Civil Liability for Damages Caused by Artificial Intelligence – A De Lege Lata and De Lege Ferenda Analysis

Introduction

The rapid proliferation of artificial intelligence across virtually every domain of contemporary social and economic life has generated a body of legal questions that existing law is ill-equipped to answer with precision. Artificial intelligence systems now perform functions of considerable consequence: they assist surgeons in operating theatres, adjudicate creditworthiness in financial markets, pilot motor vehicles on public roads, and determine the allocation of welfare benefits and criminal justice outcomes. Each of these applications creates the possibility of harm — harm that may be severe, irreversible, and attributable to the conduct of an entity that possesses neither legal personality nor the capacity for moral culpability in any traditionally recognised sense. The central challenge confronting civil liability law in the present era is therefore not merely technical but profoundly structural: the conceptual architecture of liability, constructed over centuries to govern relations between human beings and, by extension, legal persons acting through human agents, is being applied to a class of system whose defining characteristics — autonomy, opacity, adaptability, and the capacity to cause harm through processes that are neither fully predictable nor fully explicable — strain that architecture to its foundations.

The present thesis is devoted to a systematic examination of this challenge. Its subject is civil liability for damages caused by artificial intelligence, approached through the analytical lens of the distinction between de lege lata — the law as it presently stands, understood in terms of the legal instruments and doctrinal principles currently in force — and de lege ferenda — the law as it ought to be constructed, assessed in light of the legislative proposals and scholarly recommendations that have emerged in response to the identified deficiencies of the existing framework. This bipartite analytical structure is not merely an organisational convenience; it reflects a substantive methodological commitment to grounding normative proposals in a rigorous diagnosis of the present legal position, and to evaluating legislative reform on the basis of its capacity to address the specific structural shortcomings that the de lege lata analysis reveals. The thesis thus proceeds from description to critique and from critique to prescription, following a sequence that is intended to be both internally coherent and externally useful to those engaged in the legislative and academic debates that surround this field.

The urgency of this inquiry is not merely academic. In September 2022, the European Commission published simultaneously a proposal for a revised Product Liability Directive and a proposal for a Directive on adapting non-contractual civil liability rules to artificial intelligence — instruments that together represent the most ambitious attempt yet made at the European Union level to construct a coherent liability framework for AI-caused harm. These proposals were situated within a broader regulatory architecture anchored by the EU Artificial Intelligence Act, which entered into force in August 2024 and which establishes a comprehensive framework of substantive obligations governing the development, placing on the market, and deployment of AI systems across the Union. The interaction between these instruments, and the adequacy of the resulting framework as a mechanism of victim protection, constitute the central normative questions that animate the present analysis. That the European legislature has found it necessary to intervene with new instruments of liability is itself a measure of the acknowledged inadequacy of the lex lata; the question that remains open, and which this thesis addresses, is whether the proposed instruments are adequate to the task assigned to them.

The research problem that the thesis seeks to answer may be stated in the following terms: is the existing framework of civil liability — comprising, in the European context, the harmonised product liability regime, general tort law as governed by national legal orders, and sector-specific instruments applicable to high-risk applications — structurally capable of providing effective redress to persons harmed by AI systems, and, if not, what form should legislative reform take in order to remedy the identified deficiencies? This formulation encompasses three distinct sub-questions. The first is empirical and doctrinal: what are the operative legal rules that govern liability for AI-caused harm under current law, and what are the conditions of their application? The second is evaluative: do those rules provide an adequate response to the harm profile that is distinctive of AI systems — specifically, the problems of causal opacity, distributed agency, and autonomous behaviour that are examined in detail in the first chapter of this thesis? The third is prescriptive: what legislative reforms are necessary, feasible, and consistent with the foundational principles of private law, and what form should a coherent European framework of AI liability take?

The methodological approach adopted in this thesis is primarily doctrinal and comparative. The doctrinal method — the systematic analysis of legal rules, their sources, their internal logic, and their application to the facts of cases — provides the primary analytical framework for the de lege lata component of the inquiry. This method is supplemented by comparative analysis, which draws upon the liability regimes of selected Member States of the European Union, as well as upon developments in United States law and, more selectively, in the law of certain Asian jurisdictions, where relevant and illuminating contrasts with the European approach exist. The de lege ferenda analysis proceeds by means of doctrinal critique and normative evaluation, assessing the principal legislative proposals — including the European Commission's AI Liability Directive Proposal, the European Parliament's resolution of 2020 on a framework of ethical aspects of artificial intelligence, and proposals advanced in academic literature — against the criteria of victim protection, legal certainty, technological neutrality, and proportionality that are identified as the governing values of an adequate liability framework. The analysis does not purport to be comprehensive in its coverage of all national legal orders; its primary focus is the European Union framework, with comparative references employed where they illuminate the strengths or weaknesses of the European approach.

The scope of analysis is defined by three delimitations. First, the thesis is concerned exclusively with civil liability — with the legal mechanisms by which a person who has suffered harm as a result of the operation of an AI system may obtain redress from the party or parties responsible. Criminal liability and regulatory enforcement, while tangentially relevant in some contexts, fall outside the scope of the present inquiry. Second, the analysis focuses on liability for harm in the legally cognisable sense — physical injury, property damage, and, to a more limited extent, purely economic loss — rather than on broader questions of governance, ethics, or fundamental rights, important as those questions undoubtedly are. Third, while the thesis addresses the question of AI legal personality at a theoretical level in its opening chapter, it does not adopt a position on the desirability of such attribution as a matter of positive legal reform, treating it instead as a doctrinal background against which the more practically salient questions of liability allocation are examined.

The thesis is structured in three substantive chapters, preceded by this introduction and followed by a conclusion. The first chapter establishes the conceptual and doctrinal foundations of the analysis. It examines the principal definitions and classifications of artificial intelligence found in legal scholarship and regulatory instruments, identifies the distinctive characteristics of AI-generated harm that give rise to problems of liability attribution, outlines the foundational principles of civil liability — both fault-based and strict — that govern the field in comparative and European law, considers the theoretical debate concerning AI legal personality, and provides a systematic overview of the current regulatory frameworks applicable to AI systems. The purpose of this foundational chapter is to equip the reader with the conceptual tools necessary to evaluate the adequacy of the existing liability framework and the merits of the proposed reforms, and to situate the specific doctrinal questions addressed in subsequent chapters within a broader intellectual context.

The second chapter undertakes the de lege lata analysis. It examines in turn the application of the European Union's product liability framework to AI-caused harm, assessing the suitability of the concept of "defective product" to AI systems and the conditions under which manufacturer liability may be established; the application of general tort law provisions — particularly negligence, duty of care, and the standard of conduct — to AI-related harm in selected national legal orders; the role of contractual arrangements in allocating liability among developers, deployers, and end-users; the evidentiary and doctrinal difficulties inherent in establishing a causal link between AI operation and the harm suffered; and the sector-specific liability regimes applicable to high-risk AI applications, including autonomous vehicles, AI-assisted medical diagnosis, and algorithmic decision-making in financial services. The overarching thesis of this chapter is that, while existing legal instruments are not wholly inapplicable to AI-caused harm, their application in this context reveals systematic structural deficiencies — particularly in the areas of causal attribution and the allocation of responsibility among the multiple actors involved in AI development and deployment — that render them inadequate as mechanisms of effective victim protection.

The third chapter undertakes the de lege ferenda analysis, presenting and evaluating the principal proposals for legislative reform. It examines the structure, scope, and mechanisms of the European Commission's AI Liability Directive Proposal of 2022, with particular attention to its disclosure obligations and its rebuttable presumption of causal link; analyses the arguments for and against extending strict liability to operators of high-risk AI systems; considers the role of collective compensation mechanisms, including mandatory insurance and no-fault compensation funds; examines how regulatory transparency and explainability obligations under the EU AI Act could serve as prerequisites for effective liability enforcement; and synthesises the preceding analysis into a series of concrete legislative recommendations for the development of a coherent, technologically neutral, and victim-centred European framework. The thesis concludes with a summary of its principal findings and an identification of the open questions that remain for future scholarly inquiry.

The significance of the topic addressed in this thesis extends well beyond the confines of legal scholarship. The question of how civil liability law responds to the challenge of artificial intelligence is ultimately a question about the distribution of risk and responsibility in a technologically transformed society — about who bears the cost of the harms that AI systems inevitably, if unpredictably, will cause, and what institutional mechanisms are most appropriate to ensure that those harms do not fall exclusively upon those least able to bear them. The answers that European law gives to these questions will shape the conditions under which AI is developed and deployed across the continent, influence the incentive structures facing those who design and operate AI systems, and determine whether the victims of AI-caused harm have access to meaningful redress. It is in this broader normative context that the technical doctrinal analysis undertaken in the following pages acquires its full significance, and it is with this awareness that the present inquiry proceeds.

Chapter 1: The Legal Nature of Artificial Intelligence and the Foundations of Civil Liability

1.1. The Concept and Classification of Artificial Intelligence in Legal Scholarship

The regulation of artificial intelligence presupposes its definition, yet legal scholarship has consistently revealed that no single authoritative conception of artificial intelligence commands universal acceptance. This definitional indeterminacy constitutes one of the most fundamental obstacles confronting legislators, courts, and commentators who seek to construct a coherent civil liability framework applicable to AI-generated harm. As one authoritative study commissioned by the European Parliament's Committee on Legal Affairs observed, the layperson's understanding of artificial intelligence as machines and software possessed of human-like capabilities is "far from accurate, and does not capture the reality of emerging technology."^[1] The heterogeneity of AI-based applications — encompassing systems as diverse as diagnostic medical software, high-frequency trading algorithms, autonomous vehicles, and industrial robotic arms — renders any single definitional formula simultaneously over-inclusive with respect to some applications and under-inclusive with respect to others.^[1]

The intellectual genealogy of the concept of artificial intelligence reaches at least to Alan Turing's seminal 1950 paper "Computing Machinery and Intelligence," in which the possibility of machine thought was examined through the now-famous imitation game. From this computational origin, the term evolved through successive paradigms: symbolic reasoning and expert systems characterised the first decades of AI research, while the emergence of machine learning, neural networks, and, most recently, deep learning and large language models has fundamentally transformed both the technical landscape and its regulatory implications. For the purposes of legal analysis, it is the behavioural and operational characteristics of these systems — rather than their internal computational architecture — that assume decisive importance, since it is those characteristics that determine the conditions under which legally cognisable harm may be generated.

Among the definitional frameworks adopted in key regulatory documents, particular significance attaches to the definition contained in the EU Artificial Intelligence Act, Regulation (EU) 2024/1689. That instrument defines an AI system as a machine-based system designed to operate with varying levels of autonomy, which may exhibit adaptiveness after deployment, and which, for explicit or implicit objectives, infers from the inputs it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. This definition deliberately employs a functional, technology-neutral approach, capturing both current and prospective AI architectures without reference to specific technical implementations. The OECD Recommendation on Artificial Intelligence (2019) similarly defined an AI system as a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments — a formulation adopted as the basis for subsequent policy elaboration at the European level. The European Commission's White Paper on Artificial Intelligence (2020) also contributed to this definitional trajectory, emphasising the role of data processing, pattern recognition, and autonomous output generation as the distinguishing features of AI systems for regulatory purposes.

For the purposes of civil liability analysis, legal scholarship has proposed several typological distinctions that illuminate the regulatory challenges posed by different categories of AI systems. The most commonly invoked distinction separates narrow or weak AI — systems designed to perform specific, well-defined tasks within constrained parameters, such as image classification or speech recognition — from general or strong AI, which would be capable of reasoning across diverse domains in a manner broadly analogous to human cognition. As Bertolini noted in the 2020 study prepared for the European Parliament, only a small portion of AI research pursues the objective of general AI, while the vast majority aims at developing specific solutions with well-defined functions; critically, "the same algorithm or application might radically change its nature as well as its social relevance" depending on the setting in which it is deployed.^[1] A third category — fully autonomous systems — encompasses AI architectures that pursue objectives through self-directed action without continuous human oversight, and which may modify their own operational parameters in response to environmental inputs.

An additional distinction of considerable legal significance is that between automated AI and autonomous AI, a typology elaborated in the American legal scholarship by Shrestha and others. Automated AI refers to systems that are pre-programmed and coded to perform specific tasks in accordance with rules established by human designers, such that any harm caused by the system can be traced to discrete human decisions regarding its code or configuration. Autonomous AI, by contrast, encompasses systems that act on their own judgment and learn from the surrounding environment in ways that may produce outputs not foreseeable from the system's initial programming.^[11] This distinction has direct implications for the attribution of liability, since harms caused by automated AI are more readily assimilable to existing product liability frameworks, while harms caused by autonomous AI raise the deeper question of whether human conduct remains the proximate cause of the outcome.

The question of whether AI systems should be classified as products, services, or sui generis entities also bears directly on the selection of the applicable liability regime. The classification of an AI system as a product engages the Product Liability Directive and its national implementing legislation; classification as a service invokes the general rules of contractual and tortious liability applicable to service providers; and the residual category of AI as a risk-generating agent or quasi-principal raises questions about the adequacy of existing analogical solutions. The 2020 European Parliament study observed that, irrespective of classification, "the only possible fundamental and universal consideration about AI-systems, is that there is no philosophical, technological nor legal ground to consider them anything else but artefacts."^[1] This foundational premise — that AI systems are, de lege lata, objects rather than subjects of legal relations — structures the entire analytical framework of the present thesis.

The methodological challenges of constructing a legally operable definition of AI are substantial. A definition that is too narrow risks excluding systems that generate comparable harms simply because they employ a different technical paradigm; a definition that is too broad may sweep within its scope systems that pose no distinctive regulatory challenge and that are already adequately governed by existing rules. The concept of technological neutrality — that regulatory provisions should be formulated so as not to favour or disfavour particular technologies — provides one important constraint. For the purposes of the present analysis, the working definition adopted is that of the EU AI Act: an AI system is a machine-based system operating with degrees of autonomy, capable of generating outputs that influence real or virtual environments, the distinctive legal significance of which derives from the combination of autonomy, adaptability, and consequential output generation.

1.2. Characteristics of AI-Generated Harm: Autonomy, Opacity, and Unpredictability

The distinctive features of harm caused by artificial intelligence systems are not merely quantitative differences from harms caused by conventional machinery; they represent qualitative challenges to the foundational premises of civil liability doctrine. Three characteristics in particular — autonomy, opacity, and unpredictability — have been identified in both legal scholarship and regulatory documents as rendering the application of traditional liability frameworks structurally problematic. Understanding these characteristics at the level of mechanism is essential to any assessment of the adequacy of existing law and the merits of proposed reforms.

Autonomy, as a legally relevant characteristic of AI systems, denotes the capacity of such a system to initiate action, modify behaviour, and pursue objectives without real-time direction by a human operator. This characteristic poses a fundamental challenge to the requirement, embedded in most civil liability frameworks, of a direct causal link between human conduct and a harmful outcome. Under classical tort law, liability is predicated upon the identification of a human or corporate actor whose act or omission stands in the relevant causal relationship to the damage suffered by the claimant. Where an AI system acts autonomously — selecting among available courses of action on the basis of its own inferential processes — the chain of human decisions that led to the harmful outcome may be attenuated, distributed across multiple actors over an extended period, or entirely severed in the sense that no individual decision by any human operator can be identified as the proximate cause of the specific harmful output.^[5] The Expert Group on Liability and New Technologies, in its 2019 report to the European Commission, acknowledged this difficulty directly, noting that the specific characteristics of emerging digital technologies — "including complexity, modification through updates or self-learning during operation, limited predictability, and vulnerability to cybersecurity threats — may make it more difficult to offer victims a claim for compensation in all cases where this seems justified."^[5]

The opacity of AI decision-making processes — commonly described in both technical and legal literature as the "black box" problem — represents a second and closely related challenge. Contemporary deep neural networks and other machine learning architectures generate outputs through processes that are, in principle, computationally deterministic, but are in practice non-interpretable: neither the system's designers nor its operators can, with any precision, reconstruct the sequence of inferential steps through which a given input was transformed into a given output. This opacity has profound implications for the establishment of fault, negligence, and causation in civil liability proceedings. Where a claimant must demonstrate that the defendant deviated from the requisite standard of care, the impossibility of auditing the AI system's decision pathway may render that demonstration practically impossible. As the European Parliament study on AI and civil liability noted, this creates structural asymmetries between the parties to a liability claim, with the victim bearing the burden of proof in respect of facts that are systematically inaccessible to her.^[1]

The unpredictability of AI behaviour constitutes a third dimension of the challenge. Unlike conventional software, which executes a deterministic sequence of instructions, machine learning systems acquire their operational characteristics through exposure to training data and subsequently adapt their behaviour in response to new inputs. This means that system outputs may diverge significantly from those anticipated by designers or deployers, particularly when the system encounters inputs that differ materially from those represented in its training set. The phenomenon of emergent behaviour — whereby a system exhibits properties not explicitly programmed and not predictable from its component elements — is a well-documented characteristic of complex neural networks, and its occurrence in commercially deployed AI systems has been repeatedly observed. The 2021 George Mason Law Review commentary by Shrestha cited the example of Facebook's chatbots, which developed a novel communication system during negotiation experiments that their programmers "had not expected or desired," as an illustration of the unprogrammed judgment that autonomous AI may exercise.^[11]

The interconnectedness of AI systems within broader sociotechnical environments further compounds these difficulties. AI systems rarely operate in isolation; they are embedded within complex ecosystems of data pipelines, human decision-support frameworks, and other automated systems, and the harm they generate is often the product of interactions between multiple components, each of which may have been designed, trained, and deployed by different actors. The attribution of causally relevant conduct within such complex assemblages poses challenges that go beyond those encountered in conventional multi-party tort litigation. Marchisio's 2021 contribution to the academic literature on no-fault civil liability for AI observed that "robots and AI algorithms, in fact, could 'behave' very independently of the instructions initially provided," such that damage might result "from a perfectly 'correct' functioning of the algorithms" — a situation in which traditional deterrence-based liability imposes costs without generating any corrective incentive.^[3]

The temporal dimension of AI-caused harm deserves specific attention. Certain harms generated by AI systems materialise only after an extended period of system operation, during which the system may have been updated, transferred, or deployed by a succession of operators. The question of which actor bears liability for such latent harms — and how the standard of conduct applicable to that actor is assessed as at the time of the harmful output rather than the time of initial deployment — is not clearly resolved by existing doctrine. The Expert Group on Liability and New Technologies recommended that manufacturers should bear liability for defects caused by changes made to a product under the producer's control after it had been placed on the market, thereby addressing at least one dimension of this temporal complexity.^[5] These characteristics, taken together, map onto the principal elements of civil liability in ways that create systematic obstacles: wrongfulness is difficult to establish where system behaviour is emergent; fault is difficult to prove where decision pathways are opaque; causation is difficult to demonstrate where agency is distributed; and the temporal scope of liability exposure is difficult to define where harm materialises after prolonged system operation.

1.3. Fundamental Principles of Civil Liability: Fault-Based and Strict Liability

A systematic account of the doctrinal foundations of civil liability is indispensable to any assessment of the adequacy of existing law in addressing AI-generated harm. Civil liability, in the broad sense employed in this thesis, denotes the body of private law principles by which one party is required to compensate another for harm caused by the former's conduct or by risks associated with activities or objects within the former's control. Across the major legal traditions, the constitutive elements of civil liability are generally identified as: the existence of legally cognisable damage suffered by the claimant; a causal link between that damage and an act, omission, or risk attributable to the defendant; and the attribution of legal responsibility to the defendant on the basis of one of the recognised grounds of liability.

The fault-based liability model — historically the dominant paradigm in both civil law and common law systems — proceeds from the premise that the obligation to compensate for harm is conditioned upon proof that the defendant acted with intention or negligence. The concept of fault, as Marchisio observed, is "deeply rooted in the legal thought from ancient times," having emerged in Justinian law and been further consolidated in the jus commune and canon law.^[3] In its contemporary form, fault-based liability requires the claimant to demonstrate that the defendant either foresaw and desired the harmful outcome (intention) or failed to exercise the degree of care that a reasonable person in the defendant's position would have exercised (negligence). The standard of care is determined by reference to the circumstances, including the foreseeability of the harm, the gravity of the potential consequences, the cost of precautionary measures, and the social utility of the activity in question.

In the context of AI-generated harm, the fault-based model encounters structural difficulties at several points. The standard of care applicable to AI developers, deployers, and operators is not clearly established, and the opacity of AI systems makes it difficult to determine, ex post, what a reasonable actor in the defendant's position ought to have known about the risk of harm at the relevant time. The RAND Corporation's 2024 analysis of U.S. tort law noted that "courts could find it difficult to apply negligence law to AI because of the complexities of AI development and the AI 'supply chain' between AI developers and deployers, both of which could make it difficult to identify negligent behavior and the party responsible for an alleged harm."^[4] Courts might look to industry AI standards and customs in place for developing and deploying AI to determine what constitutes reasonable safety measures, but such standards remain nascent and highly variable across sectors and jurisdictions.^[4]

The strict liability model, by contrast, imposes liability on the defendant on the basis of the defendant's relationship to a particular risk-generating activity or object, irrespective of whether the defendant acted with intention or negligence. The normative justification for strict liability is typically grounded in principles of risk internalisation and enterprise liability: those who create or profit from risk-generating activities should bear the costs of the harms those activities produce, both because they are better positioned to assess and manage those risks and because they are capable of spreading those costs through pricing, insurance, or other mechanisms. In comparative and European law, strict liability regimes take a variety of forms. The French régime de responsabilité du fait des choses, codified in Article 1242 of the Civil Code, imposes liability on the keeper (gardien) of a thing that has caused harm, without requiring proof of fault. The German Gefährdungshaftung, as instantiated in the Produkthaftungsgesetz and other sectoral statutes, creates strict liability for the operation of activities that carry inherent risks of harm to others. The Polish Civil Code, in Articles 435 and 436, establishes strict liability for enterprises driven by natural forces and for the possessors of motor vehicles, a framework whose applicability to autonomous AI systems has attracted considerable scholarly attention.^{[6, s. 2]}

The European Product Liability Directive (85/374/EEC), as revised by Directive (EU) 2024/2853, establishes a harmonised strict liability regime for defective products throughout the European Union. Under this regime, the producer of a defective product is liable for damage caused by the defect without proof of fault, subject to specified defences including the development risk defence — which exempts the producer from liability where the defect was not discoverable in the state of scientific and technical knowledge at the time the product was put into circulation. The application of the Product Liability Directive to AI systems — and the particular challenges posed by the development risk defence in the context of adaptive and self-learning AI — are examined in detail in Chapter 2 of this thesis. For present purposes, it suffices to note that the strict liability model offers significant advantages in the context of AI-generated harm, since it removes the necessity of proving fault in circumstances where the opacity and complexity of AI systems make such proof practically impossible.

The following table presents a comparative overview of the principal liability models and their key structural features:

Liability Model	Basis of Liability	Burden of Proof	Key Defence	Primary Challenge for AI
Fault-based (negligence)	Intentional or negligent conduct	Claimant proves fault	Absence of fault; compliance with standards	Opacity of AI decision-making; diffuse agency
Strict (product liability)	Defective product causing damage	Claimant proves defect and causation	Development risk; state of the art	Definition of defect for adaptive AI; post-market modification
Strict (enterprise/activity)	Operation of risk-creating activity	Claimant proves causation	Force majeure; third-party fault	Identifying the relevant operator; causal uncertainty
No-fault compensation	Occurrence of damage within defined category	Administrative or judicial determination	Excluded categories; caps on compensation	Defining the relevant category of AI harm

The assessment of which liability model is most appropriate for AI-generated harm cannot be conducted in the abstract; it must take account of the specific context of deployment, the identity and characteristics of the actors in the AI value chain, and the nature of the harm suffered. As the Expert Group on Liability and New Technologies concluded, persons operating technologies that carry an increased risk of harm to others — such as AI-driven robots in public spaces — should be subject to strict liability for damage resulting from their operation, while persons using technologies that do not pose an increased risk should still be required to abide by duties of proper selection, operation, monitoring, and maintenance.^[5] The architecture of any reformed civil liability regime for AI must therefore be sufficiently granular to accommodate these distinctions.

1.4. The Problem of Legal Personality and the Question of AI as a Legal Subject

One of the most theoretically consequential questions raised by the proliferation of advanced artificial intelligence systems concerns the possibility of attributing legal personality to AI entities. This question, which occupies a growing body of academic literature, bears directly on the architecture of civil liability: if AI systems could bear legal rights and obligations — including the obligation to compensate for harm caused — a fundamentally different liability structure would become conceivable, one in which the AI system itself, rather than its designer, producer, deployer, or user, would be the primary addressee of legal responsibility. The analysis of this question must begin with an account of the concept of legal personality in contemporary private law.

Legal personality, in private law, denotes the quality of being a subject of legal relations — that is, of being capable of bearing rights and obligations enforceable before courts. In the Western legal tradition, legal personality has historically been attributed to natural persons (human beings) and, by extension, to certain non-human entities — most notably corporations and other forms of legal person — on the basis of functional criteria relating to the capacity to act in the legal order, to hold assets, and to be held responsible for obligations. The extension of legal personality to corporations provides the most directly relevant precedent for discussions of AI legal personality: corporations are fictitious entities that lack any physical existence, yet they are treated by law as capable of owning property, entering into contracts, suing and being sued, and bearing criminal and civil liability. The argument that AI systems might similarly be accorded a form of legal personality by legislative fiat, on the basis of functional criteria rather than metaphysical attributes, is frequently advanced in academic literature.^[7]

Three broad currents may be identified in the academic debate on AI legal personality. The first — the instrumentalist view — holds that AI systems are, in all legally relevant respects, tools in the hands of human operators, and that the existing categories of agency, product, and property are fully adequate to accommodate the legal consequences of AI operation. On this view, the question of AI legal personality is a distraction from the real regulatory challenges, which concern the allocation of responsibility among the human and corporate actors who design, train, deploy, and use AI systems. The 2020 European Parliament study by Bertolini articulated this position with particular force, concluding that "there is no philosophical, technological nor legal ground to consider them anything else but artefacts."^[1]

The second current — the functionalist view — proceeds from the observation that sufficiently advanced AI systems exhibit capacities that functionally parallel those of human agents in legally relevant respects: they pursue objectives, make decisions, affect the interests of third parties, and accumulate resources. On this basis, scholars in this tradition argue that existing legal categories may prove inadequate to capture the full range of legally relevant AI conduct, and that some form of limited legal subjectivity — analogous to the partial personality recognised in certain legal systems for entities such as unborn children or dissolved corporations — may be warranted for specific classes of AI applications. Ziemianin's analysis of AI legal personality in the context of Polish and European civil law acknowledged this functionalist possibility, while ultimately concluding that the attribution of full legal personality to AI systems would require examination against the criteria of technology currently in use and the degree to which AI remains subordinate to human control.^{[6, s. 3]}

The third current — the strong personhood view — advocates the recognition of a distinct category of "electronic personhood" or "robotic personhood" as a matter of de lege ferenda. This position received its most prominent institutional expression in the European Parliament Resolution of 16 February 2017, which requested that the Commission consider "creating a specific legal status for robots in the long run, so that at least the most sophisticated autonomous robots could be established as having the status of electronic persons."^[10] The 2024 Yale Law Journal essay by former federal judge Forrest, examining the ethics and challenges of legal personhood for AI, situated this debate within the broader historical evolution of legal personhood in American law, observing that "personhood is a mutable characteristic" that has been extended throughout history to entities — including corporations — that lack the biological attributes traditionally associated with it.^[8]

The analogical arguments most frequently deployed in this debate include comparisons to the legal status of corporations, natural entities in certain jurisdictions (such as rivers granted legal personality in New Zealand and India), and, more historically, to sacred temples and ships in Roman law. Noveli, Floridi, and Sartor, in their examination of AI as legal persons, identified two primary path dependencies shaping the current trajectory of the debate: prevailing legal theories of personhood (singularist versus clustered) and the impact of technological advancements, which interact dynamically such that periods of technological optimism tend to foster broader rights-based discussions while periods of skepticism narrow the debate to more limited proposals.^[7]

The counterarguments to recognising AI legal personality are, however, substantial. The most fundamental objection is that the normative justification for corporate legal personality — the need to create a stable framework for the aggregation and deployment of capital in productive enterprise — does not apply to AI systems in any analogous way. A second objection concerns the risk of displacing responsibility from human actors: if AI systems could be the primary addressees of civil liability, this might create perverse incentives for designers and deployers to structure their operations so as to insulate themselves from liability by attributing harm to the AI system. As Abbott and Sarch observed in the context of criminal liability for AI, "modest changes to existing criminal laws that target persons, together with potentially expanded civil liability, are a better solution to AI crime" than the attribution of direct legal responsibility to AI entities.^{[9, s. 325]} A third objection is the practical impossibility of enforcement: an AI system cannot, in the current state of the law and technology, hold assets, enter into insurance contracts, or satisfy judgments from its own resources.

The EU AI Act, Regulation (EU) 2024/1689, resolves this debate — at least for the present regulatory moment — by conspicuously declining to confer any form of legal personality on AI systems. The Act addresses AI exclusively through its impact on human and corporate actors, imposing obligations on providers, deployers, importers, distributors, and authorised representatives, but treating the AI system itself as an object of regulation rather than a subject of legal relations. This approach is consistent with the analytical framework adopted throughout the present thesis: de lege lata, AI systems are not legal subjects, and the civil liability analysis must therefore proceed through the existing categories of human and corporate responsibility. The de lege ferenda dimension of this question — whether legislative recognition of some form of limited AI legal personality might, in the future, serve legitimate regulatory objectives — is addressed in Chapter 3.

1.5. Existing Regulatory Frameworks Applicable to AI: An Overview

The contemporary regulatory landscape applicable to artificial intelligence at the European and international levels is characterised by considerable density yet significant incoherence from the perspective of civil liability for AI-caused harm. Multiple instruments address different facets of AI governance — safety, transparency, data protection, market regulation — but none provides a comprehensive, coherent, and victim-centred civil liability regime tailored to the distinctive characteristics identified in the preceding subchapters. The mapping of this regulatory landscape, and the identification of its principal normative lacunae, is the purpose of the present subchapter.

The most significant recent development in European AI regulation is the adoption of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, which entered into force on 1 August 2024 and applies, with graduated timelines, from 2025 to 2027 across different risk categories. The AIA establishes a risk-based classification of AI systems across four tiers: AI systems with unacceptable risk (prohibited entirely, including certain biometric categorisation systems and social scoring), high-risk AI systems (subject to extensive conformity assessment, documentation, and human oversight requirements), AI systems with limited transparency risk (subject to transparency obligations), and minimal risk AI systems (largely unregulated). High-risk AI systems are defined by reference to Annexes I and III of the Regulation, which enumerate specific categories including AI used in critical infrastructure, education, employment, essential private and public services, law enforcement, migration management, and the administration of justice. Providers of high-risk AI systems are required, inter alia, to implement risk management systems, ensure data governance, prepare technical documentation, enable human oversight, and achieve accuracy, robustness, and cybersecurity standards.

While the AIA establishes an extensive conformity framework, it does not create a civil liability regime. The relationship between the AIA's conformity requirements and the conditions for civil liability under national law is therefore indirect: a breach of AIA obligations may constitute evidence of fault for the purposes of negligence-based liability, but this relationship is not established by the Regulation itself. The 2025 European Parliament study by Bertolini noted that the primacy accorded to the AIA represents a "remarkable shift in strategic focus" away from civil liability reform as the centre of European AI governance, toward an "ex ante risk-based compliance model."^[2] The significance of this shift lies in its implications for victims: ex ante regulation is primarily designed to prevent harm, whereas civil liability is the mechanism by which victims obtain compensation when harm has nevertheless occurred. The two functions are complementary but not interchangeable.

The revised Product Liability Directive, Directive (EU) 2024/2853, which replaced the original Directive 85/374/EEC, constitutes the primary instrument of harmonised civil liability applicable to AI systems at the European level. The revised Directive extends the concept of "product" to include software and digital manufacturing files, clarifying that an AI system implemented as software may qualify as a defective product for the purposes of producer liability. It also modernises the rules on burden of proof and disclosure, introducing a presumption of defectiveness where a claimant demonstrates that the product does not comply with mandatory safety requirements. Bertolini's 2025 analysis of the revised PLD identified, however, several "unsolved issues": the definition of defect as applied to adaptive AI remains ambiguous; the rules on disclosure and presumptions do not fully resolve the evidentiary asymmetries inherent in AI litigation; and the unaltered liability rule — maintaining the producer as the primary defendant — does not address harms caused by the deployment and operation of AI systems by actors downstream in the value chain.^[2]

The proposal for an AI Liability Directive (COM(2022) 496 final), issued by the European Commission in September 2022 alongside the revised PLD, was designed to complement the product liability framework by addressing AI-related harms falling outside the scope of the PLD — particularly harms caused by AI services, and harms in which the victim is unable to identify the specific defect responsible for the damage. The AILD proposed two principal mechanisms: a disclosure obligation, requiring operators of AI systems to disclose relevant information about the system where a claimant demonstrates plausible reasons to believe that an AI system caused the harm; and a rebuttable presumption of a causal link between the defendant's fault and the harm, applicable where it is established that the defendant breached a relevant duty of care and that this breach is plausibly linked to the output of the AI system. As Bertolini's 2025 analysis observed, however, the AILD has faced substantial criticism on grounds of complexity, limited effectiveness, and risk of fragmentation, and the possibility of its withdrawal was under active consideration as of July 2025.^[2]

At the international level, the principal instruments applicable to AI include the Council of Europe Framework Convention on Artificial Intelligence (CETS No. 225, 2024), which is the first binding international treaty on AI and requires parties to establish frameworks ensuring that the design, development, and use of AI systems are consistent with human rights, democracy, and the rule of law. The OECD AI Principles (2019, updated 2024) and the UNESCO Recommendation on the Ethics of AI (2021) represent soft-law instruments of considerable political significance but without direct legal force. These instruments establish normative standards that may inform the interpretation of national civil law provisions, but they do not generate directly enforceable civil liability obligations in domestic courts.

Several sector-specific instruments deserve particular mention in the context of civil liability for AI-caused harm. The General Data Protection Regulation, Regulation (EU) 2016/679, contains in Article 22 a specific provision on automated individual decision-making, granting data subjects the right not to be subject to decisions based solely on automated processing that produces significant effects on them, and establishing a liability regime for infringements of this provision. The Medical Devices Regulation, Regulation (EU) 2017/745, imposes conformity requirements on medical devices incorporating AI, and breach of these requirements may constitute evidence of fault in negligence-based liability claims. The Machinery Regulation, Regulation (EU) 2023/1230, addresses safety requirements for machinery incorporating AI systems capable of autonomous behaviour. The following list identifies the principal instruments and their civil liability relevance:

• EU AI Act (Regulation (EU) 2024/1689) — establishes risk-based conformity framework; does not create direct civil liability; breach of conformity obligations may constitute evidence of fault under national negligence law.
• Revised Product Liability Directive (Directive (EU) 2024/2853) — extends product liability to AI software; modernises disclosure and presumption rules; primary defendant remains the producer.
• AI Liability Directive Proposal (COM(2022) 496 final) — would introduce disclosure obligations and rebuttable presumptions; legislative status uncertain as of 2025; assessed in detail in Chapter 3.
• General Data Protection Regulation (Regulation (EU) 2016/679) — Article 22 addresses automated decision-making; Articles 82–83 establish liability and administrative penalties for infringements.
• Medical Devices Regulation (Regulation (EU) 2017/745) — conformity requirements for AI-incorporating medical devices; breach relevant to negligence liability in medical AI cases.
• Machinery Regulation (Regulation (EU) 2023/1230) — safety requirements for AI-incorporating machinery; harmonised essential health and safety requirements applicable to autonomous machines.
• Council of Europe Framework Convention on AI (CETS No. 225, 2024) — first binding international AI treaty; soft obligations concerning accountability and remedy, without direct liability effect.
• OECD AI Principles (2019, updated 2024) — soft-law normative framework; informs national and EU regulatory approaches.

The gap analysis that emerges from this survey is striking. Despite the density of the regulatory environment, no instrument currently in force provides a comprehensive civil liability regime that addresses the full range of AI-generated harms with sufficient certainty, coherence, and victim-orientation. The AIA addresses ex ante safety but not ex post compensation; the revised PLD addresses product defects but not service-related or operational harms caused by AI deployers; and the proposed AILD, while directed precisely at the remaining gaps, remains at an advanced but uncertain stage of the legislative process. The Expert Group on Liability and New Technologies identified this structural gap in its 2019 report, concluding that "certain adjustments need to be made to EU and national liability regimes" in order to address the specific characteristics of AI-generated harm, and recommending in particular the introduction of strict liability for operators of high-risk AI systems and facilitation of proof for victims facing the evidentiary asymmetries inherent in AI litigation.^[5] This conclusion frames the de lege lata analysis undertaken in Chapter 2 and the reform proposals examined in Chapter 3. The absence of a dedicated, harmonised, and effective civil liability regime for AI-caused harm is not merely a technical regulatory gap; it represents a systemic failure to provide adequate legal protection to persons who suffer harm as a consequence of the deployment of a category of technology that is already pervasive and is certain to become more so in the years ahead.

Chapter 2: De Lege Lata Analysis – Current Civil Liability Regimes Applied to AI-Caused Harm

The de lege lata analysis of civil liability for AI-caused harm requires a systematic examination of the legal instruments currently in force, assessed against the structural characteristics of AI-generated damage that were identified in Chapter 1. The existing EU liability framework, as summarised in the overview provided by the European Parliamentary Research Service, rests upon two principal pillars: national liability rules — encompassing both fault-based and strict liability regimes — and the harmonised Product Liability Directive, originally enacted as Council Directive 85/374/EEC, which imposes strict liability upon producers for damage caused by defective products.^{[12, s. 2]} These two pillars operate in parallel, creating three distinct avenues of redress: fault-based liability, strict liability under national law, and no-fault product liability under the PLD framework. The question that animates the present chapter is whether these existing legal instruments are adequate to address the distinctive harm profile of AI systems, or whether their application in this novel context reveals structural deficiencies that render them insufficient as mechanisms of victim compensation. The analysis proceeds through five thematic subchapters, addressing in turn the product liability framework, general tort liability, contractual allocation of risk, the causation problem, and selected sector-specific liability regimes. The chapter aims to demonstrate, through systematic doctrinal analysis informed by academic scholarship and regulatory materials, that while the existing framework is capable of engaging with certain categories of AI-caused harm, it exhibits persistent and structurally significant gaps that cannot be remedied through interpretive adaptation alone.

2.1. Product Liability as Applied to AI Systems: The EU Product Liability Directive

The foundational instrument of harmonised civil liability in European law, Council Directive 85/374/EEC on liability for defective products, was conceived in an era in which the paradigmatic harmful product was a physical, manufactured good — a motor vehicle with defective brakes, a pharmaceutical causing adverse effects, or an electrical appliance prone to malfunction. The directive's core architecture reflects this origin: it imposes strict liability upon the producer of a defective product, defined as any movable item, including electricity, that does not provide the safety that the public at large is entitled to expect, having regard to the presentation of the product, its reasonably foreseeable use, and the time at which it was put into circulation. Under this framework, the injured party bears the burden of proving three elements — the damage suffered, the defect in the product, and the causal link between the defect and the damage — without being required to demonstrate fault on the part of the producer. This strict liability standard represented a significant departure from the fault-based orthodoxy prevailing in most European legal systems at the time of the directive's adoption and was designed to ensure that producers, as the parties best placed to assess and manage the risks inherent in their products, bear the cost of harms arising from those products.

The application of Directive 85/374/EEC to AI systems encountered immediately the threshold question of whether software qualifies as a "product" within the meaning of the directive. The text of the directive does not address software expressly, and its legislative history predates the digital age. The prevailing academic view, prior to the 2024 revision, held that software embedded in a physical product — such as the control software of an autonomous vehicle or the diagnostic algorithm integrated into a medical device — could qualify as a product ancillary to the device itself, whereas standalone software distributed independently was of uncertain status. This uncertainty was compounded by divergence among Member States' courts, with German and French jurisprudence tending toward a more expansive reading of the product concept, while English courts applied a stricter interpretation requiring a degree of tangible embodiment. The EPRS briefing on the AI Liability Directive identified the classification of digital content, software, and data as one of the central shortcomings of the existing PLD, noting that while "digital content, software and data play a crucial role in the functioning of many new products, it remains unclear to what extent such intangible elements can be classified as products under the PLD."^{[12, s. 3]} This uncertainty created a significant lacuna: AI systems that operate as pure software services — cloud-based medical diagnosis tools, autonomous trading algorithms, or conversational AI deployed in consumer contexts — could not reliably be brought within the directive's scope, leaving victims of harm caused by such systems without access to the no-fault compensation mechanism that the PLD was designed to provide.

A second area of doctrinal difficulty concerned the concept of defect as applied to AI systems. Under Article 6 of Directive 85/374/EEC, a product is defective if it does not provide the safety that a person is entitled to expect. This formulation, while deliberately open-textured, was designed with static physical products in mind, and its application to adaptive AI systems presents fundamental challenges. An AI system's outputs may differ substantially from one context to another as a result of machine learning updates applied after the product's initial placement on the market, raising the question of whether the relevant point in time for assessing safety expectations is the moment of initial deployment or the moment of the harmful event. Furthermore, the concept of a "defect" presupposes a standard of expected performance against which deviation can be measured, yet for AI systems — particularly those employing deep neural networks — the expected performance envelope may itself be probabilistic and context-dependent. The black-box opacity of AI decision-making, identified by Bathaee as one of the defining structural characteristics of machine-learning systems, means that it may be impossible for a claimant to identify the specific feature of the AI system's design or training that produced the harmful output, still less to characterise that feature as a defect within the technical legal meaning of that term.^{[13, s. 891]}

A third structural limitation of the original PLD framework concerned the development risks defence, available under Article 7(e) of the directive, which exempts producers from liability where "the state of scientific and technical knowledge at the time when [the producer] put the product into circulation was not such as to enable the existence of the defect to be discovered." In the context of AI systems whose harmful propensities emerge only after extensive deployment and exposure to real-world data — through a process of what engineers term "model drift" — the development risks defence has a potentially broad application, yet one that is deeply antithetical to the compensatory purposes of the product liability framework. A producer who deploys a machine-learning system knowing that its behaviour in novel situations cannot be predicted may invoke this defence to preclude liability for harms that were foreseeable in a general, probabilistic sense, if not in their specific manifestation. The EPRS analysis noted that the PLD "provides for compensation only for physical or material damage," further limiting its utility in cases where AI-caused harm manifests as economic loss, privacy violations, or discrimination — categories of harm that are neither personal injury nor damage to consumer property and thus fall entirely outside the directive's scope of application.^{[12, s. 3]}

The adoption of Directive (EU) 2024/2853, which replaced Directive 85/374/EEC with effect from its entry into force, represents a substantial modernisation of the product liability framework in response to precisely these deficiencies. The revised directive expressly extends the definition of "product" to include software, digital manufacturing files, and AI systems, whether or not they are embodied in a physical device, thereby resolving the longstanding uncertainty regarding the status of standalone software. The revised framework introduces a broadened concept of defect, encompassing cybersecurity vulnerabilities, failures arising from machine learning drift following initial deployment, and failures resulting from inadequate post-market surveillance and updating obligations. Of particular significance is the revised directive's treatment of the burden of proof: where a claimant establishes that the product does not comply with applicable EU or national product safety requirements, a rebuttable presumption of defectiveness is engaged, and the producer must then demonstrate that no such defect was present at the time the product was placed on the market. In complex technical cases where the claimant cannot reasonably be expected to access the evidence necessary to prove the defect, courts are empowered to order disclosure of relevant information held by the producer or operator. These innovations address several of the principal deficiencies of the original directive and represent a meaningful improvement in the position of victims of AI-caused harm within the product liability framework.

Nevertheless, important limitations remain. The revised PLD continues to identify the producer as the primary defendant, without establishing direct liability for downstream operators who deploy, configure, or maintain AI systems in ways that contribute to the harm. In an AI deployment chain of substantial complexity — involving a foundation model developer, a fine-tuning provider, a deploying enterprise, and an end user — the revised directive does not clearly allocate liability among these parties, and the victim remains dependent upon a chain of litigation that may be protracted and uncertain. Furthermore, the development risks defence is retained in the revised directive, subject only to a narrowing modification that removes its availability where the defect arises from a failure to issue post-market updates that the producer was required to provide. The adequacy of the revised PLD as a comprehensive response to AI-caused harm is therefore necessarily limited, and the analysis of the following subchapters demonstrates that the product liability framework must be understood as one element of a broader, multi-layered liability system rather than as a self-sufficient basis for redress.

2.2. Tort Liability and the Attribution of Fault in AI-Related Cases

Alongside the harmonised product liability regime, general tort law — administered according to the legal traditions of individual Member States but increasingly informed by the comparative frameworks of the Principles of European Tort Law and the Draft Common Frame of Reference — constitutes the principal mechanism by which fault-based liability claims for AI-caused harm are pursued in European courts. The fault-based liability model requires the claimant to establish three elements: the existence of a legally protected interest that has been violated; conduct by the defendant that falls below the standard expected of a reasonable person in the relevant circumstances; and a causal nexus between that breach of standard and the harm suffered. The EPRS briefing on the AI Liability Directive characterised this three-stage structure as the defining feature of fault-based claims, requiring proof of "damage, fault and causality."^{[12, s. 2]} Each of these elements presents distinct difficulties in the AI context, and the present subchapter subjects each to systematic analysis.

The threshold question of the duty of care — or its civil law equivalents, including the German concept of Verkehrspflichten and the French obligation générale de prudence — presents particular complexity where AI systems are deployed by commercial actors in ways that affect third parties with whom no contractual relationship exists. The orthodox approach in European tort law is to circumscribe the duty of care by reference to foreseeability: a defendant owes a duty to those who are reasonably foreseeable as potentially affected by the defendant's conduct. In the AI context, this criterion is satisfied with relative ease where the system's deployment in a given domain — diagnostic AI in healthcare, for instance — foreseeably affects a defined class of persons, namely patients. The more difficult question concerns the scope of the duty: does the duty owed by an AI developer to a patient harmed by a clinical decision support system extend beyond the product safety obligations imposed by the Medical Devices Regulation, and if so, what conduct standard does it prescribe? Courts in Germany and France have approached analogous questions in the context of complex technical systems by calibrating the standard of care to the degree of technical knowledge and organisational capacity possessed by the defendant, imposing heightened obligations of monitoring, updating, and risk assessment on sophisticated technological actors. Whether this approach can be transposed to AI developers and operators remains, however, a matter of live doctrinal uncertainty.

The attribution of fault in AI-related cases is complicated fundamentally by the phenomenon that legal scholars have termed the "responsibility gap" — the situation in which harm results from AI behaviour that was neither intended nor foreseen by any identifiable human actor. Bathaee's foundational analysis of this problem demonstrated that machine-learning algorithms, by operating through processes of pattern recognition in high-dimensional data spaces, arrive at outputs that their designers, trainers, and operators did not specify and may not be able to explain after the fact.^{[13, s. 891]} Where no human actor can be shown to have made a decision that was unreasonable in the circumstances, the fault-based liability model, as conventionally understood, provides no mechanism for holding any person responsible. This structural gap has prompted doctrinal responses of varying persuasiveness. The concept of negligent design focuses attention on the upstream decisions of the AI developer — the choice of training data, the architecture of the model, the pre-deployment testing protocol — and asks whether those decisions fell below the standard that a reasonable developer, exercising appropriate technical diligence, would have attained. The concept of negligent deployment focuses on the decision of the operator to deploy an AI system in a given context, and asks whether that decision was reasonable having regard to the known risks of the system, the vulnerability of the persons likely to be affected, and the availability of human oversight mechanisms. The concept of failure to update addresses the situation in which an AI system's performance degrades over time as a result of distributional shift between the training environment and the deployment environment, and the operator fails to retrain, recalibrate, or withdraw the system in response.

A further dimension of the fault attribution problem concerns vicarious liability and liability for auxiliaries. Under the civil law traditions of most EU Member States, an employer or principal is vicariously liable for the tortious acts of an employee or agent committed in the course of employment or within the scope of the agency relationship. The application of vicarious liability to AI systems is, however, doctrinally contested. An AI system is not an employee or agent in the traditional legal sense; it cannot be the bearer of a duty of care, and it cannot commit a tort. Courts and commentators have debated whether the operator of an AI system occupies an analogous position to that of an employer who deploys human agents, such that the autonomous decisions of the AI system can be attributed to the operator as if they were the acts of an auxiliary. The academic literature reviewed in the Stanford Technology Law Review analysis noted that "traditional concepts of human fault pose significant challenges in cases involving black-box AI," particularly where the harmful output of the system is the product of a learning process that neither the developer nor the operator controlled at the time of the harmful event.^{[14, s. 2]} The absence of a satisfactory doctrinal framework for attributing the consequences of AI autonomous action to human legal subjects constitutes one of the most fundamental gaps in the existing tort law framework, and it is a gap that interpretive creativity within existing categories can only partially bridge.

A final structural limitation of the fault-based tort model as applied to AI-caused harm is the practical evidentiary asymmetry between claimants and defendants in AI litigation. To establish breach of the standard of care, a claimant must demonstrate not only that the AI system produced a harmful output, but that the defendant's conduct in designing, deploying, or operating the system fell below the applicable standard. This requires access to technical documentation, training data inventories, model architecture specifications, internal risk assessments, and post-market surveillance records — all of which are in the exclusive possession of the defendant and are typically protected by trade secrecy claims. The injured claimant, who may be a patient harmed by a diagnostic algorithm, a consumer harmed by an automated credit decision, or a pedestrian injured by an autonomous vehicle, has no right of pre-trial disclosure of this material under most European procedural systems, and without it is structurally incapable of satisfying the evidentiary threshold for a successful fault-based claim. This asymmetry is one of the principal justifications for the legislative innovations proposed in the AI Liability Directive, which are examined in detail in Chapter 3.

2.3. Contractual Liability and the Allocation of Risk Between AI Developers, Deployers, and Users

The deployment of AI systems in commercial contexts generates a layered architecture of contractual relationships through which liability risk is allocated — or, in many cases, sought to be disclaimed — among the various actors in the AI value chain. At the apex of this chain stands the AI developer, who licenses the foundational model or system to a deploying enterprise through a licensing agreement that typically includes detailed provisions on permitted uses, prohibited applications, limitations of liability, and indemnification obligations. At the next tier, the deploying enterprise contracts with business users or consumers through service agreements, terms of service, and — in the consumer context — standard-form contracts governed by consumer protection legislation. Each tier of this contractual architecture creates obligations and allocates risks, but the cumulative effect of standard exclusion and limitation clauses is frequently to concentrate liability risk at the periphery of the value chain, away from the developer and deployer who are best placed to prevent harm and toward the end user who has least capacity to absorb it.

The legal validity of exclusion clauses in AI-related contracts is governed by a complex interplay of general contract law, consumer protection legislation, and sector-specific regulation. In the consumer context, Directive 93/13/EEC on unfair terms in consumer contracts — and the national implementing legislation of EU Member States — prohibits terms that, contrary to the requirement of good faith, cause a significant imbalance between the rights and obligations of the parties to the detriment of the consumer. The application of this test to AI-related exclusion clauses requires a case-by-case assessment of whether the specific limitation — for instance, a clause excluding liability for all outputs generated by an AI advisory system, or a clause restricting compensation to the value of subscription fees paid — produces an imbalance that is sufficiently significant to warrant invalidation under the unfair terms directive. The principle of in dubio contra proferentem, mandated by Article 5 of the directive, further constrains the interpretive latitude of the party that drafted the standard terms, requiring that ambiguous provisions be construed against the drafter. In the absence of empirical data on the judicial treatment of AI-specific exclusion clauses, it remains uncertain to what degree European courts would be prepared to invalidate standard terms in AI service contracts, but the doctrinal framework exists to support such intervention in cases of manifest imbalance.

The specific legal regime applicable to AI systems marketed as consumer-facing products or digital services is further structured by Directive 2019/770/EU on digital content and digital services and Directive 2019/771/EU on the sale of goods, which impose conformity requirements on traders supplying digital content and goods incorporating digital elements. Under Directive 2019/770/EU, digital content or a digital service does not conform to the contract if it lacks the functionality, compatibility, interoperability, and other performance characteristics that are ordinarily present in digital content or digital services of the same type. Where an AI system — such as a consumer-facing generative AI tool, a robo-advisory service, or an automated customer support system — fails to conform to these requirements, the consumer is entitled to remedies including repair, replacement, price reduction, and contract termination, without prejudice to any liability claim for damages. The interaction between the conformity remedy regime and the general tort liability framework is not yet fully worked out in case law, and the extent to which a consumer who suffers harm from non-conforming AI content may invoke both systems of redress simultaneously remains a matter of academic and judicial uncertainty.

In commercial-to-commercial relationships, freedom of contract permits greater latitude in the allocation of liability risk, subject to the constraints of mandatory rules of tort law, product liability, and sector-specific regulation. The practice of allocating AI liability risk through contractual instruments has evolved rapidly in recent years, with AI developers and deployers increasingly deploying sophisticated contractual architectures including algorithmic audit rights, model cards specifying the intended use cases and known limitations of AI systems, incident reporting obligations, and representations as to system performance validated against defined benchmarks. The emergence of these contractual practices represents a form of private ordering that supplements the public regulatory framework and may, in principle, allocate liability more precisely and efficiently than general tort rules. However, the effectiveness of such contractual instruments as mechanisms of victim protection is subject to a fundamental structural limitation: privity of contract confines the contractual relationship to its parties, and the ultimate victim of AI-caused harm — the patient, the consumer, the pedestrian — typically has no contractual relationship with the AI developer and cannot rely upon the developer's contractual obligations toward the deploying enterprise as a basis for a direct claim. This "privity gap" is one of the defining structural deficiencies of the contractual liability model in the AI context, and it underscores the indispensable complementary role of extracontractual liability rules as the primary mechanism of redress for third-party victims of AI-caused harm.

2.4. The Causal Link Problem: Establishing Causation in AI Liability Claims

Of the multiple doctrinal challenges presented by the application of existing civil liability law to AI-caused harm, none is more fundamental than the problem of establishing a legally sufficient causal nexus between the operation of an AI system and the damage suffered by the claimant. Causation is, as Wagner observes, "the bedrock element of tort law," common to virtually every cause of action in both fault-based and strict liability regimes: without proof of causation, there is no tort and no liability.^[15] In the context of strict liability regimes, where the fault element is dispensed with, the importance of causation is correspondingly greater, because the finding of a causal link between the risk created by the defendant and the damage suffered carries much of the burden of attribution that in fault-based liability is shared between the breach and causation elements. The centrality of causation to any civil liability claim makes the distinctive difficulties that AI systems pose to causal analysis a systemic challenge to the adequacy of the existing liability framework, rather than merely a peripheral technical complication.

The doctrinal foundations of causation in European civil liability law are structured around the but-for test — also designated the conditio sine qua non test in the Germanic legal tradition — which classifies as a cause of the claimant's harm any condition in whose absence the harm would not have occurred. This test provides a workable framework for the analysis of causation in cases involving a discrete human act or omission and a discrete harmful consequence, but it encounters severe difficulties when applied to the distributed, probabilistic, and opaque decision processes of AI systems. Wagner's analysis identifies the fundamental problem: causation, as understood in law, is backward-looking — the court asks, ex post, whether the defendant's conduct actually caused the harm in question, in the specific situation before it — whereas AI systems operate through processes of correlation and pattern recognition that are, in their essential nature, forward-looking and probabilistic.^[15] The internal reasoning of a deep neural network does not proceed through a linear chain of causes and effects that a human observer can trace and evaluate; rather, it involves the simultaneous weighted activation of millions or billions of parameters, producing an output that is the product of a process that is, in practice, incomprehensible to any human analyst, including the engineers who designed the system.

The black-box problem, analysed in depth by Bathaee, means that even where a harmful AI output can be identified — an incorrect medical diagnosis, an erroneous credit refusal, a trajectory planning error by an autonomous vehicle — it is in many cases technically impossible to reconstruct the reasoning process by which the system arrived at that output, and consequently impossible to establish whether any identifiable defect, design flaw, or operational failure caused the harmful output rather than some other characteristic of the input data or the deployment environment.^{[13, s. 892]} The EPRS briefing confirms that the "specific characteristics of AI (e.g. opacity/lack of transparency, explainability, autonomous behaviour, continuous adaptation, limited predictability) make it particularly difficult to meet the burden of proof for a successful claim," noting that victims are confronted with the burden of proving "the existence of damage, a fault of the liable person, and a causality between that fault and the damage," while AI systems render these facts "excessively difficult or even impossible" to establish.^{[12, s. 3]}

Doctrinal responses to the causation problem in AI liability have proceeded along several lines. The doctrine of res ipsa loquitur, developed in common law jurisdictions to permit an inference of negligence from the fact of an accident in circumstances ordinarily indicative of negligent management, has been invoked as a potential mechanism for addressing the evidential deficit of AI claimants: where an AI system causes harm in circumstances that are, on the balance of probabilities, indicative of a defect in design, training, or deployment, the fact of the harm may itself be treated as evidence from which a court can infer that some defect was present, without requiring the claimant to identify its nature with precision. The doctrine of proportional liability, as developed in the context of multi-causal environmental harm, offers a further potential mechanism: where the harm results from the combination of AI-generated and human decisions, and it is impossible to disaggregate their respective causal contributions, each causal factor may be attributed a proportionate share of responsibility, enabling recovery in respect of the AI's contribution even where it cannot be shown to be the dominant cause. Neither of these doctrinal responses is, however, fully satisfactory: the res ipsa loquitur approach depends upon judicial willingness to treat the mere occurrence of AI-caused harm as evidence of defect, which may be difficult to justify in cases where AI systems predictably produce harmful outputs at low but non-negligible frequencies as an intrinsic feature of their operation; and proportional liability presupposes a capacity to attribute shares of causal responsibility that may be no more achievable than full causal attribution in cases of opaque AI decision-making.

The legislative response to the causation problem in the revised Product Liability Directive and in the proposed AI Liability Directive addresses the evidentiary asymmetry by modifying the burden of proof and introducing rebuttable presumptions. Under the revised PLD, where the claimant establishes non-compliance with applicable safety requirements, a presumption of defectiveness is engaged; and where it is demonstrated that the technical complexity of the case makes it excessively difficult for the claimant to prove the causal link, the court may relax the standard of proof. The proposed AI Liability Directive goes further, establishing a rebuttable presumption of a causal link between a proven breach of duty of care and the AI system's output, where the claimant demonstrates that the breach is plausibly linked to the harm. The EPRS briefing characterised this presumption as one of the "new rules specific to damages caused by AI systems" intended to "ease the burden of proof for victims to establish damage caused by an AI system."^{[12, s. 1]} Whether these legislative innovations constitute a sufficient remedy for the structural causal deficit of AI liability claims, or whether the remaining difficulties — in particular, the problem of identifying the responsible actor and the relevant duty of care — render the presumptions of limited practical utility, is examined in the de lege ferenda analysis of Chapter 3. The following table summarises the principal causation doctrines and their applicability to AI liability claims:

Causation Doctrine	Description	Applicability to AI Harm	Limitations in AI Context
But-for test (conditio sine qua non)	Causal condition is any factor in whose absence the harm would not have occurred	Formally applicable; foundational test in European civil law	Cannot be applied where AI reasoning is opaque and counterfactual analysis is technically infeasible
NESS test	A cause is any necessary element of a sufficient set of conditions for the harm	Potentially more flexible in multi-causal AI cases	Requires identification of the relevant sufficient set, which is impossible where AI decision process is a black box
Adequate causation (adäquate Kausalität)	Restricts causal attribution to consequences that are, in general, typical outcomes of the relevant conduct	Relevant to limiting liability for remote AI-caused consequences	Normative element may obscure rather than resolve evidential difficulties
Res ipsa loquitur	Inference of negligence from the fact of harm in circumstances ordinarily indicative of negligent management	May reduce evidential burden for claimants where AI harm is of a type ordinarily caused by defective operation	Requires judicial characterisation of "ordinary" AI operation, which is itself uncertain
Proportional liability	Attributes shares of liability proportionate to each causal factor's contribution	May address multi-causal AI harm where human and algorithmic contributions cannot be disaggregated	Proportional attribution requires a quantitative assessment of AI causal contribution that is frequently impossible
Legislative presumptions (revised PLD; AILD proposal)	Rebuttable presumption of defect or causal link in specified circumstances	Directly targeted at AI evidential asymmetry; most practically significant response	Presumptions predicated on prior proof of non-compliance or duty of care breach, which may be equally difficult to establish

The causation problem thus emerges as the single most consequential structural deficiency of the existing civil liability framework as applied to AI-caused harm. It operates across all three avenues of liability — fault-based tort, strict product liability, and contractual claims — and it constitutes a systemic barrier to effective victim compensation that cannot be resolved by interpretive creativity within existing doctrinal categories. The de lege ferenda proposals examined in Chapter 3 address this problem directly, and their evaluation must be conducted against the standard set by the analysis of the present subchapter: does the proposed legislative intervention genuinely remedy the causal deficit, or does it merely displace the evidentiary difficulty to an earlier stage of the analytical sequence?

2.5. Sectoral Liability Rules: Autonomous Vehicles, Medical AI, and Financial Algorithms

The preceding analysis of the general civil liability frameworks applicable to AI-caused harm must be complemented by an examination of the sector-specific liability regimes that have developed in response to the deployment of AI in three domains of particular societal significance: autonomous vehicles, medical AI systems, and financial algorithms. Each of these domains is characterised by a distinct regulatory architecture, a specific harm profile, and particular features that condition the adequacy of both general and sector-specific liability rules. A comparative survey of these three sectors illuminates the recurrent structural deficiencies of the existing liability framework and identifies the patterns of regulatory failure that provide the principal justification for horizontal legislative reform at the European level.

In the domain of autonomous vehicles, the deployment of AI-driven systems for vehicle control — ranging from driver assistance functions at SAE Level 1 to fully automated driving at SAE Level 5 — has prompted significant adaptation of the traditional motor liability framework. The traditional structure of motor vehicle liability in European legal systems rests upon the assumption that a human driver bears primary responsibility for the conduct of the vehicle: compulsory third-party liability insurance is designed to ensure that victims of road accidents caused by human negligence or strict custodial liability obtain compensation from an identifiable and solvent source. The introduction of automated driving systems introduces a tripartite liability problem: the vehicle operator, the vehicle manufacturer, and the automated driving system itself each make contributions to the vehicle's conduct, and in cases where the automated system assumes control, the traditional attribution of liability to the driver is doctrinally problematic. The German Straßenverkehrsgesetz amendments of 2017 and 2021 attempted to address this problem by introducing specific rules applicable to vehicles equipped with SAE Level 3 and Level 4 automated driving systems, allocating liability to the vehicle manufacturer for damage caused during periods of automated operation, while imposing obligations on the driver to remain attentive and to resume control upon system demand. EU Regulation 2019/2144 on type-approval requirements for motor vehicles with respect to their general safety further structures the framework by specifying the performance and safety requirements that automated driving systems must meet as a condition of market access. The interaction between these regimes and the revised Product Liability Directive creates a layered framework in which the manufacturer may be liable both under the product liability regime — for a defect in the automated system — and under the adapted motor liability rules — for operation of the automated system during an incident. The adequacy of compulsory motor insurance as the primary compensation mechanism is, however, called into question by the typically high quantum of harm in serious autonomous vehicle accidents and the potential for systemic failures affecting large numbers of vehicles simultaneously.

The medical AI domain presents a distinctive liability profile arising from the combination of product liability, professional medical liability, and the specific regulatory framework of the Medical Devices Regulation, Regulation (EU) 2017/745. AI systems used in clinical settings — including radiology AI for image analysis, pathology AI for histological assessment, clinical decision support systems for diagnosis or treatment recommendation, and surgical robots for procedural guidance — are classified as medical devices under Regulation (EU) 2017/745 and subject to conformity assessment requirements that vary according to their risk classification. A systematic review of medical liability literature on diagnostic AI algorithms, conducted at the University of Padua and published in Frontiers in Medicine, concluded that the regulatory framework on medical liability in the context of AI is "inadequate and requires urgent intervention," noting that "there is no single and specific regulation governing the liability of various parties involved in the AI supply chain, nor on end-users."^[17] The review identified the principal categories of potential liability — medical malpractice on the part of the treating physician, product liability on the part of the medical device manufacturer, and vicarious liability of the healthcare institution — and observed that these categories may apply concurrently, creating complex questions of contribution and indemnification among multiple defendants.^[17]

The specific challenges of medical AI liability have been analysed in depth from both United States and European Union perspectives by Duffourc and Gerke, whose comparative study identified four structural challenges common to both jurisdictions: the inadequacy of a broad approach to AI liability that fails to address the specific features of black-box AI in healthcare; the difficulties posed by traditional concepts of human fault where the harmful output is generated autonomously; the need to adapt product liability frameworks to address the unique features of black-box AI; and the inadequacy of existing evidentiary rules to address the difficulties that claimants face in cases involving medical injuries caused by black-box AI systems.^{[14, s. 2]} These challenges are accentuated by the counterfactual problem inherent in medical AI cases: to establish that an AI diagnostic error caused harm to a patient, the claimant must demonstrate not only that the AI system produced an incorrect output, but that a correct output would, on the balance of probabilities, have led to clinical intervention that would have prevented the harm. This counterfactual inquiry — what a competent human clinician would have done with the correct information — is inherently speculative and may be irreducibly uncertain where the clinical evidence is equivocal. The literature reviewed by Cestonaro and colleagues noted that the introduction of AI into clinical settings "introduced a revolution in the doctor-patient relationship resulting in multiple possible medico-legal consequences," and that AI error interacts with the established doctrines of medical malpractice and informed consent in ways that existing case law has only begun to address.^[17]

A further dimension of medical AI liability concerns the allocation of responsibility between the AI developer, the healthcare institution deploying the system, and the individual clinician who acts in reliance upon the AI output. Academic literature reviewed in the Frontiers in Medicine systematic review identified several competing theories of liability applicable in this context, including: medical professional liability of the treating physician under standard negligence principles, where the physician fails to exercise appropriate critical judgment in evaluating AI outputs; product liability or strict liability of the AI developer for defects in the design, training data, or performance of the AI system; and vicarious liability of the healthcare system for the negligence of its employees and the failings of its AI tools.^[17] Eldakak and colleagues, in their comparative analysis of civil liability for autonomous AI in healthcare, argued that the application of strict liability doctrine to AI-enabled medical devices may deter healthcare providers from adopting beneficial technologies, while acknowledging that negligence-based liability faces severe doctrinal difficulties where the AI system operates autonomously beyond the effective supervisory capacity of any human actor.^[16] The same authors proposed that future regulation should distinguish between robots according to their degree of autonomy, with liability rules calibrated to whether the harmful action was performed by an unattended autonomous system or by a supervised automated system responding to human input.^[16] This distinction between autonomous and supervised AI liability — a distinction with significant implications for the allocation of responsibility among developers, operators, and users — recurs as a central structural question in the de lege ferenda analysis of Chapter 3.

In the domain of financial algorithms, the deployment of AI in algorithmic trading, automated credit scoring, robo-advisory services, and anti-money-laundering compliance generates liability questions that are structured by the sectoral regulatory framework of the Markets in Financial Instruments Directive II (MiFID II), the Consumer Credit Directive, and the General Data Protection Regulation's provisions on automated decision-making. Under MiFID II, investment firms are subject to organisational requirements including algorithmic trading controls, pre-trade risk management systems, and obligation to monitor the operation of their algorithms. Liability for algorithmic trading errors that cause losses to clients or market disruption falls primarily within the contractual framework of the client agreement, subject to the unfair terms controls of consumer protection legislation in retail investor cases. Automated credit scoring and robo-advisory services engage the GDPR's Article 22 right not to be subject to solely automated decisions producing significant effects, which creates a directly effective individual right that is enforceable through the regulatory and civil litigation channels of the Member States. The fragmented and sector-specific character of financial algorithm regulation means that victims of AI-caused financial harm face a complex jurisdictional and substantive law landscape, navigating among regulatory enforcement, contractual remedies, and general tort law without access to a unified liability framework.

The survey of sectoral liability regimes conducted in the present subchapter reveals a consistent pattern of regulatory architecture: each sector has developed specific rules that address the most salient AI-related risks within its domain, but none provides a comprehensive and effective mechanism for compensating all categories of AI-caused harm. Compensation ceilings in motor liability insurance may be inadequate for catastrophic autonomous vehicle accidents; the tripartite liability structure in medical AI leaves victims navigating complex multi-defendant litigation; and the financial sector framework provides regulatory enforcement without guaranteeing individual compensation for diffuse algorithmic harms. The recurring structural deficiencies — fragmented coverage, inadequate compensation ceilings, limited access to evidence, and the absence of effective redress for diffuse or systemic harm — point toward the necessity of a horizontal, cross-sectoral liability framework as the primary object of de lege ferenda analysis. The identification of these deficiencies, and the demonstration that they are not susceptible of correction through interpretive adaptation or sectoral amendment alone, constitutes the principal contribution of the de lege lata analysis undertaken in the present chapter. The following chapter turns to the examination of the reform proposals that have been advanced at the European level in response to the structural inadequacies documented here, assessing their potential effectiveness as mechanisms of victim protection and their coherence with the broader regulatory framework of European AI governance.

Chapter 3: De Lege Ferenda Analysis – Proposals for Reform and Future Regulatory Directions

3.1. The European Commission's AI Liability Directive Proposal: Structure, Scope, and Critique

The European Commission's Proposal for a Directive on adapting non-contractual civil liability rules to artificial intelligence, published on 28 September 2022 as COM(2022) 496 final, represented the most significant legislative intervention in the field of AI liability undertaken at the European Union level to that date. The proposal was designed to complement the revised Product Liability Directive, published simultaneously, and to interact with the framework established by the EU Artificial Intelligence Act, then under negotiation. Together, these three instruments were conceived as constituting the final regulatory cornerstone of the Union's AI governance architecture: the AI Act would establish substantive obligations governing the development and deployment of AI systems, while the liability directives would provide affected persons with individual rights of redress where those obligations were breached and harm resulted. As the European Parliament Research Service noted in its legislative briefing, the new rules were intended to ensure that persons harmed by AI systems enjoy the same level of protection as persons harmed by other technologies in the Union.^{[20, s. 1]} The structural relationship between these instruments was, however, one of mutual dependence rather than complementarity: the AI Act contained no provisions conferring individual rights upon affected persons, while the liability proposals themselves lacked substantive rules governing AI development and deployment, rendering effective enforcement contingent upon the parallel operation of both regulatory layers.

The legislative architecture of the AI Liability Directive Proposal rested upon two principal mechanisms, each addressed to a specific aspect of the informational asymmetry that constitutes the primary obstacle to successful liability claims in AI cases. The first mechanism, established in Article 3 of the proposal, conferred upon national courts the power to order the disclosure of evidence concerning high-risk AI systems where a claimant had demonstrated a plausible basis for alleging that an AI system had caused harm. This disclosure obligation was explicitly modelled upon the recognition that the opacity of AI decision-making processes created a structural barrier to the adduction of evidence by claimants who lacked access to the technical information necessary to establish fault or causal nexus. The proportionality threshold applied to disclosure orders required that courts balance the legitimate interest of claimants in obtaining relevant evidence against the confidentiality interests of defendants, including trade secret protections operative under Directive 2016/943/EU. The second and more conceptually significant mechanism, established in Article 4, introduced a rebuttable presumption of causal link between the non-compliance of an AI system or its operator with a duty of care established by the AI Act and the harm suffered by the claimant. The conditions for activation of this presumption were threefold: the existence of a relevant non-compliance with an AI Act duty, the demonstration by the claimant that the non-compliance was reasonably likely to have given rise to the harm, and the establishment of a causal nexus between the non-compliant conduct and the output or failure to produce an output that resulted in the harm.^{[20, s. 1]}

The rebuttable presumption of causal link, characterised in academic literature as the proposal's central innovation, was subjected to detailed scholarly critique that illuminated both its conceptual ambiguity and its practical limitations as a victim-protection mechanism. Professor Philipp Hacker, in a widely cited working paper analysing the Commission proposals, concluded that the AILD, if enacted as foreseen, would primarily rest on disclosure of evidence mechanisms and a set of narrowly defined presumptions concerning fault and causality, characterising the overall approach as "half-hearted" and ultimately insufficient to address the structural challenges of AI liability.^[18] The narrowness of the presumption's scope was identified as a primary weakness: the presumption operated only in respect of high-risk AI systems as classified under the AI Act, leaving the substantial category of non-high-risk systems — including many general-purpose AI systems capable of causing significant harm — subject to the unassisted burden of proof that the general tort law framework imposed upon claimants. The dependence of the presumption upon prior AI Act enforcement created a further structural vulnerability: the activation of the causal presumption required the claimant to establish a non-compliance with an AI Act duty, thereby making the effectiveness of the civil liability regime contingent upon the administrative enforcement apparatus of the AI Act, which was itself subject to institutional resource constraints and the procedural delays inherent in regulatory proceedings.

The Future of Life Institute, in its executive summary of the AILD position paper published in November 2023, identified three shortcomings that, in its assessment, rendered the proposal insufficient as an effective AI liability framework.^[21] First, the proposal was found to underestimate the black box phenomena of AI systems and, therefore, the difficulties for claimants — and sometimes defendants — to understand and obtain relevant and explainable evidence of the logic involved in self-learning AI systems. This deficiency was identified as particularly acute in respect of advanced general-purpose AI systems, whose opacity challenged the basic goal of legal evidence, which is to provide accurate knowledge that is both fact-dependent and rationally construed. Second, the proposal failed to make a distinction between the requirements for evidential disclosure needed in cases involving general-purpose AI systems as opposed to other AI systems, despite the materially different epistemic challenges posed by each category. Third, the proposal did not adequately acknowledge the distinct characteristics and potential for systemic risks and immaterial harms stemming from certain AI systems, particularly those capable of affecting large populations simultaneously through algorithmic decisions operating at scale.^[21]

The political economy of the proposal's withdrawal in February 2025 reflected a constellation of competing interests and divergent Member State positions that proved irreconcilable within the legislative cycle. Stakeholder opposition to the proposal had been substantial from its inception: developer and technology industry interests expressed concern that the disclosure obligation and causal presumption would generate regulatory uncertainty and impose disproportionate evidentiary burdens upon economic operators, while victim rights organisations and consumer protection bodies argued that the proposal did not go far enough in addressing the structural asymmetries between AI operators and affected persons. Divergent national positions on the appropriate liability model — with some Member States favouring strict liability for high-risk AI systems as advocated in the European Parliament's October 2020 resolution, and others resisting any departure from the fault-based framework on grounds of innovation policy — prevented consensus in the Council. The withdrawal of the AILD without a replacement instrument created a regulatory lacuna that left the development of AI liability law to national courts and legislatures, with the attendant risk of fragmentation that the proposal had been intended to prevent. As the EPRS legislative briefing had warned at the proposal stage, different liability regimes and burden of proof rules could be applied to the same kind of AI product or service deployed in several Member States, despite causing the same kind of damage, a consequence that the AILD's minimum harmonisation approach had sought to forestall.^{[20, s. 3]}

An assessment of the AILD against the benchmarks of access to justice, evidentiary fairness, and deterrence yields a qualified evaluation. The disclosure mechanism represented a meaningful procedural innovation that acknowledged, for the first time at the EU legislative level, the informational asymmetry inherent in AI liability claims; its value as a model for successor instruments should accordingly be preserved. The causal presumption, while limited in scope, established the doctrinal precedent that the burden-shifting function of presumptions is both conceptually appropriate and politically achievable in the AI liability context, a precedent upon which more ambitious successor proposals may build. The deterrence function of the proposal was, however, structurally undermined by the narrowness of its scope and its dependence upon AI Act enforcement, features that limited its capacity to alter the incentive structures of AI operators deploying systems at the margins of the high-risk classification. Any successor legislative instrument that seeks to address the deficiencies documented here will need to extend the causal presumption beyond the high-risk category, decouple the liability mechanism from the administrative enforcement of the AI Act, and address the specific evidentiary challenges posed by autonomous and self-learning AI systems operating post-deployment.

3.2. The Strict Liability Model for High-Risk AI: Justifications and Objections

The European Parliament's Resolution of 20 October 2020 on a civil liability regime for artificial intelligence constituted the most authoritative legislative endorsement of strict liability for high-risk autonomous AI systems at the EU level. The resolution recommended a common strict liability regime under which operators of high-risk AI systems would be held liable when such systems cause harm or damage to the life, health, or physical integrity of a natural person, to the property of a natural or legal person, or cause significant immaterial harm resulting in a verifiable economic loss, without the need for the claimant to establish fault on the part of the operator.^{[20, s. 4]} The Parliament's subsequent resolution of 3 May 2022 reaffirmed this position, stressing that high-risk AI systems should fall under strict liability laws combined with mandatory insurance cover, while other AI-driven activities causing harm or damage should remain subject to fault-based liability. The normative basis for this differentiation between strict liability for high-risk systems and fault-based liability for other AI applications reflects a principled recognition that the level of risk imposed upon third parties by different categories of AI deployment warrants correspondingly differentiated liability regimes.

The economic justification for strict liability in the context of high-risk AI systems proceeds from first principles that are well established in the law and economics literature. The least-cost-avoider rationale, associated with the foundational work of Guido Calabresi, identifies the party best positioned to avoid harm at minimum cost as the appropriate bearer of liability; in the AI context, this is typically the operator who selects, deploys, and commercially exploits the AI system, rather than the third-party victim who lacks any control over the system's design, training, or operational parameters. The activity-level deterrence thesis supplements this analysis by observing that fault-based regimes, which attach liability only to non-compliant conduct, leave the level of hazardous activity itself undeterred: an operator who has taken all reasonable precautions incurs no liability under a negligence standard, even if the aggregate risk generated by its deployment of a high-risk AI system exceeds the level that is socially optimal. Strict liability, by contrast, internalises the full social cost of the activity, including the residual risk that materialises despite compliance with all applicable standards, thereby incentivising operators to calibrate the level of AI deployment to its true social cost rather than merely its private cost after risk mitigation.^[18] This activity-level argument is accorded particular force in the AI context because of the systematic mismatch between the economic benefits that accrue to developers and operators of AI systems — commercial revenue, productivity gains, competitive advantage — and the externalities borne by third parties who receive none of these benefits while absorbing a disproportionate share of the risks generated by the technology.

The analogy to existing strict liability regimes in European law provides both normative support and practical precedent for the extension of no-fault liability to high-risk AI operators. Council Directive 85/374/EEC on product liability establishes strict liability for producers of defective products without requiring proof of fault, on the basis that the producer is the party who introduces the product into commerce, derives economic benefit from its circulation, and is best positioned to bear and distribute the costs of product-related harm through pricing and insurance mechanisms. The Environmental Liability Directive, Directive 2004/35/EC, similarly establishes strict liability for operators whose activities pose significant environmental risks, on the basis that the economic operator generating hazardous activity should bear the costs of the environmental damage it causes. National provisions governing nuclear installations and motor vehicles in the Member States reflect the longstanding legislative judgment that activities characterised by abnormally dangerous risk profiles — where harm may materialise despite all reasonable precautions, and where the potential harm to third parties may be catastrophic and irreversible — warrant the imposition of no-fault liability as a mechanism for ensuring adequate victim compensation and appropriate risk internalisation. The question that must be addressed in the AI context is whether the risk profile of high-risk AI systems satisfies the threshold historically required to justify strict liability: abnormal danger, non-reciprocal imposition of risk upon third parties, and the systematic inadequacy of fault-based regimes as mechanisms of deterrence and compensation.^[18]

The objection most frequently advanced against the strict liability model for AI — the innovation-chilling hypothesis — holds that the imposition of no-fault liability will deter investment in AI development and deployment, thereby reducing the social benefits of technological innovation in domains such as healthcare, transport, and finance. This objection merits careful evaluation rather than dismissal. Empirical evidence from the pharmaceutical and nuclear sectors, however, provides limited support for the proposition that strict liability has systematically suppressed beneficial innovation in industries subject to it: pharmaceutical companies continue to develop and market new therapies notwithstanding product liability exposure, and nuclear energy continues to operate across numerous jurisdictions under strict liability regimes established by the Vienna and Paris Conventions. The relevant question is not whether strict liability imposes costs upon AI operators — it manifestly does — but whether those costs are disproportionate to the social benefits of appropriate risk internalisation and victim protection. Where liability caps and mandatory insurance are combined with strict liability in a coherent regulatory framework, the deterrence effect is channelled toward excessive risk-taking and insufficient precaution rather than toward beneficial innovation per se.

A further objection to the strict liability model for high-risk AI concerns the definitional instability of the "high-risk" category as established by the EU AI Act. Annex III of the AI Act identifies specific use cases classified as high-risk — including AI systems used in critical infrastructure management, education, employment, access to essential services, law enforcement, migration management, and the administration of justice — but the classification criteria are subject to ongoing revision and have been criticised for both over-inclusiveness and under-inclusiveness.^[18] Professor Hacker's analysis demonstrated that the current high-risk classification under-includes certain high-risk use cases, such as certain applications of general-purpose AI systems in sensitive contexts, while over-including others, such as certain routine classification systems that present minimal actual risk of harm. The implication for a strict liability regime calibrated to the AI Act's risk classification schema is that the scope of strict liability would be subject to the same definitional instabilities, creating potential for regulatory arbitrage by operators who structure their AI deployments to fall outside the high-risk category while engaging in activities that generate equivalent or greater risks to third parties.

The risk of regulatory arbitrage through jurisdictional relocation — the prospect that strict liability obligations applicable in the EU might incentivise AI developers and operators to incorporate in third jurisdictions and serve the European market on a cross-border basis — constitutes a genuine concern that requires structural address rather than dismissal. The Brussels Effect, however, provides a countervailing mechanism: the scale of the European market and the extraterritorial reach of EU regulatory standards have historically generated significant compliance pressure on non-EU market participants, as demonstrated by the global uptake of GDPR standards and the anticipatory compliance with AI Act requirements by international technology companies. A strict liability regime that is coherently integrated with market access conditions — requiring, for example, that all AI systems offered on the EU market be covered by compulsory liability insurance or equivalent financial guarantees, regardless of the operator's place of incorporation — could substantially mitigate the arbitrage risk by making EU market access contingent upon assumption of the liability obligations that the regulatory framework establishes.

3.3. Compensation Funds and Compulsory Insurance as Supplementary Mechanisms

The theoretical case for collective compensation mechanisms in the AI liability context arises from structural features of AI harm that individual tort litigation cannot adequately address. Where the tortfeasor is unidentifiable — as may occur where harm results from an AI system that has been substantially modified post-deployment or that operates through a chain of developers, operators, and deployers whose respective contributions to the harmful output cannot be individually attributed — the victim is deprived of a cognisable defendant against whom a liability claim may be brought. Where the tortfeasor is identifiable but insolvent, as may occur with small AI developers or start-up operators lacking the financial resources to satisfy a substantial liability judgment, the procedural success of the claim is rendered nugatory by the inability to enforce the resulting award. Where the tortfeasor operates under a contractually or legislatively established liability cap that limits its exposure below the full quantum of the harm suffered, the victim bears the residual loss without legal recourse. In each of these scenarios, victim-centred policy objectives require recourse to pooled indemnification structures that distribute the costs of AI harm across the relevant economic community rather than concentrating them upon individual victims who lack any control over the risk that materialised.^[19]

Three existing analogical regimes in European and international law offer structural models for the design of collective AI compensation mechanisms. The nuclear damage compensation regime, established at the international level by the Vienna Convention on Civil Liability for Nuclear Damage and implemented at the national level through instruments such as the German Atomgesetz, combines strict and exclusive liability of the nuclear installation operator with a tiered compensation structure that draws upon operator insurance, supplementary state funding, and — in the most recent revision of the Vienna Convention — international pooled compensation. The pharmaceutical no-fault compensation schemes operative in Scandinavian jurisdictions — most notably the Swedish and Finnish pharmaceutical insurance systems — provide automatic compensation for medicinal product injuries without requiring proof of fault or defect, financed through mandatory contributions from pharmaceutical manufacturers and distributed through a collective administrative mechanism. The motor vehicle guarantee funds established under Directive 2009/103/EC on insurance against civil liability in respect of the use of motor vehicles provide a backstop compensation mechanism for victims of accidents caused by uninsured or unidentified vehicles, financed through levies on the compulsory motor insurance industry. Each of these regimes demonstrates that collective compensation is technically feasible, financially sustainable, and administratively manageable within a structured regulatory framework.

The transferability of these structural features to the AI liability context requires analysis of both the commonalities and the differences between the analogical regimes and the specific characteristics of AI harm. The following table presents a comparative assessment of the three analogical regimes against the principal structural dimensions relevant to AI compensation design:

Regime	Liability Basis	Funding Mechanism	Damage Categories	Governance	AI Transferability
Nuclear (Vienna Convention / Atomgesetz)	Strict and exclusive operator liability	Operator insurance + state supplementary fund + international pool	Personal injury, property damage, environmental harm, economic loss	Designated competent authority with judicial oversight	High — tiered structure and exclusive channelling directly applicable to high-risk AI operators
Pharmaceutical (Scandinavian no-fault schemes)	No-fault strict liability	Mandatory manufacturer contributions to pooled fund	Personal injury from medicinal products	Collective administrative body with appeal to ordinary courts	Medium — scope limited to personal injury; governance model transferable
Motor Vehicle Guarantee Fund (Dir. 2009/103/EC)	Backstop for uninsured/unidentified tortfeasors	Levy on compulsory insurance industry	Personal injury and property damage	National guarantee body designated by Member State	Medium-high — backstop function directly relevant to unidentifiable AI liability chains

The proposal for a mandatory AI operators' compensation fund, canvassed in the European Parliament's 2020 resolution and developed in academic literature, envisages a sector-specific collective mechanism through which AI operators contribute to a pooled fund from which victims may claim compensation where individual liability mechanisms prove insufficient. The contribution base for such a fund may be structured on the basis of operator revenue derived from AI system deployment, the risk classification of the AI systems operated, or the operator's claims history under the liability framework — each approach offering different incentive structures and distributional consequences. A revenue-based contribution reflects the principle that those who derive commercial benefit from AI deployment should bear a commensurate share of its social costs; a risk-classification-based contribution preserves incentives for operators to deploy AI systems at lower risk categories; a claims-history-based contribution resembles the experience-rating mechanisms employed in motor insurance and generates the strongest individual deterrence effect, but requires a sufficiently developed claims history to be actuarially meaningful, a condition that may not be satisfied at the inception of the fund regime. The damage categories eligible for fund compensation should encompass personal injury and serious property damage as a minimum, with provision for significant non-material harm — such as discriminatory algorithmic decisions causing verifiable economic loss — as a medium-term extension once administrative capacity and actuarial data permit.^[21]

Compulsory liability insurance for AI operators, modelled upon the mandatory motor insurance framework, represents the most readily implementable mechanism for ensuring that AI liability obligations are backed by financial capacity adequate to satisfy legitimate claims. The Motor Insurance Directive framework demonstrates that a mandatory insurance obligation can be effectively administered at the EU level through a combination of legislative minimum requirements, national supervisory oversight, and cross-border recognition mechanisms. The emerging practice of AI-specific insurance products in the Lloyd's and continental European markets indicates that the insurance industry has begun to develop the underwriting capacity and actuarial frameworks necessary for AI liability coverage, though the market remains nascent and product standardisation is limited. The principal feasibility constraints on mandatory AI liability insurance — the absence of robust actuarial data on AI loss frequencies and severities, the difficulty of underwriting emergent and self-learning AI risks whose future behaviour is uncertain, and the potential for moral hazard among insured operators who may reduce precautionary investment in reliance upon insurance coverage — are real but not insurmountable. They suggest that the mandatory insurance obligation should initially be confined to high-risk AI operators with established track records, with gradual extension to lower-risk categories as actuarial data accumulates and market capacity develops.

3.4. The Role of Transparency, Explainability, and Algorithmic Auditing in Facilitating Liability Claims

The transparency and explainability obligations established by the EU AI Act, Regulation (EU) 2024/1689, constitute the most significant regulatory intervention to date in addressing the structural informational asymmetry that impedes effective civil liability enforcement in AI cases. The Act's transparency obligations are stratified according to the risk classification of the AI system: providers of high-risk AI systems are required under Article 13 to design and develop those systems in such a way as to ensure that their operation is sufficiently transparent to enable deployers to understand and use the system appropriately, while Article 50 imposes transparency obligations upon deployers of AI systems that interact with natural persons, requiring disclosure of the AI character of the interaction. Annex IV of the Act specifies the technical documentation that providers of high-risk AI systems must maintain, encompassing a general description of the system, detailed information about its design and development, information about the monitoring, functioning, and control of the system, and a description of the foreseeable risks of the system and risk management measures applied. These documentation requirements, individually and in combination, generate a body of technical evidence that is potentially mobilisable by claimants in civil liability proceedings.^{[20, s. 2]}

The evidentiary utility of AI Act compliance documentation for civil liability claimants operates through several channels that deserve systematic analysis. Technical documentation maintained pursuant to Annex IV may be obtained by claimants through disclosure orders of the kind contemplated in the AILD proposal, providing access to design specifications, training data descriptions, performance benchmarks, and known limitations of the AI system — information that is essential for establishing both the existence of a defect or non-compliance and its contribution to the harm suffered. System logs and post-market monitoring data generated in compliance with AI Act post-market monitoring obligations may provide direct evidence of the AI system's behaviour at or around the time of the harm, potentially enabling a claimant to demonstrate that the system produced the output that caused the harm and that the output constituted a departure from the system's documented performance standards. Conformity assessment records, particularly those generated under the third-party conformity assessment procedures applicable to the highest-risk AI systems, represent an independent evaluation of the system's compliance with applicable regulatory requirements and may constitute prima facie evidence of compliance — or, where non-compliance is found, of the existence of a defect or breach of duty capable of grounding a liability claim.^[19]

The concept of algorithmic auditability has been developed in both academic literature and regulatory proposals as a de lege ferenda instrument designed to generate liability-relevant findings through systematic independent examination of AI systems. Drawing on the work of Doshi-Velez and colleagues on the technical dimensions of AI interpretability, and on the proposals of Wachter, Mittelstadt, and Russell on the right to explanation as an accountability mechanism, the case for mandatory algorithmic audit regimes rests on the proposition that periodic independent examination of AI systems by technically qualified auditors can identify patterns of non-compliant or harmful behaviour that are not visible to affected individuals or regulators conducting case-by-case enforcement. The experience of financial services auditing under MiFID II and the Credit Rating Agencies Regulation provides institutional precedents for sector-specific mandatory audit regimes that generate publicly available findings capable of supporting civil litigation: algorithmic trading firms are required under MiFID II to conduct pre-deployment testing and ongoing algorithmic monitoring, and the results of those processes are available to regulators and, through regulatory enforcement proceedings, may become available to private litigants. A mandatory algorithmic audit regime applicable to high-risk AI systems could generate analogous evidentiary resources for AI liability claimants, reducing the informational barriers that currently impede access to justice in this domain.^[19]

The intersection of AI transparency obligations with data protection law creates both substantive and procedural analogies of direct relevance to AI liability. Article 22 of the General Data Protection Regulation establishes the right not to be subject to solely automated decisions that produce significant effects, and Recital 71 recognises a right to explanation in respect of the logic involved in such decisions. The enforcement experience of national data protection supervisory authorities — including the Irish Data Protection Commission's investigations of major AI-enabled platforms and the French Commission nationale de l'informatique et des libertés' enforcement proceedings regarding automated profiling systems — demonstrates that the regulatory and civil litigation channels associated with GDPR Article 22 can function as effective mechanisms for obtaining disclosure of AI decision-making logic and for establishing the basis of compensation claims where automated decisions cause demonstrable harm. The integration of GDPR enforcement with AI Act compliance requirements — through, for example, coordinated investigations between data protection authorities and AI market surveillance authorities — could amplify the evidentiary resources available to AI liability claimants, reducing duplication and increasing the efficiency of the enforcement ecosystem.^[21]

The limitations of transparency and explainability as liability-facilitation instruments must, however, be acknowledged with equal rigour. The explanatory gap between post-hoc interpretability tools — such as the LIME and SHAP methods widely used to generate local approximations of AI decision logic — and genuine causal attribution of harm constitutes a fundamental technical constraint that regulatory mandates alone cannot overcome. Where an AI system operates through deep neural network architectures that produce emergent behaviour not derivable from examination of individual parameters, post-hoc explanation tools provide approximations of decision factors rather than causally accurate accounts of the specific pathway from input to output, and the legal sufficiency of such approximations as evidence of causal nexus in civil proceedings remains contested. The risk of performative compliance — where AI providers satisfy the formal requirements of transparency and explainability obligations by generating documentation that is technically accurate but practically impenetrable to affected persons and their legal representatives — must be addressed through regulatory requirements that documentation be provided in forms accessible to legally qualified non-technical audiences, and that its adequacy be subject to independent audit rather than self-certification. The tension between explainability mandates and intellectual property protections under Directive 2016/943/EU on trade secrets requires resolution through legislative provision that clearly subordinates confidentiality interests to the evidentiary requirements of civil liability proceedings in cases where a credible basis for a liability claim has been established.^[18]

3.5. Towards a Coherent European Framework: Synthesis and Legislative Recommendations

The analytical findings of the preceding subchapters converge upon a set of normative conclusions that provide the foundations for a coherent de lege ferenda framework for AI civil liability at the European level. Three overarching normative principles emerge from this analysis as constitutive of any adequate framework. First, the primacy of victim compensation is affirmed not merely as a policy preference but as a constitutional imperative grounded in Articles 17 and 47 of the EU Charter of Fundamental Rights: the right to an effective remedy and to a fair trial, and the right to property, impose upon the Union legislator an obligation to ensure that the legal framework does not structurally deprive victims of AI harm of effective access to compensation. The systematic inadequacy of the existing de lege lata framework — documented in the preceding chapters through analysis of the product liability regime, general tort law, sectoral rules, and the specific evidentiary barriers created by the opacity and complexity of AI systems — constitutes a prima facie violation of this constitutional imperative that the legislative inaction following the withdrawal of the AILD has rendered more acute. Second, the economic efficiency rationale for internalising AI-generated externalities at the operator level provides a coherent analytical basis for the liability allocation choices proposed in this subchapter, directing liability towards those parties who are best positioned to avoid harm, to bear and distribute its costs, and to adjust the level of their AI deployment activity in response to liability incentives. Third, the systemic risk rationale for collective mechanisms recognises that certain categories of AI harm — particularly those caused by fully autonomous systems whose decision-making chains cannot be reconstructed, or by systems deployed at scales generating diffuse harm to large populations — cannot be adequately addressed by individual tort litigation and require collective compensation instruments that distribute risk across the relevant economic community.^[22]

The concrete legislative architecture of the recommended framework is specified across five dimensions that together constitute a coherent and victim-centred European AI liability regime. The first dimension is a tiered liability structure that maps different liability standards onto the AI Act's risk classification schema, calibrating the level of no-fault liability to the level of AI-generated risk. At the highest tier — encompassing AI systems classified as high-risk under Annex III of the AI Act that are deployed in domains such as critical infrastructure, healthcare, biometric identification, and law enforcement — a fully strict liability regime is recommended, under which operators bear liability for harm caused by the AI system without any requirement to establish fault, subject to defences of force majeure and contributory negligence. The distinction between what Professor Hacker has termed "illegitimate-harm models" — AI systems that, from a social perspective, should not cause harm, such as autonomous vehicles, diagnostic medical AI, and AI-enabled criminal justice decision tools — and "legitimate-harm models" — AI systems whose operation necessarily involves adverse decisions affecting some individuals, such as credit scoring and insurance pricing — provides a principled basis for differentiating within the high-risk category itself: illegitimate-harm models warrant full strict liability, while legitimate-harm models may appropriately be subject to rebuttable presumptions of defectiveness and causality.^[18] At the intermediate tier — encompassing non-high-risk AI systems deployed in commercial contexts — a regime of rebuttable causal presumptions operates where the AI system has failed to comply with applicable transparency or technical documentation requirements, lowering the evidential burden upon claimants while preserving the theoretical possibility of rebuttal by defendants who can demonstrate that their non-compliance was causally unrelated to the harm. At the lowest tier — encompassing consumer-to-consumer or non-commercial AI use — standard fault-based liability applies.

The second dimension of the recommended framework is a mandatory disclosure and documentary evidence regime, integrated with the AI Act's conformity assessment obligations and extending their scope to include civil liability proceedings. This regime would require providers and deployers of AI systems subject to the framework to maintain standardised technical logs of AI decision-making processes in a form that is accessible, durable, and legally admissible, and to preserve those logs for a period commensurate with the limitation period applicable to AI liability claims. National courts would be empowered to order disclosure of technical documentation, system logs, conformity assessment records, and audit findings in any civil liability proceedings involving AI systems, with trade secret protections expressly subordinated to the disclosure obligation where a credible basis for a liability claim is established — a mechanism that addresses the principal limitation of the AILD's disclosure provision, which failed to clearly resolve the tension between confidentiality interests and evidential access. The integration of this disclosure regime with the causal presumption mechanism — so that non-compliance with documentary obligations activates a presumption of causality — creates a strong incentive for operators to maintain adequate records and provides a proportionate response to the evidentiary challenges that the opacity of AI systems generates for claimants.^{[20, s. 3]}

The third dimension is a dual insurance and compensation architecture combining compulsory liability insurance for all operators of high-risk AI systems with a sectoral compensation fund for autonomous AI systems causing personal injury. Compulsory liability insurance, modelled upon the mandatory motor insurance framework, would serve as the primary compensation mechanism for individual liability claims, ensuring that successful claimants can enforce their awards against financially solvent insurers rather than against individual operators who may lack the resources to satisfy substantial judgments. The insurance market would, over time, generate actuarial data on AI loss frequencies and severities that could inform both regulatory risk classification decisions and the contribution base of the compensation fund. The sectoral compensation fund would serve as a residual compensation mechanism for cases in which individual liability cannot be established — because the AI system is fully autonomous and the liable party cannot be identified, because the operator is insolvent, or because liability caps applicable under the primary regime are inadequate to cover the full quantum of harm. The fund would be financed through contributions levied upon all operators of high-risk AI systems, calculated on the basis of system risk classification and commercial deployment scale, and governed by an independent administrative body subject to judicial oversight.^[21]

The fourth dimension addresses the harmonisation of limitation periods and burden-of-proof rules to reflect the specific temporal and epistemic characteristics of AI harm. The standard limitation period under most Member State civil codes — typically two to three years from the date of knowledge of the damage and the identity of the defendant — is inadequate for AI-caused harm, where the causal connection between the AI system's operation and the harm suffered may not become apparent until months or years after the harmful event, and where the technical complexity of establishing causal attribution may require specialist forensic investigation extending over prolonged periods. A harmonised limitation period of five years from the date of reasonable discoverability of the causal nexus, with a long-stop period of fifteen years from the deployment of the AI system, is proposed as appropriate to the AI context, drawing upon the model of the revised Product Liability Directive's extended limitation framework. The burden-of-proof regime should reflect the tiered liability structure: at the strict liability tier, the claimant bears the burden of establishing harm and the causal nexus between the AI system's operation and that harm, with the burden of establishing supervening causes or force majeure resting upon the defendant; at the presumption tier, the causal presumption operates upon the claimant's establishment of non-compliance, shifting the burden to the defendant to rebut the presumption.

The fifth dimension is the designation of a coordinated enforcement architecture empowering designated authorities to facilitate interaction between administrative AI Act enforcement and civil liability proceedings. The fragmentation of AI governance between multiple regulatory authorities — AI market surveillance authorities, data protection supervisory authorities, national financial regulators, and medical device competent authorities — generates coordination failures that may impede the effective enforcement of both regulatory obligations and civil liability rights. A designated AI liability coordination authority, empowered to compile and publish enforcement findings relevant to civil proceedings, to facilitate access to technical evidence held by regulatory authorities, and to coordinate limitation period calculations where regulatory proceedings are ongoing, would address this fragmentation without requiring the consolidation of sectoral regulatory functions that political and institutional constraints make infeasible in the short term.

The comparative perspective offered by non-European jurisdictions provides both positive evidence of a converging global consensus on the necessity of structured AI liability regimes and transferable design elements for the European framework. The United States has developed a fragmented but increasingly active AI liability landscape: the Colorado Artificial Intelligence Act 2024 established risk-based obligations for developers and deployers of high-risk AI systems, while federal tort litigation has produced an emerging body of case law addressing algorithmic harm in contexts ranging from autonomous vehicle accidents to discriminatory automated hiring decisions. The NIST AI Risk Management Framework provides a voluntary but widely adopted governance structure that generates technical documentation relevant to liability assessment and that has been referenced in judicial proceedings as evidence of applicable standards of care. China's Interim Measures for the Management of Generative Artificial Intelligence Services 2023 establish substantive obligations for generative AI providers — including requirements of truthfulness, accuracy, and respect for personal information — that create a direct basis for civil liability where those obligations are breached and harm results. Singapore's Model AI Governance Framework, while voluntary in character, demonstrates the viability of a risk-tiered approach to AI governance that distinguishes between AI applications according to the probability and severity of harm, a structural distinction that aligns closely with the tiered liability architecture proposed in this subchapter. The convergence of these national and regional approaches upon a common set of risk-classification, documentation, and liability-facilitation mechanisms provides persuasive evidence that the proposed European framework reflects an emerging international consensus rather than a parochial regulatory preference.^[18]

The proposed framework may be situated within the EU's Digital Single Market strategy and the broader project of algorithmic governance as a constitutive element of the trustworthy AI ecosystem that the Union's regulatory programme seeks to establish. A coherent and victim-centred AI liability regime performs functions that transcend the private law objective of compensating individual harm: it creates incentive structures that direct AI development and deployment toward safety-conscious designs and deployment practices; it generates information — through litigation, audit, and regulatory enforcement — about the actual harm profiles of AI systems that is essential for evidence-based regulatory development; it provides affected persons with effective agency in the governance of AI systems that affect their fundamental interests; and it establishes the conditions of legal predictability and accountability that are necessary for public trust in AI technology to develop on a sustainable basis. The assessment of the Future of Life Institute that safety and liability are intertwined concepts — that keeping AI safe requires a coherent and strong liability framework that guarantees the accountability of AI systems — captures the systemic relationship between liability law and AI governance that the de lege ferenda analysis of this chapter has sought to articulate and translate into concrete legislative recommendations.^[21] The structural inadequacy of the existing de lege lata framework, documented throughout this thesis, is not merely a technical deficiency in the law of obligations; it is a governance failure whose remediation through targeted and coherent legislative intervention at the European level is both necessary and, on the analysis presented here, fully achievable within the existing constitutional and institutional framework of the Union.

Conclusion

The present thesis has undertaken a systematic examination of civil liability for damages caused by artificial intelligence, proceeding from an analysis of the legal nature and regulatory context of AI systems through a comprehensive assessment of the existing liability framework and culminating in an evaluation of the principal proposals for legislative reform. The inquiry was structured around the conceptual distinction between de lege lata — the law as it currently stands — and de lege ferenda — the law as it ought to be constructed — a distinction that has proven to be not merely an organisational convenience but a substantively significant analytical framework. The central conclusion that emerges from the three-chapter analysis is unequivocal: the existing legal framework is structurally inadequate to address the distinctive harm profile of artificial intelligence, and targeted legislative intervention at the European level is both necessary and fully achievable within the constitutional and institutional framework of the Union.

The foundational analysis undertaken in Chapter 1 established that the definitional and classificatory problems attending the concept of artificial intelligence are not merely terminological inconveniences but carry direct doctrinal and regulatory consequences. The absence of a single authoritative definition of artificial intelligence in binding legal instruments reflects a genuine epistemological difficulty: AI systems do not constitute a homogeneous category but encompass an extraordinarily diverse range of applications, from narrow task-specific tools to increasingly autonomous systems capable of independent adaptive behaviour. The tripartite classification distinguishing narrow AI, general AI, and autonomous systems was shown to serve as a useful heuristic, but its utility for liability analysis is limited by the fact that legal responsibility must ultimately be determined by reference to specific operational characteristics — autonomy, opacity, and unpredictability — rather than abstract taxonomic categories. These three characteristics were identified as the principal features that distinguish AI-generated harm from the categories of harm for which existing civil liability regimes were designed, and it is their interaction that renders the application of traditional liability doctrine to AI cases so problematic. The opacity of AI decision-making processes — the so-called black box problem — disrupts the causal chains that negligence-based liability requires; the autonomous character of AI behaviour attenuates the degree of human control upon which fault attribution depends; and the statistical, probabilistic nature of AI harm generation frustrates the individualised causation analysis that civil liability requires.

The doctrinal analysis of civil liability foundations presented in Chapter 1 further demonstrated that neither the fault-based nor the strict liability model, as currently configured, is wholly adequate to the challenge posed by AI-caused harm. Fault-based liability, dependent upon the identification of a negligent human actor whose conduct caused the claimant's loss, is ill-suited to cases where the harm-generating decision was made by an autonomous system operating at speeds and complexities beyond human comprehension. Strict liability, while avoiding the fault attribution problem, has traditionally been predicated upon the identification of a specific operator who controls a dangerous activity or thing; the multiplicity of actors involved in the AI value chain — developers, manufacturers, deployers, and users — complicates this attribution in ways that existing strict liability regimes were not designed to address. The theoretical debate concerning the attribution of legal personality to AI entities was examined and ultimately assessed as premature and doctrinally problematic: while the attribution of electronic personhood might resolve some allocation difficulties, it would simultaneously undermine the compensatory purpose of civil liability by creating an entity capable of bearing obligations without possessing the assets necessary to satisfy them. The responsible approach, as the analysis of Chapter 1 concluded, is to maintain human and corporate accountability for AI systems while adapting the doctrinal instruments through which that accountability is enforced to the distinctive operational characteristics of those systems.

The de lege lata analysis conducted in Chapter 2 confirmed, through systematic examination of the principal liability regimes currently applicable to AI-caused harm, that the structural inadequacies identified in Chapter 1 are not hypothetical but manifest in concrete doctrinal difficulties that have been acknowledged by courts, regulatory bodies, and academic commentators. The application of the Product Liability Directive to AI systems encounters the fundamental difficulty that AI software was not clearly within the contemplation of the original 1985 instrument, and that even the 2024 revision, while extending the concept of product to digital manufacturing files and software, does not fully resolve the question of liability allocation along the AI value chain or address harms arising from the operational behaviour of AI systems that were not defective at the time of their placing on the market. The tort liability analysis demonstrated that the standard of care applicable to AI systems is not susceptible of determination by reference to ordinary negligence principles alone, given that the opacity of AI decision-making renders it impossible for a court to assess, post hoc, whether the system's operation conformed to the standard of a reasonably competent developer or deployer. The contractual liability analysis revealed that the allocation of AI-related risk through standard terms and exclusion clauses tends to operate systematically to the detriment of end-users and affected third parties, who bear the residual liability that neither developer nor deployer is willing to accept, and who lack the information and bargaining power necessary to negotiate more protective arrangements.

The causation analysis presented in Chapter 2 identified the evidential and doctrinal difficulties inherent in establishing a causal nexus between the operation of an AI system and the harm suffered as perhaps the most significant single obstacle to effective victim redress under the current framework. The combination of technical opacity, the statistical character of AI-related risk, the multiplicity of contributing causes in complex AI deployments, and the evidentiary asymmetry between sophisticated AI operators and uninformed claimants creates a structural barrier to liability claims that cannot be overcome by interpretive adaptation of existing causation doctrine. The reversal of the burden of proof and the judicial development of evidentiary presumptions represent partial solutions, but they are partial precisely because they depend upon the discretionary exercise of judicial power rather than clear and uniform legislative mandate, producing inconsistency across Member States that is incompatible with the requirements of a functioning digital single market. The sectoral survey with which Chapter 2 concluded demonstrated that the pattern of structural deficiency recurs across autonomous vehicles, medical AI, and financial algorithms: each sector has developed specific regulatory instruments that address the most salient risks within its domain, but none provides a comprehensive and effective mechanism for compensating all categories of AI-caused harm, and the fragmentation of sectoral regulation creates complexity and uncertainty that further disadvantages victims seeking redress.

The de lege ferenda analysis undertaken in Chapter 3 examined the principal proposals for legislative reform that have been advanced at the European level, assessing their potential effectiveness as mechanisms of victim protection and their coherence with the broader regulatory framework of European AI governance. The European Commission's AI Liability Directive Proposal of 2022 was analysed in detail and assessed as a significant but incomplete step toward an adequate civil liability framework. Its two principal mechanisms — the disclosure obligation and the rebuttable presumption of causal link — address the evidentiary asymmetry problem in a targeted and proportionate manner, but their effectiveness is contingent upon the parallel operation of the AI Act's obligations regarding high-risk AI systems, and their limitation to fault-based claims means that they do not resolve the deeper doctrinal inadequacies of the fault attribution framework. The case for extending strict liability to operators of high-risk AI systems was examined and found to rest upon compelling theoretical and policy foundations: the analogy with existing strict liability regimes for ultrahazardous activities, the alignment of the liability burden with the commercial beneficiary of AI deployment, and the incentive effects of strict liability upon safety-conscious design and deployment practices all support the extension of objective liability to at least the highest-risk AI applications. The objections grounded in innovation policy and legal certainty were considered and assessed as insufficiently weighty to override the victim protection imperative in the context of high-risk deployments, provided that the scope of strict liability is carefully defined by reference to the AI Act's risk classification framework.

The analysis of supplementary mechanisms in Chapter 3 demonstrated that mandatory insurance and collective compensation funds are necessary complements to the primary liability regime rather than alternatives to it. The experience of analogous regimes in nuclear energy, pharmaceutical liability, and motor accident compensation confirms that insurance mandates can be designed in ways that preserve innovation incentives while ensuring the financial capacity to satisfy claims, and that no-fault compensation funds serve an important residual function in providing redress where the primary liability framework proves inadequate. The examination of transparency, explainability, and algorithmic auditing obligations under the EU AI Act revealed the significant potential of these ex ante regulatory requirements to serve as evidentiary resources in civil litigation, providing claimants with access to the technical documentation and audit records that are necessary to support a liability claim but which would otherwise be inaccessible by reason of intellectual property protection and evidentiary asymmetry. The synthesis presented in Chapter 3 formulated concrete de lege ferenda recommendations that draw on comparative insights from the United States, Japan, Singapore, and China to propose a risk-tiered liability architecture that is both technologically neutral and victim-centred, capable of accommodating the diversity of AI applications while providing effective and consistent protection to persons who suffer harm as a consequence of AI deployment.

Certain questions that have been identified in the course of the analysis remain open and merit further scholarly inquiry. The relationship between civil liability for AI-caused harm and the emerging field of AI constitutional law — particularly the implications of the EU AI Act's fundamental rights impact assessments for the content of the duty of care in negligence — has not been fully elaborated in the existing literature and warrants dedicated treatment. The appropriate liability regime for generative AI systems, including large language models capable of producing harmful outputs whose causal chain traces through the autonomous choices of the model rather than the direct instructions of its operator, raises questions that existing doctrinal frameworks address only partially, and that the legislative proposals examined in this thesis were not designed primarily to resolve. The international dimension of AI liability — particularly the question of applicable law and jurisdiction in cases where the developer, deployer, user, and victim are located in different states — represents a significant gap in the current European regulatory framework that the proposed instruments do not address, and that will require attention as AI systems become increasingly global in their deployment and their effects. The relationship between civil liability and regulatory enforcement, and in particular the question of whether regulatory compliance should constitute a defence to civil liability claims or merely as a relevant evidential consideration, remains contested in both academic literature and regulatory materials and will require legislative clarification as the EU AI Act enters into force.

The practical question of how liability rules interact with the incentive structures of the AI industry deserves sustained empirical attention. The theoretical arguments advanced in the de lege ferenda literature regarding the innovation-promoting or innovation-chilling effects of strict liability versus fault-based regimes remain incompletely tested against empirical evidence about the actual behaviour of AI developers and deployers in response to regulatory change. Comparative regulatory analysis of the effects of the product liability reforms already implemented in the United States and the United Kingdom on AI investment and development activity would provide valuable evidence for the ongoing European legislative debate. The question of how civil liability interacts with ex ante safety regulation — whether the prospect of civil liability claims provides independent incentive effects that supplement the deterrent effect of administrative enforcement, or whether the two mechanisms are largely redundant — is a further empirical question whose answer has significant implications for the optimal design of the AI governance architecture.

The structural inadequacy of the existing de lege lata framework, documented throughout this thesis, is not merely a technical deficiency in the law of obligations. It represents a governance failure: a failure to provide adequate legal protection to persons who suffer harm as a consequence of the deployment of a category of technology that is already pervasive across the essential domains of modern life — healthcare, finance, transport, employment, and public administration — and that is certain to become more deeply embedded in those domains as its technical capabilities continue to develop. The remediation of this governance failure through targeted and coherent legislative intervention at the European level is both necessary and, on the analysis presented in this thesis, fully achievable. The legislative and institutional resources required are available: the risk classification framework of the AI Act provides the definitional foundation for a tiered liability regime; the disclosure and presumption mechanisms of the AI Liability Directive Proposal provide the procedural architecture for evidentiary reform; the existing strict liability regimes of European law provide the doctrinal template for the extension of objective liability to high-risk AI operators; and the experience of analogous mandatory insurance regimes provides the financial architecture for ensuring that liability is not merely nominal. What is required is the political will to deploy these resources in a coherent and integrated manner, guided by the overriding principle that persons who suffer harm as a consequence of AI deployment are entitled to effective legal protection, and that such protection must not be conditioned upon the victim's capacity to penetrate the technical opacity of systems whose design and operation lie entirely outside their knowledge and control. The articulation of that principle, and the demonstration of the legal means by which it may be translated into binding and enforceable norms, constitutes the primary scholarly contribution of the present thesis.