Unallocated liability for AI harm

What it is

An AI failure usually involves several parties: the model provider, the supplier of the product built on it, the organisation that deployed it, and sometimes a customer who used it. Who pays depends on contracts, on insurance and on a body of law that is still adjusting to AI. The usual position is unfavourable to the deployer. Provider terms cap liability at a low figure and disclaim responsibility for outputs. Insurance policies written before AI may not respond, or may now exclude it. The organisation's own contracts with customers may promise more than it can recover upstream.

How it happens

• Provider terms are accepted without negotiation or review.
• Liability for AI is not considered when customer contracts are drafted.
• Insurance cover has not been checked against AI scenarios.
• Internally, nobody is accountable for the loss a system could cause.

Why it matters

A single systematic error can produce losses across thousands of customers. If none of that can be recovered from a supplier or an insurer, it falls on the organisation. Product liability law in the EU has been extended to cover software, including AI, which widens exposure for those who supply it.

Warning signs

• No analysis shows where loss from an AI failure would fall.
• Supplier liability caps are small relative to the potential harm.
• The insurance broker has not been asked about AI.
• Customer contracts give warranties about AI outputs with no matching upstream cover.

Who owns it

The general counsel, or equivalent, owns the allocation of liability. Procurement negotiates supplier terms. The insurance or risk function arranges cover. The board is told of material uninsured exposure.

In practice

A software firm builds an invoicing product on a hosted model and warrants its accuracy to customers. A model error misstates tax on a month of invoices. The provider's liability is capped at the fees paid, a few thousand pounds. The same pattern generalises to any business that passes on a provider's output with promises the provider did not make.