Liability exposure in the age of Artificial Intelligence: The European debate

The European debate surrounding artificial intelligence has so far focused primarily on regulation, particularly the obligations imposed by the EU AI Act. However, a second and equally pressing question is now moving to the forefront: who ultimately bears the financial consequences when the use of AI causes harm? There is no single answer to this question. Liability will depend to a considerable extent on the context in which the AI system is developed, supplied and deployed. In particular, it is necessary to distinguish between cases in which AI is merely used as a tool to support a professional decision and cases in which AI constitutes, or is embedded in, a product. Different liability principles, contractual arrangements and insurance considerations may apply in each scenario.

Executive Summary

• AI liability in Europe is shaped by a combination of the EU AI Act, the revised EU Product Liability Directive, national liability regimes, contractual arrangements and insurance coverage rather than a standalone AI liability framework.
• The key distinction is whether AI is used as a tool to support human decision-making or forms part of a product, as fundamentally different liability and insurance considerations apply in each scenario.
• Human oversight remains the central liability principle. Whether in professional services, product development or corporate decision-making, responsibility generally remains with the human actors who deploy, supervise and rely on AI systems.
• AI significantly increases complexity in product liability, causation and governance. Multi-party AI ecosystems, evolving AI-enabled products and board-level oversight obligations create new legal and evidentiary challenges.
• Organizations that implement robust AI governance, testing, documentation, risk allocation and insurance strategies will be best positioned to manage future liability exposure and defend AI-related claims

Overview of the European Liability Regime

The European liability framework for AI does not consist of a single, self-contained regime. Instead, liability must be assessed by reference to several overlapping sources of law.

On the one hand, the EU AI Act establishes regulatory requirements for the development, provision and use of certain AI systems. Although the EU AI Act is primarily a regulatory instrument rather than a comprehensive civil liability framework, non-compliance with its requirements may become relevant when assessing whether an organization exercised an appropriate standard of care.

On the other hand, the revised EU Product Liability Directive is particularly relevant where an AI system qualifies as a product or forms part of a product. It addresses liability for damage caused by defective products and therefore has the potential to apply to software and AI-enabled products. In this context, compliance with the EU AI Act is likely to become an increasingly important factor when courts assess whether an AI-enabled product provided the level of safety that the public was entitled to expect.

In addition, national statutory rules remain relevant. In Germany, for example, contractual liability, tort law, additional product liability principles and precedential court rulings governing the responsibility of corporate decision-makers may all play a role.

Finally, contractual regimes will continue to play a central role in allocating risks among the parties involved in the development, supply, integration, training and use of AI systems. However, unlike in common law jurisdictions such as the UK, the US or Australia, the effectiveness and permissible scope of contractual risk-allocation mechanisms under Continental European legal systems are frequently constrained by mandatory statutory rules. As a result, issues relating to warranties, limitations of liability, indemnities, audit rights and insurance obligations must be assessed within a different legal framework and cannot simply be equated with a Common Law approach.

When AI Is Only a Tool: Liability for Assisted Use of AI

In many cases, AI is not itself the product supplied to the end customer. Instead, it is used internally as a tool to support professional decision-making by lawyers, consultants, accountants and other advisers. AI is rapidly becoming part of everyday professional practice, particularly in areas such as legal research, document review, due diligence and drafting tasks.

At the same time, growing attention has been given to cases in which court filings contained fictitious authorities or inaccurate citations generated by AI. While German courts have not yet developed significant professional liability case law relating to AI-assisted services, these cases demonstrate that AI-related risks are no longer merely theoretical and highlight the importance of meaningful human oversight.

Consider a lawyer who relies on a generative AI tool that cites non-existent case law or produces an incorrect legal assessment. Similar issues may arise where AI is used to support due diligence exercises, compliance reviews, tax assessments or auditing processes.

Germany has not introduced a dedicated liability regime for professional services involving AI. Instead, AI-related claims are likely to be assessed under established contractual and professional liability principles. The key question remains familiar: did the professional exercise the level of skill, care and diligence expected from a reasonably competent practitioner in the particular circumstances at hand?

From a German law perspective, liability is unlikely to turn on whether AI was used. Rather, the focus will be on whether the professional adequately reviewed the output before relying on it. AI may assist the professional, but responsibility for the final work product remains with the human adviser. Effective human oversight, appropriate verification and a clear understanding of the system's limitations therefore remain critical. The more significant long-term question is whether AI will reshape the applicable standard of care. Today, liability discussions focus on the risks of using AI. In the future, however, claimants may increasingly argue that certain AI tools should have been used where they have become an accepted and effective part of professional practice.

This question is already being discussed in Germany. While no general obligation to use AI currently exists, the failure to use available technologies could become relevant where they are capable of improving accuracy, identifying risks or reducing avoidable errors.

From an insurance perspective, this raises the question of whether losses arising from AI-assisted professional services fall within existing professional indemnity coverage and whether policy terms contain relevant exclusions, notification obligations or requirements regarding the use and supervision of AI systems. It may also become necessary to distinguish between an error in the professional service and a defect in the underlying AI tool.

AI also raises questions that go beyond the underlying liability claim. Professional indemnity policies are traditionally designed to respond to losses arising from the insured's professional services. As AI becomes more deeply embedded in professional workflows, questions may arise as to the extent to which the relevant work continues to constitute a professional service performed by the insured, rather than an automated process driven by technology.

In addition, the increasing use of AI may lead to greater scrutiny of the degree of human review and oversight. Where AI-generated outputs are adopted without meaningful verification, questions may arise as to the role and extent of the insured's own professional contribution where significant parts of a workflow are supported by AI systems. In exceptional cases, insurers may also examine whether the circumstances engage exclusions relating to knowing or deliberate breaches of professional duties.

When AI Becomes Part of a Product

A different set of considerations arises where AI is itself the product or is embedded in a physical or digital product.

The revised EU Product Liability Directive represents one of the most significant developments for AI-related liability in Europe. Rather than creating a separate liability regime for artificial intelligence, the EU Product Liability Directive adapts existing product liability concepts to the realities of digital products and AI-enabled technologies. In particular, it expressly recognizes software as such as a product, regardless of whether it is supplied on a physical device, downloaded, cloud-based or provided as software-as-a-service. Consequently, developers and providers of AI systems may increasingly find themselves within the scope of product liability rules where this would previously have been uncertain. The revised EU Product Liability Directive also expands the scope of recoverable damage, including certain forms of data loss or corruption, reflecting the economic significance of digital assets in modern products and services.

In this context, a defect may originate from several different sources. It may result from the original system design, the quality or suitability of the training data, subsequent software updates, the behavior of the model in specific operating conditions or inadequate monitoring after the product has been placed on the market.
An illustrative example would be an AI-enabled product that causes property damage or personal injury. Examples could range from AI-supported medical devices and autonomous industrial systems to smart consumer products that make decisions based on real-time data and continue to evolve through software updates. In such a case, the central issue may be whether the product provided the level of safety that the public was entitled to expect, taking into account its intended purpose, its foreseeable use, the instructions and warnings supplied with it, and any relevant updates or modifications.

The interaction between the EU AI Act and product liability is likely to become increasingly important. While the AI Act does not itself establish a civil liability regime, compliance with the EU AI Act is likely to play an increasingly important role when courts assess whether an AI-enabled product provided the level of safety that users were entitled to expect. In practice, this may mean that regulatory compliance and liability assessments can no longer be viewed in isolation. Failures that initially appear to be compliance issues may ultimately become central evidence in product liability litigation. Requirements relating to data quality, transparency, accuracy, robustness and human oversight may therefore influence future assessments of product defectiveness. Regulatory compliance and civil liability are likely to become increasingly interconnected, although the precise relationship between the two regimes will ultimately need to be clarified by the courts.
AI also creates a particular challenge because the behaviour of an AI-enabled product may change over time. A product that appeared safe when initially supplied may subsequently be affected by updates, new data or changes in its operating environment. This may complicate the assessment of when the relevant defect arose, and which party was responsible for it.

This challenge is reflected in the revised European product liability framework. Traditional product liability has often focused on the condition of a product at the time it was first placed on the market. AI-enabled products, however, frequently evolve throughout their operational lifecycle through software updates, patches, retraining activities or modifications to connected digital services. The revised EU Product Liability Directive therefore recognizes that product safety may need to be assessed on a more dynamic basis. In practice, this means that liability assessments may no longer focus exclusively on the moment a product was first placed on the market, but may extend throughout significant parts of the product's operational lifecycle. Manufacturers that retain influence over the functioning of a product through ongoing updates and digital services may continue to bear responsibility for maintaining appropriate levels of safety after the product has entered the market.

The new framework may also have a significant impact on litigation. One of the recurring challenges in AI disputes is that the operation of complex systems can be difficult for claimants to understand and prove. To address these challenges, the new framework introduces disclosure mechanisms and evidentiary presumptions in certain circumstances. Where technical or scientific complexity makes proof particularly difficult, courts may be prepared to draw inferences regarding defectiveness or causation. For businesses and insurers, this may prove just as significant as the expansion of the product concept itself, as liability exposure may increase not only because more AI systems fall within the scope of product liability, but also because claims may become easier to pursue successfully.

The insurance implications may extend beyond traditional product liability insurance. Depending on the circumstances, product liability, technology errors and omissions, cyber, property and recall coverage may all become relevant. The precise allocation of risk will depend on the wording of the applicable policies and on whether the loss is characterized as arising from a defective product, a deficient service, a cyber incident or another insured event.

The Challenge of Causation in Multi-Party AI Ecosystems

AI systems are rarely developed, supplied, deployed and operated by a single party. A typical AI ecosystem may particularly involve model developers, software providers, cloud service providers, system integrators, data providers and business users.

As a result, several parties may potentially be involved when an AI system causes loss. The model developer may have designed or trained the model, a software provider may have incorporated it into an application, a system integrator may have configured the application for a particular business process, and the business user may have determined how the system was ultimately deployed and supervised.

In such circumstances, establishing that a loss occurred may be considerably easier than identifying the actual source of the failure. The relevant failure could lie in the model itself, the training data, the technical integration, the configuration of the system, the instructions given to users or the absence of adequate human oversight.
This complexity places particular importance on documentation, auditability and contractual risk allocation. Contracts should clearly define the parties’ respective responsibilities, including responsibility for testing, validation, training, monitoring, updates, incident management and regulatory compliance.

For insurers, multi-party AI ecosystems may create difficult questions regarding causation, aggregation, subrogation and overlapping coverage. Where several parties and policies are potentially involved, disputes may arise not only over whether the loss is insured, but also over which insured party or insurer should ultimately bear it.

AI Governance and the Growing D&O Exposure

AI is increasingly becoming a board-level issue rather than a purely technical or operational matter. Where AI deployments are material to an organization’s business, management teams may be expected to understand the associated risks and to establish appropriate structures for oversight and control.
Potential liability may therefore arise even where the AI system itself does not malfunction. The relevant failure may instead consist of inadequate governance surrounding, the decision to procure, implement, use or monitor the system and its challenges and risks.

While AI may significantly enhance the information available to management, it does not replace the responsibility of directors and officers for the decisions taken. The increasing use of AI therefore does not create an entirely new catalogue of management duties. Rather, traditional obligations relating to selection, implementation, supervision and control of business processes must be adapted to the specific characteristics and risks of AI systems.

Questions may arise as to whether management sufficiently assessed the risks of a material AI deployment, allocated clear responsibilities, ensured compliance with applicable legal requirements and responded adequately to known incidents or warning signs. From a governance perspective, management may therefore be expected to assess whether a particular AI system is suitable for its intended purpose, whether it has been implemented in a manner consistent with the organization’s operational and risk profile and whether appropriate testing has been carried out before deployment. These responsibilities are unlikely to end once the system has been introduced. Particularly where AI systems continue to evolve through updates, learning processes or changing datasets, ongoing monitoring and review may become an essential component of effective governance.

Particular challenges may arise where AI systems operate as so-called “black boxes” and the reasoning behind a recommendation cannot readily be explained. While directors are unlikely to be expected to understand every technical aspect of an underlying model, they may nevertheless be required to satisfy themselves that the output is sufficiently plausible and reliable for the purpose at hand. The more significant the decision and the greater the potential impact, the greater the expectation that AI-generated recommendations will be validated through additional review, independent sources of information or other verification mechanisms.

The liability question is therefore unlikely to be whether an AI system ultimately generated an incorrect output. Rather, courts are likely to focus on whether management established and followed an appropriate decision-making process. This aligns with the principles underlying the business judgement rule, which generally protects directors and officers from personal liability for business decisions that subsequently turn out to be wrong or unsuccessful, provided that they acted on the basis of adequate information and exercised reasonable business judgement at the time the decision was made. In the context of AI-assisted decision-making, the business judgement rule is unlikely to depend on whether AI was used. Instead, the focus will generally be on whether directors could reasonably rely on the information available at the time and exercised appropriate judgement in evaluating and using AI-generated recommendations. The business judgement rule protects the management decision, not the AI output itself. Accordingly, a mistaken AI recommendation will not in itself give rise to liability if management acted reasonably when selecting, reviewing and relying upon the information available at the time. Conversely, the existence of an AI recommendation will not automatically shield management from liability. Where AI-generated outputs are adopted without meaningful scrutiny, where obvious inconsistencies are ignored, or where the system is relied upon outside its intended scope, the protection afforded by the business judgement rule may be significantly more difficult to invoke. 

Looking ahead, a further question may emerge: Not whether management was entitled to use AI, but whether it should have used available AI tools in the first place. While no general obligation currently exists, expectations may evolve as certain technologies become more established and capable of improving decision quality, risk identification and corporate oversight.

This creates a potential connection between AI governance and directors’ and officers’ liability. Claims could focus on alleged failures of oversight, inadequate internal controls, insufficient documentation or deficiencies in the process by which AI-supported decisions were assessed, documented and implemented. The quality of the governance framework and the evidence documenting management’s deliberations may therefore become central to the defence of such claims.

Will Insurance Drive the Next AI Standards?

Courts and regulators will play an important role in defining acceptable AI practices. However, insurers may prove equally influential in shaping the standards that organizations are expected to meet.
Underwriters are increasingly likely to examine how an organization governs, tests and monitors its use of AI. Insurance requirements may therefore help determine what constitutes a reasonable and insurable AI deployment in practice.

Several areas are likely to attract particular scrutiny:

• the existence and effectiveness of an AI governance framework;
• clearly defined human oversight mechanisms;
• appropriate testing and validation procedures;
• comprehensive documentation and auditability;
• effective incident detection and response capabilities; and
• robust vendor, model and supply-chain risk management.

Organizations that cannot demonstrate adequate controls in these areas may face more restrictive policy terms, higher premiums, lower coverage limits or more extensive exclusions. Conversely, organizations that can evidence mature AI governance may be better positioned to obtain appropriate coverage and defend future liability claims.

Insurance may therefore do more than respond to AI-related losses. Through underwriting standards and coverage requirements, insurers may actively influence how organizations design, procure and deploy AI systems.

Conclusion

AI does not necessarily create an entirely new category of liability. Instead, it reshapes established legal concepts and makes their application more complex.

Traditional questions concerning defective products, professional negligence, causation, corporate oversight and contractual risk allocation remain relevant. However, AI introduces new technical dependencies, new evidentiary difficulties and increasingly complex relationships between the parties involved.
The most significant disputes are therefore likely to arise at the intersection of liability and insurance. Questions of causation, oversight, coverage and risk allocation will become increasingly central as AI is embedded more deeply in products, professional services and corporate decision-making.

Ultimately, organizations will need to demonstrate not only that they used AI, but that they used it responsibly. This will particularly require effective governance, meaningful human oversight, appropriate testing, reliable documentation and a clear allocation of responsibilities throughout the AI value chain.