Who Is Responsible When AI Makes a Mistake?

When an artificial intelligence system causes harm, responsibility generally falls on whichever party in the chain was best positioned to prevent it: the developer who designed the system, the business that deployed it, or the person who relied on its output without adequate oversight. There is no single federal law in the United States that says who is responsible when AI makes a mistake, so courts and regulators reach for the tools already on the shelf — product liability, negligence, contract, civil rights, and consumer protection law — and apply them to the facts of each case. The answer depends on where the failure actually happened.

Why There Isn’t a Single Answer

The U.S. has no comprehensive federal statute dedicated to AI liability. In January 2025, the administration revoked prior executive-order-level AI safety requirements and adopted a policy favoring minimal regulation, and the same action created an AI Litigation Task Force to challenge state AI laws the administration considers overly burdensome.¹ A bill in the 119th Congress, the AI LEAD Act (S. 2937), would establish a federal products liability framework with separate rules for developers and deployers, but as of mid-2026 it has not become law.²

What fills the gap is a patchwork: traditional tort law, federal civil rights statutes, consumer protection enforcement by agencies like the FTC, and a growing body of state legislation. Several states now require companies deploying high-risk AI systems to use reasonable care against algorithmic discrimination, with obligations that can include annual audits, consumer notice, and reporting to the state attorney general. Which theory a plaintiff can prove, and in which state, usually matters more than any abstract rule about AI.

When the Developer Is on the Hook

Software creators face the sharpest scrutiny when their product’s design, testing, or warnings are inadequate. The theory most people reach for first — strict product liability — runs into a complication: courts have not consistently treated software as a “product” in the traditional sense. A product generally means tangible personal property distributed commercially, and at least one federal appeals court has held that software does not fit the definition. Strict product liability claims also typically require physical harm, and many AI failures cause only financial or reputational loss.

That doesn’t mean developers escape liability. It means the usual path runs through negligence. A plaintiff suing an AI developer typically has to show the developer failed to exercise reasonable care in designing the system, testing it, or warning about its limitations. The proposed AI LEAD Act would formalize that approach, making developers liable when they fail to exercise reasonable care in design or fail to provide adequate instructions and warnings, or when a product reaches the market in a defective condition unreasonably dangerous during reasonably foreseeable use.²

When an AI system causes physical injury — a malfunctioning autonomous vehicle sensor, a flawed medical device algorithm — strict product liability becomes more viable because the physical-harm threshold is met. The injured person then does not need to prove carelessness, only that the product had a defect that made it unreasonably dangerous. For purely financial harm, negligence and breach of contract remain the primary avenues.

If a developer’s conduct crosses from carelessness into something approaching willful disregard for known safety risks, punitive damages become possible. Those awards are meant to punish and deter rather than compensate, and courts generally require evidence of willful misconduct, malice, fraud, or conscious indifference before allowing them.

When the Business That Deployed It Is on the Hook

Companies that use AI tools in their operations cannot simply hand legal risk off to the software vendor. Under vicarious liability, a company is generally responsible for harm caused by agents acting within the scope of its business. When a company deploys an AI system to make or heavily influence decisions affecting customers, employees, or the public, courts tend to view that output as an extension of the company’s own actions. The company profits from the automation and bears responsibility when it goes wrong.

Hiring and Employment Decisions

Federal law prohibits hiring and employment practices that disproportionately exclude people based on race, sex, religion, national origin, age, or disability, even when the discrimination is unintentional.³ When a company uses an AI screening tool that systematically filters out qualified candidates from protected groups, the company bears the liability regardless of whether a third-party vendor built the tool. EEOC guidance has stated this directly: an employer may be responsible if a selection procedure discriminates on a prohibited basis, even if the procedure was developed by an outside vendor. The employer is making the employment decision, and the legal duty sits with the employer.

Enforcement has already caught up to that reality. The EEOC has pursued actions against companies whose AI hiring tools automatically rejected applicants based on age, producing settlements that included financial payments, anti-discrimination policy adoption, and mandatory compliance training. Amazon preemptively abandoned an AI recruiting tool in 2018 after discovering it penalized resumes from women applying for technical roles.

Consumer-Facing Services

Companies using AI to process loan applications, insurance claims, or other consumer services must ensure the results comply with existing consumer protection law. The FTC has stated that there is no AI exemption from the laws on the books, and companies making misleading claims about AI products or misusing consumer data face enforcement.⁴

There is a wrinkle. Some legal scholars have argued current law actually leaves a gap favoring corporations that automate misconduct. Because AI systems are not employees with independent mental states, traditional respondeat superior doctrine does not map perfectly onto algorithmic decisions. A company acting through an algorithm may look just as purposeful as one acting through human employees, but the framework for holding it accountable is less developed. That is exactly the gap proposed federal and state legislation is trying to close, and why deploying companies face real legal uncertainty in the meantime.

When the User or Operator Is on the Hook

The person operating or relying on an AI system has their own duty of care. Ignoring it can make them liable for resulting harm, or reduce what they can recover if they are the ones hurt.

The idea driving most of this is “human-in-the-loop”: a person is supposed to monitor the AI’s output and intervene when something goes wrong. In practice, this creates a paradox. Research on human-AI interaction shows that people working alongside automated systems develop “automation bias,” trusting the machine’s recommendation even when red flags are present. The human “in the loop” can end up functioning as a rubber stamp, legally responsible for outcomes they could not realistically predict or prevent. Courts have not fully reconciled the “reasonable person” standard with that cognitive reality, though the tension is increasingly recognized in legal scholarship.

Driving a Semi-Autonomous Vehicle

Operator liability is clearest with semi-autonomous vehicles. At current automation levels (generally SAE Level 2 and Level 3), the driver remains responsible for monitoring the road and taking over when the system requests it. Under developing U.S. frameworks, liability depends on the individual case: if the driver fails to fulfill their duty of care while the automated system is engaged, the driver and the vehicle’s registered owner bear responsibility for the accident. If the automated system malfunctions during proper use, liability shifts toward the manufacturer. The approach gaining the most traction among policymakers combines traditional negligence product liability with a “reasonable human driver” standard, asking whether a competent, attentive human driver would have avoided the accident.

Professional Use (Doctors, Lawyers, Advisors)

User responsibility gets heavy in professional practice. A doctor who relies on an AI diagnostic tool without exercising independent clinical judgment can be held liable for malpractice if the AI’s recommendation turns out to be wrong. The standard of care does not change because a machine was involved; the physician is still expected to cross-check the AI’s output against their own expertise and other diagnostic methods. When AI is used as a decision-support tool, the professional who makes the final call bears the liability risk. The same logic applies to lawyers, financial advisors, and other licensed professionals: the license holder keeps the legal duty to the client.

When the User’s Own Negligence Reduces What They Can Recover

If an AI user’s negligence contributes to the harm — they ignored warnings, skipped verification steps, or used the tool for a purpose the manufacturer explicitly said it should not be used for — comparative or contributory fault principles reduce their recovery. In most states, a plaintiff’s share of fault diminishes damages proportionally. In a significant number of jurisdictions, if the user’s fault exceeds 50%, they lose the right to recover entirely. A user’s negligence can also make them liable to third parties who were harmed as a result.

Training Data Providers and Generated Content

AI systems are only as reliable as the data they are trained on, and entities that supply training datasets face their own exposure. If a dataset is sold for use in a high-stakes system and contains systematic errors or biased labeling, the provider could face product-style claims for selling a defective product. If training data was collected in ways that violated privacy laws — scraping personal information without consent, failing to anonymize sensitive records — both the data provider and the AI developer using that data face enforcement risk. The FTC has already acted against companies for deceptive data practices and warned explicitly that AI companies must honor their commitments to users or face liability under existing consumer protection law.⁴

Copyright is one of the fastest-developing fronts. In 2025, federal courts began sorting out when training on copyrighted material is fair use. In Bartz v. Anthropic, the court found that training on legitimately purchased copyrighted books was “highly transformative” fair use but called the use of pirated works “inherently, irredeemably infringing.” In Kadrey v. Meta, the court granted Meta summary judgment on fair use grounds, emphasizing that the plaintiffs had not shown substantial market harm from the training process. In Thomson Reuters v. ROSS Intelligence, the court rejected a fair use defense, finding the defendant’s use of legal headnotes was not transformative and directly competed with the original product. The separate question — whether an AI output that resembles a copyrighted work creates liability, and for whom — is even less settled. For now, developers risk claims based on what their models ingested, and users risk claims based on what they do with the outputs, particularly if they prompt the system to produce something closely mimicking a specific work.

How Contracts Quietly Decide Most of This

In practice, much of AI liability is allocated not by courts applying tort law but by contracts negotiated before anything goes wrong. Two clauses do most of the work.

Limitation of liability clauses cap the total amount a software provider can owe, typically at the fees the customer paid during the preceding 12 months. They routinely exclude consequential, incidental, and punitive damages, meaning the customer cannot recover downstream business losses. Courts generally enforce these provisions unless the provider’s conduct rises to gross negligence or willful misconduct, which most states will not allow parties to waive.

Indemnification clauses determine which party covers legal costs when a third party sues. In a typical AI software agreement, the developer might indemnify the customer against intellectual property infringement claims but carve out liability caused by the customer’s own data, instructions, or misuse of the tool. If the AI makes a mistake that leads to a lawsuit, these provisions usually control who writes the check.

These arrangements can leave the deploying company holding substantial risk, especially when the liability cap sits far below potential damages from a large-scale AI failure. Many standard AI service agreements also disclaim warranties of accuracy or fitness for a particular purpose, so the customer is contractually accepting that the AI’s output may be wrong. Any business licensing AI technology should negotiate these terms with the same rigor it would apply to any high-exposure contract, and should independently verify that the AI tool meets its own regulatory obligations rather than relying on the vendor’s assurances.

Does Section 230 Protect AI Companies?

Section 230 of the Communications Act shields online platforms from liability for content created by their users.⁵ Whether that shield extends to AI-generated content is one of the biggest unresolved questions in technology law. As of mid-2026, no court has decided whether or how Section 230 applies as a defense against claims based on generative AI outputs.⁶

The argument for immunity treats generative AI as analogous to search engines or autocomplete — tools that organize and deliver information originating from third parties. The argument against immunity focuses on hallucinated facts, fabricated quotes, and defamatory claims that do not appear in training data at all. Under the statute, a provider “responsible, in whole or in part, for the creation or development of information” does not qualify for immunity.⁵ If the AI is creating new information rather than passing along someone else’s, the immunity argument weakens considerably. Legislation has been proposed in Congress that would explicitly withhold Section 230 protection when a claim involves generative AI, though no such bill has passed.⁶

What Enforcement Looks Like Right Now

While Congress debates comprehensive legislation, federal agencies are already using existing authority to hold companies accountable. The FTC has been the most active enforcer, launching “Operation AI Comply” to target deceptive AI practices. In one action, the agency reached a $193,000 settlement with an AI service that falsely claimed to substitute for professional legal advice, requiring the company to notify affected consumers about the tool’s limitations. In another, the FTC permanently banned an AI writing tool from generating fake consumer reviews and testimonials.⁷ The agency’s posture has been consistent: existing consumer protection law applies fully to AI, and companies cannot use the technology’s complexity as a shield for deceptive or unfair practices.

State-level activity is moving the other direction from federal deregulation. Several states have passed laws requiring impact assessments, consumer notice, and discrimination audits for high-risk AI systems, with some mandating that safety incidents be reported to regulators within 72 hours of detection. Whether those state obligations survive federal preemption challenges under the current administration’s policies remains an open and actively contested question.

1
The White House. Ensuring a National Policy Framework for Artificial Intelligence
2
Congress.gov. Text – S.2937 – 119th Congress (2025-2026): AI LEAD Act
3
Office of the Law Revision Counsel. 42 U.S. Code 2000e-2 – Unlawful Employment Practices
4
Federal Trade Commission. AI Companies: Uphold Your Privacy and Confidentiality Commitments
5
Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material
6
Congress.gov. Section 230 Immunity and Generative Artificial Intelligence
7
Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes