effectively to only a restricted number of stimuli at any given time (Sosnowski & Brosnan, 2023, pp. 1103–1117). By contrast, once an ADMS has been trained, it can be replicated indefinitely.⁴ Beyond computational efficiency, the use of ADMS may offer additional benefits, including improvements in safety, cost reduction, efficiency, and accuracy (Attaran, 2020, pp. 158–172).

The potential risks associated with Automated Decision-Making Systems (ADMS), and the serious consequences they may impose on individuals in critical sectors such as healthcare, military operations, finance, and justice, highlight the need to integrate human oversight into automated decision-making frameworks (Leslie & Perini, 2024). Such integration is often presented as an essential means of ensuring accountability and effective supervision. However, the concept of meaningful human control gives rise to a paradox. On the one hand, systems are designed to make decisions independently in order to reduce or eliminate human involvement, thereby enhancing safety, lowering costs, and improving the prediction of behavior. On the other hand, there is a growing demand to monitor autonomous systems to ensure ethical outcomes, for example, by addressing concerns related to fairness.

Particularly troubling is the phenomenon of quasi-automation, in which humans are formally involved but function largely as a superficial source of validation, while the system performs the substantive decision-making tasks. In many organizations, insufficient staff training or a lack of adequate time allocated for decision-making have been identified as common issues. This problem was notably demonstrated in 2018, when Amazon faced criticism over an AI-based recruitment tool that ranked job candidates, which was found to be biased against women and black applicants.⁵ The algorithm ranked applicants on a scale from one to five based on their résumés but systematically rated female candidates poorly because it had been trained on historical data reflecting male dominance in the technology sector. As will be discussed later in this paper, recruiters retained partial responsibility for shortlisting, interviewing, and hiring new employees, but they rarely reviewed the full pool of applicants due to the sheer volume of applications, which caused candidate lists to be processed very quickly. This example illustrates the need for clearly defined parameters to establish meaningful human control over ADMS (Saeik et al., 2021).

Legal Framework for AI in the EU

The European Commission has developed a number of legislative instruments in response to the rapid emergence and widespread deployment of diverse AI technologies across multiple sectors, as well as the ethical concerns and risks associated with their use. In 2021, the European Commission proposed the AI Act,⁶ which establishes a comprehensive legal framework for the development, deployment, and use of AI systems across various sectors within the EU and its internal market (Schmidt et al., 2024). On July 12, 2024, the AI Act was published in the Official Journal of the European Union, marking it as the first horizontal legal framework specifically aimed at regulating artificial intelligence across the EU.⁷ The AI Act became applicable on August 1, 2024, and will enter into full effect on August 2, 2026, unless specific provisions listed in Article 113 apply.⁸

As of February 2025, the EU AI Liability Directive—initially proposed by the European Commission to address legal challenges related to the attribution of responsibility in cases involving AI systems—has been formally withdrawn from the Commission’s legislative agenda⁹ (Grozdanovski, 2025, pp. 1–24). Despite early momentum, including the adoption of a position by the European Parliament’s Committee on Legal Affairs (JURI Committee), proposals to extend the Directive’s scope, and broader parliamentary interest, the Directive encountered strong opposition from EU member countries. Critics argued that it duplicated provisions already addressed by the newly adopted Product Liability Directive.¹⁰ This withdrawal reflects institutional reluctance to create overlapping legal regimes and underscores the EU’s preference to regulate AI liability and responsibility through existing legislation, particularly through the AI Act, and to rely on its overall regulatory effectiveness (Greenstein & Zamboni, 2025, pp. 1–41). The absence of a harmonized, specifically tailored AI liability regime creates a regulatory gap, especially in cases involving non-material harm and complex decision-making chains, which may undermine legal certainty and consumer protection in AI-related contexts.

Several EU legal acts and regulations are relevant to the governance of AI, including the EU Artificial Intelligence Act (AI Act),¹¹ the Digital Markets Act (DMA),¹² the Cyber Resilience Act (CRA),¹³ the Data Act,¹⁴ the Digital Services Act,¹⁵ and the General Data Protection Regulation (GDPR),¹⁶ all of which influence the regulation and deployment of AI systems within the EU.

The AI Act defines an “AI system” as “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” A “general-purpose AI model” is defined as an AI model, including those trained on large datasets using self-supervision at scale, that demonstrates significant generality and is capable of competently performing a wide range of distinct tasks, regardless of how it is placed on the market, and that can be integrated into a variety of downstream systems or applications, excluding models used solely for research, development, or prototyping prior to market placement. The term “general-purpose AI system” refers to an AI system derived from a general-purpose AI model that can be used either as a standalone product or as part of other systems.

Pursuant to Article 3(66),¹⁷ the AI Act has extraterritorial applicability to the following actors:

• any provider that places an AI system or a general-purpose AI model on the EU market, uses it for its own purposes, or otherwise makes it available, irrespective of whether the provider is established within the EU or in a third country;
• any deployer of AI systems that is established or located within the EU;
• any provider or deployer of an AI system established or located in a third country, where the output generated by the AI system is used within the EU.

The AI Liability Directive primarily addressed non-contractual, fault-based civil liability claims within the EU and was expected to adopt the same definition of AI as that used in the AI Act (Nikolinakos, 2024, pp. 477–621).

Under the AI Act, any developer of an AI system or general-purpose AI model, as well as any natural or legal entity, public authority, agency, or other body that develops and places such systems or models on the EU market, is classified as a “provider”.¹⁸

A “distributor” is defined as any natural or legal entity in the supply chain other than a provider or importer who makes an AI system available on the EU market, but a provider or importer does not become a distributor solely by placing an AI system on the market.¹⁹

An “importer” is any natural or legal entity within the EU that places an AI system on the EU market which is marketed under the name or trademark of an entity established in a third country.²⁰

The proposed AI Liability Directive sought to revise civil liability rules to make it easier for victims of AI-related harm to prove fault and obtain compensation. It aimed to enhance legal certainty by introducing mechanisms such as disclosure obligations and rebuttable presumptions to address the technical complexity and opacity of AI systems. However, the European Commission withdrew the Directive in early 2025 due to concerns about over-regulation and a lack of legislative progress. Although the Directive is no longer proceeding through the formal legislative process, its underlying objective of complementing the AI Act by addressing AI-related liability concerns remains relevant.

The AI Liability Directive was intended to ensure that individuals harmed by AI systems would have access to compensation equivalent to that available to victims of other forms of technological harm within the EU (Nikolinakos, 2024). Existing fault-based liability regimes are often ill-suited to address damage caused by AI-driven products and services. Victims may encounter significant practical and financial barriers when attempting to demonstrate fault and establish causation, largely due to the opaque, complex, and self-learning nature of AI systems.

Risk Categorization

The categorization of AI systems by risk level and the corresponding regulatory requirements under the EU Artificial Intelligence Act are set out in the following provisions:

• Article 5—Prohibited AI Practices, which lists AI systems and practices that are outright banned, such as manipulative subliminal techniques, social scoring by public authorities, and certain uses of biometric technologies.
• Article 6—High-Risk AI Systems, which defines what constitutes a high-risk AI system, including AI applications used in areas such as critical infrastructure, education, employment, law enforcement, migration, and the administration of justice.
• Article 7—Amendments to the List of High-Risk AI Systems, which establishes the mechanism through which the European Commission may update or expand the list of high-risk AI applications.

Under the AI Act, any undertaking that provides an AI system as a service, produces a product incorporating an AI system, deploys an AI system, imports an AI system, distributes an AI system, or acts as an authorized representative of an operator is classified as an “operator,” regardless of legal form. Both individual providers and contractors specializing in general-purpose AI models are subject to obligations relating to technical documentation and transparency. They are also required to consult with the European Commission and national competent authorities and to comply with national legislation concerning copyright and related rights. Compliance may be demonstrated, inter alia, through adherence to approved codes of practice.

Additional obligations apply to providers of general-purpose AI models that pose systemic risk. These include requirements to conduct standardized model evaluations, identify and manage systemic risks, monitor incidents, and implement appropriate cybersecurity measures.

The AI Act further provides for the development of codes of conduct for AI systems, with the European Commission expressing the expectation that providers will adopt such codes on a voluntary basis (Cantero Gamito & Marsden, 2024). By contrast, the AI Liability Directive does not impose any comparable compliance obligations (Hacker, 2023).

Legal Personification of AI

The products and actions of artificial intelligence cannot easily be accommodated within existing legal categories, whether as property or as persons. Many scholars compare the current role of artificial intelligence in law to the historical concept of a “quasi-person”, a legal status previously used to address entities that did not fit neatly into established legal classifications (Amelin et al., 2022, pp. 294–302). A number of authors have drawn analogies between the present legal treatment of artificial intelligence and earlier encounters with quasi-personhood in legal doctrine (Mecaj, 2022, pp. 180–196).

A related issue arises from the position of other legal scholars who argue that if discussions concerning the behavior of AI and its moral and ethical dimensions are to be treated as meaningful and coherent, then it may also be appropriate to consider the legal recognition of the personality of artificial intelligence. In this context, legal personality is viewed as a significant stage in the realization of constitutional rights. Once an AI system is granted legal personality under the law, it would, in principle, become a bearer of constitutional rights (Bublitz, 2024, pp. 1095–1106).

Complexities of Multi-Stakeholder Liability

Explainable AI (XAI) and Interpretability

Cognitive approaches to transparency and accountability in AI systems focus on the application of technological processes, tools, and practices that make artificial intelligence systems comprehensible, explainable, and traceable to organizational stakeholders (Göksal & Solarte Vasquez, 2024). These approaches seek to facilitate an understanding of how an AI system arrives at a particular conclusion and to provide mechanisms for challenging outcomes or identifying points at which the system may have failed. As a result, Explainable AI (XAI) has emerged as an important subfield concerned with making AI systems interpretable to human users (Holzinger et al., 2023, pp. 16–24).

When AI is deployed in serious and high-impact application contexts, there are strong societal imperatives to understand how AI systems function, to critically assess and challenge their outcomes, and to demand justification for AI-driven decisions and actions. In this regard, the EU’s General Data Protection Regulation (GDPR) incorporates a so-called “right to explanation” and establishes principles governing solely automated decision-making that has significant effects on individuals (Bayamlıoğlu, 2022, pp. 1058–1078).

Legal and Regulatory Frameworks

Legal and regulatory frameworks play a crucial role in promoting transparency and establishing effective accountability within information systems that rely on artificial intelligence (Díaz-Rodríguez et al., 2023). Privacy laws contribute to fair data processing by requiring organizations to disclose how data is used and by enabling individuals to participate in and influence decisions concerning the use of their personal information (Mijwil et al., 2023, pp. 8–13). These laws also support accountability, as the GDPR grants data subjects the right to bring legal action against organizations for unlawful automated decision-making. Similarly, anti-discrimination laws facilitate accountability by prohibiting the development and deployment of AI systems that produce discriminatory outcomes, while also providing individuals with legal remedies for unfair treatment.

A recent case involving Clearview AI illustrates these concerns. The American facial recognition company was accused by the American Civil Liberties Union (ACLU) of violating Illinois’ Biometric Information Privacy Act (BIPA) (Ahmed, 2023, pp. 66–95). The company reportedly collected billions of images from Facebook and other websites to build a facial recognition database without users’ consent. This case raises significant questions regarding the use of AI systems that rely heavily on personal data.

Such challenges and regulatory gaps are often viewed as best addressed through incremental reforms to data protection law combined with the development of new AI governance frameworks. These measures may include expanding the definition of “personal data” to encompass inferred data, introducing privacy impact assessments and algorithmic audits for high-risk AI systems, and requiring comprehensive model documentation and reporting.

As artificial intelligence has become increasingly embedded in consumer products and services, growing scrutiny has emerged regarding accountability when AI systems cause harm to individuals (Patel, 2024, pp. 1–17). Traditional product liability regimes hold manufacturers responsible for harm caused by manufacturing defects, design flaws, or inadequate warnings. However, the autonomous and self-learning characteristics of AI systems make them difficult to assess under conventional product liability frameworks (Sayre & Glover, 2024, pp. 357–394). Defining what constitutes a “defect” in an AI system presents particular challenges (Hacker, 2023). This raises complex questions, such as whether biased outputs generated by an AI system should be considered defects (Lesenciuc, 2024, pp. 9–22). If an AI system functions as intended and harm results from the optimization goals embedded in its design, such harm may be interpreted as a design defect (Li et al., 2023, pp. 1–46). Distinguishing between a flaw and an unavoidable or inherent risk associated with the intended use of AI remains inherently difficult.

Furthermore, under established product liability doctrines, the “component parts” rule generally excludes component suppliers from liability for harm caused by the final integrated product (Beck & Jacobson, 2017, pp. 143–210). The incorporation of AI systems further complicates liability attribution, as emergent properties may arise from interactions among multiple AI components (Díaz-Rodríguez et al., 2023). This makes it challenging to assign responsibility among the various actors involved in data provision, model development, and system integration.

The EU AI Liability Directive adopted a progressive yet cautious approach to addressing evidentiary challenges posed by multi-purpose AI systems by proposing two key mechanisms: the right to disclosure of evidence and a shift in the burden of proof. These measures were intended to rebalance procedural inequalities between claimants and powerful AI developers by empowering courts to order the disclosure of relevant technical information, such as system logs and training data, from high-risk AI providers. At the same time, national courts would have been permitted to presume causality where claimants could demonstrate that an AI system’s failure plausibly caused the harm suffered, thereby easing evidentiary burdens in civil liability claims. While these mechanisms would have enhanced access to justice for victims, they also raised concerns about excessive disclosure of proprietary algorithms and the potential chilling effect on innovation. The Directive’s emphasis on procedural fairness reflected the EU’s preference for soft harmonization rather than strict liability. However, its withdrawal has created a regulatory gap in addressing evidentiary asymmetries in AI-related litigation (Ziosi et al., 2023).

As a result, plaintiffs may continue to face significant difficulties in obtaining sufficient evidence to prove that an AI system caused alleged harm, particularly because relevant algorithms and operational processes are often protected as proprietary information and not easily discoverable. This also complicates the apportionment of damages, as harms caused by AI systems may consist not of isolated losses but of cumulative minor inconveniences or diffuse negative externalities. Legislative reform may therefore be necessary to clarify procedural mechanisms in AI-related litigation. Such reforms could include requiring AI companies to establish integrated AI incident response teams to address liability claims or to maintain detailed data logs, testing records, and validation documentation for AI systems implicated in harm.

Guidelines on Business Ethics

There are multiple approaches to ethical AI, which are reflected in a range of core principles and bodies of work. One prominent example is the IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems, which has developed a set of principles for ethical AI known as the IEEE standards for AI (Jedličková, 2024, pp. 1–14). These principles can serve as a foundation for developing AI systems that are safe and socially relevant, in line with widely accepted societal values. Issues of bias and non-bias are critical considerations in the advancement of AI systems, along with principles of fairness and equality.

Improving collaboration among academia, industry, and government can contribute to greater transparency in AI systems and help ensure accountability for the outcomes they produce (Sharma, 2024). The integration of perspectives from disciplines such as computer science, law, ethics, and the social sciences can provide the expertise needed to address the complex and multi-layered challenges of AI governance.²¹

This paper advocates for the development of collaborative governance models, emphasizing that this should be understood as a long-term process that demands sustained and coordinated effort. AI governance requires the participation of a broad range of societal actors, including policymakers, industry and business representatives, non-governmental organizations, and the general public (Zaidan & Ibrahim, 2024, pp. 1–18). Such inclusive involvement will help ensure that current and future AI systems are developed and deployed in accordance with diverse perspectives and expectations. In this way, collaborative governance supports responses to the complexity and multidimensional nature of AI governance challenges. The establishment of independent regulatory agencies for AI implementation is also proposed as a means of ensuring oversight and improving efficiency that encompasses multiple stakeholders.

Balancing Competing Interests

One of the central challenges of AI governance is the need to balance competing interests, including privacy, intellectual property rights, and transparency (Walter, 2024). Particular tension exists between the demand for transparency in AI processing and the protection of user privacy, indicating that while transparency is important, it should not be pursued in a manner that infringes upon individual privacy rights (Ramya et al., 2025, pp. 85–110). Various approaches have been proposed to address this discord, such as the use of differential privacy techniques, which aim to preserve individual privacy while maintaining a degree of transparency. These approaches highlight the difficulty of protecting proprietary innovations while simultaneously promoting transparency.

Because machine learning algorithms are often protected as intellectual property, companies are generally reluctant to disclose them, which can result in reduced transparency. To address these competing concerns, legal and policy recommendations have been proposed that would permit access to AI systems by third-party auditors under conditions that preserve confidentiality and anonymity.

Facebook* faced a class action lawsuit in which it was accused of violating the Illinois Biometric Information Privacy Act (BIPA)²² by using facial recognition technology to collect and store its users’ biometric data without their consent. In 2020, the company settled the case for $650 million (Nieves, 2021, pp. 1–20). This outcome was subsequently affirmed by the United States Court of Appeals for the Ninth Circuit in the well-known Patel v. Facebook, Inc. case.²³ In addition, in 2023, the Illinois Supreme Court issued another significant decision concerning BIPA enforcement. In Cothron v. White Castle System, Inc.,²⁴ the Court reaffirmed its prior jurisprudence by holding that each instance of biometric data collection without required consent constitutes a separate BIPA violation. This ruling has substantial implications for the calculation of damages and poses significant legal risks to organizations that fail to comply with the statute.

Legal Challenges in AI Decision Making

A fault-based liability system, which requires proof of negligence or intent, is ill-suited to AI systems that operate autonomously or rely on opaque machine-learning processes and are, in many cases, beyond the direct control or even full understanding of users and developers alike (Botero Arcila, 2024). The evidentiary burden imposed by such a system would create unnecessary obstacles for victims, particularly in high-stakes sectors such as autonomous transportation or healthcare, where AI malfunctions may result in catastrophic harm. By contrast, a strict liability regime, which does not require proof of fault, is more compatible with the unpredictability and risk profile of advanced AI systems, especially those classified as high-risk under the AI Act.²⁵ However, the blanket application of strict liability may stifle innovation and impose disproportionate burdens on small-scale developers.

An alternative approach offering a more balanced solution is a hybrid liability model that combines strict liability for operators or deployers of high-risk AI systems with fault-based liability for designers and developers (Popa Tache & Vâlcu, 2025, pp. 281–305). Under this model, primary responsibility rests with the “AI owner” or deploying entity—such as a hospital, logistics provider, or digital platform—that determines how and where the system is used. Secondary liability may be attributed to developers or manufacturers where defects in design, training, or system updates can be demonstrated. Regulators may further support this framework by imposing obligations related to transparency, risk assessment, and insurance coverage. Ultimately, the construction of AI liability regimes must protect victims without imposing undue constraints on responsible innovation by ensuring accountability across the entire AI value chain and adapting legal frameworks to the distinctive risks and opacity associated with intelligent systems (Zekos, 2023, pp. 293–359).

Policy Recommendation on the Need for a Visionary Legal Framework for AI

There is an urgent need to establish a progressive legal framework that addresses liability for high-intelligence AI systems involved in decision-making in critical sectors such as healthcare, transportation, security, and commerce. Existing liability regimes, which are largely premised on human agency, are inadequate to address the challenges posed by autonomous and opaque AI-driven decision-making. The central legal questions that require resolution include identifying who should bear liability when harm is caused through the use of AI and determining how causation and fault should be established in a manner that balances innovation with justice. Addressing these issues is essential to ensure that the legal system evolves alongside technological development rather than lagging behind it.

The law should clearly distinguish between actors across the AI value chain in order to allocate liability appropriately. A recommended approach is a tiered liability model, under which strict liability is imposed on deployers and operators of high-risk AI systems—namely, those entities that choose to integrate such systems into real-world contexts, oversee their operation, and derive benefits from their use. These actors are generally best positioned to assess contextual risks and to implement appropriate protective measures. Conversely, liability for AI developers and model providers should be based on fault, with particular emphasis placed on whether reasonable care was exercised with respect to transparency, safety, and diligence in the design, training, and updating of AI systems. This approach encourages prudent behavior while avoiding undue constraints on innovation.

To address the difficulties associated with establishing causation and fault, traditional evidentiary rules must be adapted. AI systems are often described as “black boxes,” making it difficult to trace specific outcomes to particular design or operational decisions. Accordingly, the legal framework should adopt a presumption of causality whereby, if an AI system causes harm, courts presume a causal link between the system and the injury. The burden would then shift to the operator or developer to demonstrate that appropriate care was taken to prevent this harm. Such a shift acknowledges the practical impossibility faced by victims in unpacking complex AI operations while incentivizing risk prevention by AI stakeholders.

In addition, the legal framework should mandate transparency, auditability, and traceability throughout the development and deployment of AI systems. Regulators should require that high-risk AI systems implement robust logging mechanisms, including comprehensive decision logs and metadata audit trails, to enable the reconstruction of system behavior in the context of liability proceedings. These technical requirements should be formalized through binding regulations similar to safety standards found in sectors such as pharmaceuticals or aviation. Establishing such shared evidentiary infrastructure would facilitate reasoned adjudication of responsibility and encourage openness in system design.

Given the distributed and collaborative nature of AI development, the framework should also incorporate mechanisms for shared liability in situations where responsibility cannot be clearly attributed to a single actor. For example, assigning joint and several liability may be appropriate in cases where commercial AI systems incorporate open-source models or third-party application programming interfaces. In cases where attribution remains particularly difficult, the establishment of AI compensation funds or mandatory insurance schemes for high-risk AI activities could provide effective remedies for victims while maintaining trust in the AI ecosystem and avoiding deterrence of investment.

From a governance perspective, there should be a central AI regulatory or supervisory authority with a mandate to enforce liability rules, issue binding safety certifications, and resolve disputes. This body should coordinate with sector-specific regulators and data protection authorities to ensure consistency in standards and enforcement. It should also maintain a public registry of certified high-risk AI systems and compliance audit reports, thereby enhancing transparency, accountability, and public oversight. Such an institution would serve both preventive and adjudicatory functions.

A forward-looking, dynamic, and socio-technically sensitive AI liability framework must take into account the technological complexity inherent in artificial intelligence. It should define liability across the entire AI lifecycle, reconceptualize evidentiary rules to address informational opacity, establish enforceable transparency and monitoring obligations, and provide effective compensation mechanisms. Crucially, it should also be aligned at the international level to avoid regulatory fragmentation and to support the safe, fair, and innovative development of AI on a global scale. Public policy should reinforce these objectives by embedding them within AI ecosystems and ensuring that legislative efforts continue to safeguard fundamental rights alongside technological progress.

Conclusion

This paper confirms that the emergence of AI-based decision-making and autonomous systems fundamentally disrupts existing liability frameworks, which were developed on the assumption of human actors and deterministic causation. Its central finding is that traditional tort, contract, and product liability regimes are inadequate in situations where autonomous systems operate with a high degree of independence, giving rise to significant challenges in assigning accountability when harm occurs.

A further key observation is that responsibility for AI-related harm cannot be easily attributed to a single actor. Instead, liability is often distributed among developers, manufacturers, deployers, and users. This diffusion of responsibility underscores the need for more refined mechanisms to allocate liability, particularly in high-risk sectors such as healthcare, transportation, and finance, where autonomous decision-making may generate systemic risks.

The study also highlights the limited effectiveness of fault-based liability mechanisms when applied in isolation and suggests that strict liability and risk-distribution models may be more effective in ensuring compensation and deterrence. Comparative analysis indicates that jurisdictions such as the European Union are moving toward more harmonized regulatory approaches, including the AI Liability Directive and reforms to product liability frameworks, while the United States has largely retained a sector-specific regulatory model.

Finally, the paper argues for a reconciliation of innovation and accountability through the implementation of transparency, explainability, and auditability requirements in AI systems. Liability regimes will need to evolve toward hybrid models that integrate fault-based, strict, and enterprise liability in order to ensure legal certainty and maintain public trust in autonomous technologies.

* Ed. note: By decision of the authorities of the Russian Federation, Meta Platforms, Inc. has been declared an extremist organization, and its activities are prohibited on the territory of Russia.