Who's Liable When the AI Gets It Wrong?

When an AI tool causes harm, everyone points at everyone else. The vendor blames your configuration. You blame their model. The customer blames both of you. So who actually pays? The honest answer: it's blurry, and the blur is where your risk lives.

In plain English, liability here comes from three places. First, the contract: whatever you and the vendor agreed about who covers what. Second, the law: regulations like the EU AI Act, in force since August 2024, assign responsibilities to providers and deployers of AI systems, and other laws assign duties around negligence and consumer protection. Third, the facts: who chose the tool, who configured it, who reviewed the outputs.

Notice what this means in practice. If your team rubber-stamps AI outputs with no human review, "the AI did it" won't shield you. Deployers have their own responsibilities, and courts and regulators increasingly expect meaningful human oversight, not a human-shaped rubber stamp.

I'm explaining the landscape, not your situation — liability questions belong with your lawyer. But go into that conversation knowing the map: contracts, regulations, and your own oversight practices are the three things that decide the answer.

I explain frameworks; I don't give legal counsel.