Who Is Liable When AI Makes Mistakes? The State of the Debate

Why the liability question for AI affects every business

AI has arrived in many small businesses: drafts of emails and offers, data analysis, chatbots on the website, translations, summaries of contracts. Where it saves time in sales today is described in AI in sales. With each of these uses comes a question rarely asked day to day: what happens if the result is wrong and someone suffers harm as a result?

A well-known example comes from Canada. In 2022, an Air Canada chatbot told a customer about a refund rule that did not exist in that form. The airline argued that the chatbot was responsible for its own statements. A tribunal in British Columbia rejected this in 2024: the company was responsible for all information on its website, including that from its chatbot.

The question this article sets out to answer: Who is liable when AI makes mistakes in a business, and how can an owner assign responsibility so that errors remain manageable? To answer it, we clarify terms, outline the legal framework in Germany and the EU, introduce the mental model of the moral crumple zone, review findings, and weigh two views.

Terms: liability, fault, product liability, deployer

• Contractual liability: Anyone who owes a customer a service and performs it defectively is liable under the contract, for example for remedy or damages. Damages generally require fault, which is presumed where a duty has been breached.
• Tort liability: Anyone who culpably injures another’s life, health, property, or other protected interests is liable even without a contract (§ 823 of the German Civil Code).
• Product liability: The manufacturer of a defective product is liable for certain damages without fault, that is, even if it cannot be blamed.
• Provider and deployer: Under the EU AI Act, a provider is whoever develops an AI system and places it on the market. A deployer is whoever uses an AI system professionally under its own authority. Most small and midsize businesses are deployers.

The AI Act itself does not regulate liability for damages. It sets out obligations, such as transparency toward people who talk to an AI and sufficient AI literacy among employees. Anyone who breaches these obligations, however, will find it harder to exonerate themselves in a liability dispute. Which obligations deployers have in sales and marketing and which deadlines apply after the 2026 changes is described in EU AI Act: what it means.

The legal framework: who is liable for what today

The most important change concerns product liability. On October 8, 2026, the Bundestag passed a law modernizing product liability law that implements EU Directive 2024/2853 and applies from December 9, 2026. Software is then explicitly a product, including AI systems. Manufacturers remain liable if they control the product after placing it on the market through updates. Courts can order companies to disclose evidence if a claim appears plausible, and if a company refuses, the product is presumed defective. The previous 500-euro deductible for property damage and the 85-million-euro cap are abolished. For businesses that offer software or AI-based products themselves, this is a significantly stricter framework.

For businesses that merely use AI, less changes. They are liable to their customers for their own performance anyway. A separate EU directive intended to bring easier proof specifically for AI damages will not exist for now: the Commission announced its withdrawal in February 2025 and formally withdrew the proposal in the Official Journal in October 2025.

The mental model: the moral crumple zone

Technology researcher Madeleine Clare Elish coined the term moral crumple zone. It means that in a system of humans and automation, responsibility for a mistake often lands on the person who could last have intervened, even if they had little control over what happened. Just as a car’s crumple zone absorbs the impact, this person absorbs the blame and thereby protects the technical system and its manufacturers.

W. David Holford (2022) examined this using the example of airline pilots. Legally, the pilot in command bears full responsibility for the aircraft, and courts have upheld this attribution for decades. In fact, the automation flies most of a flight, and studies show that pilots’ situational awareness decreases as automation increases. A contradiction arises between attributed responsibility and actual control. Holford distinguishes four kinds of responsibility: causal, legal, moral, and role responsibility.

For a small business, this is a useful warning. The sentence “A human checks everything” sounds like responsibility. But if that person is supposed to approve a hundred AI drafts a day, has no time to check, and does not know the underlying material, they are not a control but a crumple zone. Good rules give them real control or take the role away.

Anyone who gives an employee responsibility for AI results must also give them the time and knowledge to carry it.

What research shows about control and automation

The studies on cockpit automation summarized by Holford (2022) show a pattern that can be transferred to office work. The expectation was that automation would relieve people of routine and free them for more important judgments. In aviation, this was often not confirmed: attention dropped, and rarely used skills declined. When something unexpected then happened, exactly these people were supposed to take control within seconds.

Peng Liu (2024) describes the related concept of automation complacency: people working with a mostly reliable system check less thoroughly. Liu points out that it serves to attribute responsibility to operators, even though the behavior is a foreseeable reaction to the system’s design. Mourão and Juliasse (2026) propose for healthcare that authority be delegated only as far as reliability is proven, and that oversight be given time.

The findings come from high-risk fields. For a business using AI drafts for offers, the damage is usually smaller. But the pattern is the same: the more reliable a tool usually is, the less it is checked, and the more surprisingly the rare error strikes. Why AI can worsen results on tasks outside its capabilities is described in AI tools in marketing with the jagged frontier according to Dell’Acqua and colleagues.

Two views: a tool like any other or a new kind of risk?

The first view considers AI a tool like any other. Anyone who miscalculates with a faulty spreadsheet is also liable to their customer. Existing law suffices: the business is liable for its performance, the manufacturer for its product, and in future explicitly for software too. A separate AI liability regime is not needed, and the withdrawal of the EU directive confirms this.

The second view sees a new kind of risk. AI results are hard to trace, vary with the same input, and errors sound convincing. Injured parties often cannot prove where the error lay. Responsibility blurs between provider, deployer, and employee, and providers’ terms of use shift the risk almost entirely onto users.

I consider the first view largely accurate legally and the second more important organizationally. For the customer, little changes: they hold the business responsible, and rightly so. For the business, however, a lot changes, because it bears a risk whose cause it controls less well than with a conventional tool. The answer is not a legal question but a question of processes: who approves what, how thoroughly, and where AI stays out entirely.

Assigning responsibility for AI in the business

1. Record uses

   List where AI is used in the business, with which tool, and with what external effect. Under the AI Act, too, this list is the most sensible first step.

2. Classify by risk

   Separate drafts for internal use, results that go to customers, and decisions about people or money. The strictest rules, or no AI at all, apply to the last group.

3. Link approval to control

   For each group, define who approves, what is checked, and how much time is allotted. Approval without time to check is not control.

4. Ensure competence

   Train the employees who approve AI results on the typical errors of the tools. Since February 2025, the AI Act has required sufficient AI literacy.

5. Review contracts and insurance

   Check providers’ terms of use, liability limits in your own contracts, and whether your professional or business liability insurance covers AI-assisted services.

This applies especially to website chatbots, because they talk directly to customers without human approval. Which form of inquiry makes sense there is compared in Chatbot, callback, or live chat. How such rules fit into a simple order of responsibility in a business is described in Corporate governance for small businesses.

Conclusion: who is liable when AI makes mistakes

To the guiding question: when AI makes mistakes in a business, the business using it is generally liable to customers, as if it had provided the service itself. From December 9, 2026, manufacturers of software and AI systems are explicitly liable without fault for defective products under Germany’s new Product Liability Act. There will be no separate EU rule on AI liability for the time being. The mental model of the moral crumple zone shows what matters within the business: responsibility must not be dumped on a person who has no real control. An owner assigns responsibility well by classifying uses by risk, equipping approvals with time and knowledge, and setting clear limits for the AI. The limits of this article: case law on AI errors is young, and research on automation comes from high-risk fields.

1. This week: List all AI uses in the business and mark those whose results go out without checking.
2. This month: For each group, define who approves, what is checked, and what the AI may not do.
3. By year-end: Review terms of use, your own contracts, and insurance coverage, especially if you offer software yourself.

An AI can make a mistake. Only whoever deployed it can be liable, and so they should also decide how it is used.