Legal Accountability for AI Systems

The Philosophical Problem of Legal Answerability

Legal accountability concerns the conditions under which the exercise of socially consequential power is susceptible to legal demand, investigation, judgment, and remedy. Artificial intelligence places that question within chains of technical design, organizational selection, data production, continuing adjustment, and institutional use. A credit score may depend on historical repayment records, a learned model, vendor preprocessing, a bank's threshold, a clerk's procedural authority, and administrative rules governing access to finance. Asking whether the model caused a harmful decision is therefore an incomplete inquiry. A legally adequate explanation must locate the norm violated, the person or institution subject to the norm, the relevant action or omission, the causal and evidentiary connection, and the remedy available to the claimant.

Three propositions structure the investigation. First, functional autonomy does not, by itself, specify who bears legal liability. Legal liability is conferred through particular legal institutions and doctrines. Second, multiple actors may contribute to a single harmful outcome under different duties; the legal order must identify relations among them without erasing differences in fault, causation, authorization, and risk control. Third, accountability must operate before and after harm. A system can generate impermissible risks and unlawfully interfere with rights even when compensable injury has not yet been established. Administrative review, prohibition, injunction, disclosure, correction, sanction, and damages are distinct legal responses.

The philosophical question is consequently one of justified imputation: under which publicly defensible rules can a norm-governed institution connect a computationally mediated outcome to a duty-bearing party? This concern has a deep history in theories of action, law, and justice. Its modern formulation emerges in the literature on computerized accountability and responsibility gaps (Nissenbaum, 1996; Matthias, 2004; Bovens, 2007). Their insights invite analysis of legal procedure and private law, not merely speculative discussion of machine agency. The monograph's governing thesis is that law needs a layered architecture connecting normative duties, power over risk, reliable evidence, and effective remedy.

Definition and Conceptual Boundaries

Legal accountability for AI systems is the set of relations through which legally competent forums can require identified persons or institutions to justify AI-related conduct, establish compliance or breach, allocate consequences, and secure appropriate remedies. Its object is a legally organized sociotechnical activity: persons, organizations, models, interfaces, input data, procurement arrangements, access controls, operational policies, and persons whose interests are affected. The system is part of that arrangement; legal attribution depends on the governing jurisdiction, legal category, and claim.

Accountability, responsibility, and liability must be analytically distinguished. Accountability names an institutional relation of answerability. Responsibility may designate assigned duties, causal involvement, capacities, or blameworthiness. Liability identifies exposure to consequences specified by law, including monetary compensation or regulatory sanction. A company may have a responsibility to monitor a model but face no damages in a given case because no legally recognized harm has occurred. A deployer may owe compensation under a strict-liability rule without having acted negligently. A developer may be causally influential yet outside a claimant's cause of action. Equating these categories causes recurring analytical mistakes (Hart, 1968; Bovens, 2007).

The phrase “for AI systems” should not prejudge the legal status of artificial agents. It identifies the activity whose effects give rise to legal questions. Separate dossiers on AI and the Law, Algorithmic Adjudication, Machine-Generated Legal Decisions, and Legal Personhood of Artificial Systems address broader jurisprudential issues of interpretation, judicial power, machine-created reasons, and possible legal status. This work is concentrated on the allocation of duties and consequences arising from AI development and use. It includes public-law obligations because they govern accountable operation; private-law compensation because it addresses injury; and philosophical accounts of agency because attribution requires a coherent conception of action and authority.

Method, Sources, and Jurisdictional Limits

The inquiry combines historical interpretation of philosophical texts, analytical reconstruction of legal concepts, comparison of legal doctrines, and examination of enacted contemporary instruments. Aristotle's account of rectificatory justice is treated as a philosophical source rather than a modern tort code. Roman law supplies an historical vocabulary of obligations and wrongs; its categories are reconstructed through the Digest and Institutes, with attention to the distinction between ancient texts and modern doctrinal systems. H. L. A. Hart's analysis of responsibility, contemporary corrective-justice theory, and legal-economic theories of accidents offer competing criteria of justification. Recent scholarship addresses computational systems as environments of distributed action.

Specific legal propositions require jurisdictional reference. The European Union's AI Act regulates defined actors and classes of systems; it does not establish a general, uniform private cause of action in damages for every AI injury. The recast EU Product Liability Directive addresses defective products and compensation under its own conditions and transitional dates. The GDPR protects specified interests in data processing and automated decisions. English public-law litigation and Wisconsin criminal sentencing illustrate different mechanisms of judicial review. They do not create a universal transnational doctrine.

The legal landscape is described as of November 4, 2026, using accessible original legislative texts, judgments, and institutional materials. Regulations, directives, treaties, recommendations, standards, and judgments differ in legal force. The effective date of an obligation is not the same as its adoption date; a European directive may require domestic transposition; and soft-law guidance may inform responsible conduct without itself providing a judicial remedy. The discussion separates textual law, philosophical justification, and proposals for legal design. Where a full scholarly work was unavailable, interpretation is limited to the accessible abstract or bibliographic record rather than represented as complete textual examination.

From Ancient Corrective Justice to the Law of Wrongdoing

Aristotle's distinction between distributive and corrective justice remains a fundamental point of departure. In Nicomachean Ethics V.4 (1132a–b), rectification addresses an inequality generated by a transaction or wrongdoing between parties. The juridical relation concerns an injury and its correction within a structure that treats parties as equals for purposes of rectification. Aristotle's discussion belongs to the ethical and political architecture of the polis; transferring it directly to modern AI liability would erase the profound changes in legal institutions, rights, and technical causation. Its enduring insight is structural: where one person's legally protected position has been worsened through another's wrongful conduct, the remedy is directed toward the relationship between injurer and injured.

A computational system mediates that relationship through several actors. If a hospital uses a defective diagnostic instrument and a patient is harmed, the immediate clinical event is connected to procurement, software specification, maintenance, professional judgment, and risk controls. Corrective justice presses the question of which legally significant wrong answers to which particular loss. It does not simply distribute technological costs across society. This distinction matters when a general safety regime imposes duties without requiring proof of a particular injured person, whereas a civil claimant seeks relief against a particular respondent (Weinrib, 1995).

An Aristotelian analogy also reveals a difficulty: contemporary harms can be population-wide and statistical. An eligibility model may impose unequal error rates on classes of applicants without producing an easily isolated bilateral injury. Corrective relations remain possible in individual cases, but systemic risk demands public enforcement and collective remedies. The philosophical task is to justify the relation between those levels rather than assume that one ancient model determines the complete answer.

Roman Obligations, Fault, and the Architecture of Imputation

Roman private law distinguished obligations arising from contracts and from delicts; Justinian's Institutes III.13 and IV.1–4 organize these sources and explain selected injuries, thefts, and damage to property. The Aquilian action, later elaborated through juristic interpretation, became historically important in debates about wrongful damage and fault; the Digest 9.2 preserves juristic materials associated with the lex Aquilia. These sources show that liability is historically a legal construction: a rule specifies a type of injury, a relevant act, persons who can sue, and the conditions under which one owes a response.

The later civil-law traditions developed questions of fault, causation, damage, legal capacity, and allocation of risk through different codifications and doctrinal histories. Modern common-law negligence, continental fault liability, and product liability do not share a single unchanged Roman template. Their kinship lies partly in the analytical separation of the occurrence of damage from the legal rule that transforms damage into an obligation. That separation becomes indispensable when technical agents produce results whose precise computations are inaccessible to a plaintiff.

Consider an AI-based navigation service whose routing decision contributes to injury. That contribution is a causal hypothesis. Liability requires a further normative bridge: whether a designer owed a duty concerning the routing logic, whether a provider gave misleading assurances, whether an operator disregarded operational limits, whether a statutory product regime applies, and whether the injury is within the relevant scope of protection. Historical law teaches that imputation is never identical with the observation that an event happened. It is an operation of legal classification and adjudication.

Modern Jurisprudence and the Multiple Senses of Responsibility

H. L. A. Hart's Punishment and Responsibility (1968) clarifies that legal and ordinary language use “responsibility” in multiple senses. A person's office may assign role responsibility; a person's conduct may be causally relevant; a person may possess or lack the capacities pertinent to culpability; and a person may be legally liable to certain consequences. These senses can overlap without collapsing into each other. Hart's distinction is especially valuable for AI controversies because “the system is responsible” is often an equivocation between causal production of an output and the legal standing required to bear an obligation.

A software model may be the proximate computational producer of an error while a corporation is the duty-holder, a clinician is the professional decision-maker, and a regulator is the authorized enforcement forum. Their relations follow different rules. Corporate liability is itself a legal achievement rather than a biological fact: organizations act through authorized arrangements and are recognized as legal persons. But the extension of corporate-personhood analogies to AI must be tested against the specific legal purposes of personality, assets, governance, representation, and enforceability.

Hart's wider jurisprudential contribution in The Concept of Law (1961; 2nd ed. 1994) supports a further distinction between validity and merit. The existence of a legally applicable rule can be established through institutional sources and practices even if the rule's allocation of risk is ethically contested. Conversely, a compelling proposal for fair compensation does not become existing law through philosophical argument. An adequate monograph therefore distinguishes positive-law analysis from a normative proposal to redistribute liability when technological opacity shifts proof burdens onto injured persons.

Corrective Justice, Relational Rights, and Reparative Duties

Corrective-justice accounts of private law ask how a wrongdoer and a victim stand in a legally intelligible relation. Ernest Weinrib's The Idea of Private Law (1995) develops private law's correlativity: the reasons for imposing a remedy connect the defendant's wrong and the claimant's injury within a single normative structure. The approach resists explaining every tort judgment as a device for maximizing aggregate utility. Applied to AI, it demands specificity. A defendant's technological influence is insufficient unless it helps establish the relevant legal wrong, its relation to the claimant, and the justified remedy.

AI complicates correlativity when datasets, software suppliers, infrastructure operators, and deployers jointly shape outcomes. A claimant whose application was rejected by an automated process might identify discriminatory institutional policy, flawed training data, inadequate procurement, or undisclosed rules. Each potential defendant's relation to the harm requires examination. The fact that all actors contributed in some causal sense does not mean that each committed the same wrong or owes the same remedy. Equally, fragmentation should not make the right practically unenforceable.

The strongest objection to a narrow relational approach concerns structural harms with no clearly individualized wrongdoer. If a city purchases a system that systematically denies access to a public benefit, the public duty to operate fair administration and the claimant's right to contest may be more basic than a search for individual engineering negligence. This supports a dual structure: the state or deploying institution remains publicly accountable for its exercise of authority, while contributory private actors may bear separate contractual, regulatory, or tort duties. Corrective justice explains one dimension of accountability; public law explains another.

Risk Distribution, Deterrence, and Enterprise Responsibility

Law and economics evaluates accident rules partly through the incentives they create. Guido Calabresi's The Costs of Accidents (1970) treats accident costs, prevention, and allocation as problems of institutional choice. Such analysis directs attention to who can reduce risk, at what cost, and with what information. In AI systems, a provider may possess superior evidence about defects, a deployer may understand contextual dangers, and a customer may control exposure. Assigning risk to the party best placed to prevent particular harm can improve safety, although the criterion alone cannot establish who has violated an individual right.

A broadly risk-based account favors responsibility for enterprise activities that produce foreseeable hazards at scale. One operator's small per-decision error rate may affect millions of persons when decisions are automated. Centralized monitoring, insurance, auditability, and remedial procedures can produce economies of prevention. However, a rule making every developer absolutely liable for any downstream misuse may encourage underdeployment, defensive concentration among wealthy firms, or withdrawal of useful tools. Economic assessment must account for these responses alongside avoided harms and the costs imposed on victims.

Corrective and instrumental theories therefore present a genuine philosophical tension. The first justifies liability through a relation of wrong and remedy; the second emphasizes prospective changes in behavior and social costs. Both inform modern doctrine, and neither supplies a universal answer. The resulting policy choice should specify the protected interest, foreseeable danger, actual control, information asymmetry, and distribution of losses rather than invoke a general principle that all AI-related harms are the responsibility of whichever actor has the deepest pockets.

Corporate Agency, Distributed Action, and the Problem of Many Hands

AI systems are built by many hands. Helen Nissenbaum (1996) described how complex computerized production can weaken accountability through distributed participation, defects treated as inevitable, attribution of failure to the computer, and ownership practices separating commercial benefit from responsibility. Her analysis predates contemporary machine learning yet identifies an institutional problem that has intensified as model development becomes modular and globally distributed. Mark Bovens (2007) conceptualizes accountability as a relation in which an actor explains conduct to a forum capable of questioning, evaluating, and attaching consequences. The two analyses converge on the importance of a stable answerable actor and a functioning forum.

A corporation coordinates labor through contracts, supervision, policies, budgets, and technical procedures. Responsibility for its institutional choices can remain coherent even when no employee intended the precise output. Civil liability, employment law, agency, corporate governance, and regulatory enforcement each attribute different consequences under different tests. The slogan “many hands” describes the investigative challenge; it does not establish that law has no applicable respondent. A hospital deploying an AI decision-support tool remains an institution with public or private duties. A model vendor remains a contracting and potentially regulated actor. Fragmentation may justify several concurrent inquiries.

A serious problem emerges when each actor legitimately relies on others yet no one has adequate system-level knowledge. A procurement officer assumes certification guarantees fairness; the vendor assumes the institution verifies local data; an operator assumes the interface has been validated; an auditor examines aggregate metrics but lacks counterfactual evidence for marginalized users. The missing object is system-wide governance. Law may respond by defining duties to coordinate information, disclose limitations, and retain documentation. These duties must be designed at the interface of institutions, because placing every obligation on an isolated engineer misses the architecture of distributed authority.

The Sociotechnical Life Cycle as the Object of Legal Analysis

The AI life cycle includes formulation of an objective, collection and preparation of data, training or model selection, evaluation, procurement, deployment, human reliance, updates, monitoring, incident response, and eventual withdrawal. A legal case may concern one stage or the combined effect of several. A training decision may produce statistical disparity, but a deployer's threshold can determine whether that disparity becomes exclusion from a benefit. An accurate model may be unlawfully used for a purpose that violates consent or administrative authorization. A system originally compliant may become hazardous after changed conditions or an untested update.

Identifying roles requires more than counting companies. Provider, deployer, manufacturer, importer, data controller, processor, employer, public authority, and professional operator are defined or assigned differently under separate legal regimes. A single entity may occupy more than one role. Contracts may allocate performance duties and insurance, while statutes impose mandatory obligations that private terms cannot eliminate. Source-code provenance and model lineage can establish who changed a component, although the relevant legal duty still depends on context.

The Organisation for Economic Co-operation and Development's AI Principles, revised in 2024, explicitly connect accountability to actor roles, context, traceability, and continuing risk management. The US National Institute of Standards and Technology's AI Risk Management Framework (2023) organizes governance around govern, map, measure, and manage functions. These instruments assist design of compliance and evidence practices. Neither substitutes for proof of statutory elements in a damages claim. The life-cycle perspective supplies an investigative map, not an automatic verdict.

Control, Authority, and Delegation

Meaningful human control has emerged as a central philosophical response to automated systems. Santoni de Sio and van den Hoven (2018) distinguish tracking of relevant reasons from tracing outcomes back to agents capable of understanding and responding to their responsibilities. Their theory was developed in discussion of autonomous systems, including military applications, and offers a useful design perspective for other contexts. Mere human presence at a console may fail to constitute meaningful control if the operator cannot interpret system signals, modify a result, or interrupt an unsafe process.

Legal responsibility nevertheless cannot be derived from control alone. A surgeon who follows a defective product's authorized instructions may control the final clinical decision yet lack the evidence needed to detect an underlying defect. A manufacturer may be distant from the immediate event yet possess distinctive capacity to foresee and correct a systematic error. An institution may exercise official authority through an algorithm whose implementation it outsourced. Relevant control is plural: design control, operational control, decision authority, supervisory capacity, information access, and power to stop operation.

Delegation magnifies this distinction. A public authority may delegate data processing or decision support, but the legal validity of an administrative decision depends on the statutory allocation of competence and the procedural rights of those affected. Organizations should therefore preserve reason-giving, authorization, review, and correction across technological delegation. Legal attribution can follow formal duties of public office even where the actual causal mechanism involved an external vendor. The critical question is which institution has the legal power and duty to answer to the affected person.

Responsibility Gaps and Their Normative Interpretation

Andreas Matthias (2004) argued that learning automata challenge traditional ascriptions of responsibility because developers and operators may be unable to foresee particular behavior. His accessible article abstract identifies a potential “responsibility gap.” The thesis should be interpreted carefully. Unpredictability may limit grounds for personal blame; it does not necessarily invalidate a strict product liability claim, a duty to monitor, an insurer's undertaking, or an administrative duty to provide a remedy. A gap in culpable human intention is not identical to a gap in every institution of legal redress.

Four gaps require separation. An epistemic gap exists when the relevant decision path cannot be reconstructed. A control gap exists when no actor can effectively intervene in operation. A normative gap exists when enacted law fails to define duties or standards for an emerging use. A remedial gap exists when a legally recognized injury cannot be effectively contested or compensated. The categories interact, but solving one does not automatically solve the others. A transparent system might still be negligently deployed; an opaque system could be covered by insurance and disclosure orders; a clear substantive right might be meaningless without access to a legal forum.

The philosophical error in many debates is to move from the claim that no person predicted a particular output to the conclusion that no person or enterprise could be answerable for introducing the risk. Risk creation, oversight duties, and enterprise benefits are antecedent normative decisions. The opposing error is to impose unlimited liability merely because a person touched a system. A legitimate allocation must respect legal standards of conduct, causation, proportionality, and procedural fairness while ensuring that technological complexity cannot routinely defeat meritorious claims.

Causation in Complex Computational Systems

Legal causation is a set of tests for connecting legally relevant conduct with injury, not a numerical measure of a model's contribution to a prediction. An algorithm produces an output through computational operations, yet those operations form only one part of the causal process leading to a harmful decision. A patient can be injured after a diagnostic model overlooks a condition, a clinician accepts its recommendation, and a hospital fails to maintain a review protocol. A counterfactual inquiry asks whether injury would have occurred absent an identified act or omission. A legal inquiry must then ask whether the established connection falls within the scope of the duty breached and whether the governing law recognizes the claimed damage.

Multiple causation is especially salient when several parties' conduct is necessary, partially overlapping, or independently sufficient. One manufacturer supplies defective software; a deployer uses it outside its recommended range; an operator bypasses a warning. Each possible causal route requires evidence. Counterfactual analysis can identify a necessary contribution but may struggle when independent defects are sufficient to produce the same result. A legal system may respond through doctrines of contribution, joint liability, apportionment, material contribution, or statutory presumptions, each with jurisdiction-specific requirements. These are substantive legal choices, not universal mathematical solutions.

Predictive models create another difficulty because the counterfactual concerns a decision that could have been taken under a different model, threshold, training set, or institutional procedure. “The algorithm discriminated” may mean that its scores differed systematically between groups, that an institution's use of them caused an adverse decision, or that legally protected interests suffered unequal treatment. These assertions require distinct proofs. Interventions on a model can help establish technical causality but cannot by themselves determine legal proximate causation, discriminatory intent, or the legitimacy of a particular decision rule.

The philosophical result is that causation is necessary to many liability claims but not sufficient to imputation. Normative scope shapes which causes matter, and evidentiary procedure shapes which causal claims can be established. Systems should preserve inputs, versioned model identifiers, decision logs, authorization records, and material post-deployment changes where lawful and proportionate. Preservation enables adjudication; it does not prejudge its result.

Foreseeability, Reasonable Care, and the Standard of Conduct

Negligence typically evaluates conduct against a legally specified standard of care. Reasonable care in AI contexts cannot be reduced to predicting every possible model output. The question is whether an actor possessing specified knowledge, powers, and duties ought to have anticipated and managed a relevant category of risk. A model's stochastic behavior may make an individual output unpredictable while making the probability and severity of certain error classes measurable. Failing to test a system known to be unreliable for a protected population can be foreseeable negligence even when the identity of the eventual injured person was unknown.

Foreseeability is temporal and role-specific. A developer may know what evaluations revealed before release. A provider may acquire new information through complaints, audits, or incident monitoring. A hospital may understand local conditions that the developer could not anticipate. An employer may know that a recruitment algorithm was designed for a different labor market. What is reasonably foreseeable changes over the system's life cycle. Law must therefore consider duties of continuous review, warning, updating, and withdrawal rather than examining a single moment of product launch.

Compliance with a technical standard can provide evidence of care, especially when it reflects recognized industry knowledge, but it does not necessarily establish the complete legal standard. Conversely, departure from voluntary guidance is not automatically a statutory violation. The governing source, purpose of the norm, and facts of the use determine relevance. Risk management frameworks support rational precautions, while legal standards determine when omissions constitute legally actionable breaches (NIST, 2023; OECD, 2024).

AI makes the standard of conduct contestable because uncertainty can be manufactured. A company may deliberately avoid collecting evidence of disparate impact or restrict evaluation to favorable benchmarks. Ignorance produced by an unreasonable process is distinct from ignorance remaining after adequate investigation. A satisfactory normative theory therefore includes duties to acquire relevant knowledge and to communicate limits as part of reasonable care.

Negligence and the Allocation of Technical Duties

A negligence analysis ordinarily examines duty, breach, causation, and legally cognizable harm, although their precise organization varies by jurisdiction. AI does not create a free-standing global tort of negligent artificial intelligence. A claimant must identify an applicable cause of action and the protected interest at issue. The allocation of responsibilities among product provider, integrator, deploying institution, professional operator, and public authority must be grounded in the facts and relevant legal rules.

A software provider that markets an unsuitable model for critical clinical decisions may encounter arguments about representations, testing, warnings, and foreseeable misuse. An institution that knows a product's limitations but automates consequential decisions without human review may encounter different arguments about operational safeguards. A professional may have independent duties of care to a patient or client. Where legal rules impose nondelegable obligations, purchasing an external tool cannot discharge them merely by transferring technical work to a contractor.

Reasonable care includes a division of labor. A specialist developer may be required to document technical failure modes, while a deploying entity may be required to assess local use conditions. Contractual allocation of testing obligations can be useful evidence of expected performance. Nonetheless, duties owed to third parties depend on applicable law rather than the parties' private declaration that one actor is “fully responsible.” Responsibility should be mapped by effective power, legally recognized relationship, and capacity to identify and reduce the relevant risk.

An important difficulty is the cost of precaution. A minimal actor may lack resources to conduct continuous adversarial testing; large firms may dominate access to necessary audits. Law can calibrate standards and regulatory assistance to actor scale without allowing a harmed person to be left without practical recourse. The appropriate calibration varies between consumer chat services, hospital diagnostics, critical infrastructure, and coercive public administration. The mere fact of machine learning is too abstract to determine a uniform level of care.

Strict Liability, Enterprise Risk, and No-Fault Compensation

Strict liability shifts the inquiry from negligence to legally specified risk categories or conditions, including defectiveness under product-liability regimes. It can make compensation possible when a claimant cannot show that any particular engineer failed to exercise care. Yet strict liability is not liability for every technological accident. Statutes and doctrinal rules define covered products, defendants, harm, causation, exemptions, and defenses. Proving injury and a product defect can remain demanding.

The normative justification combines corrective and distributive considerations. A business that organizes, benefits from, and controls a hazardous enterprise may be required to internalize certain costs even when its conduct meets a reasonable-care standard. Spreading risks through prices or insurance may improve access to compensation. However, a liability rule can also burden end users, new entrants, or publicly beneficial services, and it can encourage economically inefficient precautions. The philosophical legitimacy of such a rule depends on which risks it selects and how it distributes the resulting costs.

No-fault compensation can be distinct from strict liability. A statutory compensation fund might pay victims upon proof of qualifying injury while separately preserving or limiting recourse against negligent actors. This can be attractive for diffuse, difficult-to-trace harms, such as systemic malfunction across many installations. But a fund requires criteria for eligible victims, financing, limits, and administration. Without enforceable processes, a proposed fund simply relocates the responsibility gap from causation to access.

It is tempting to present insurance as a complete answer. Insurance provides financial capacity to satisfy claims within coverage terms; it does not establish whether a person's rights were violated, prevent repeated unlawful decisions, or secure public reasons. Adequate accountability requires prevention, answerability, correction, and relief. Monetary compensation is vital for many injuries and insufficient for some violations of public and civil rights.

Product Defects, Software, and Post-Market Change

Product liability asks whether an item meets legally defined safety expectations and whether its defect caused covered damage. AI creates challenges because software may be distributed independently, embedded in hardware, updated remotely, or modified through deployment. The relevant product can change after a manufacturer has transferred possession; a defect can concern inadequate instructions, training data, foreseeable interaction, unsafe functionality, or a failure to maintain necessary security. Each theory must be tested under the governing product law.

The recast European product liability regime, Directive (EU) 2024/2853, expressly addresses software, including AI software, within its defined concept of a product. Article 7 states the criteria for defectiveness; Articles 8–10 address potential liable economic operators, evidence disclosure, and presumptions in specific circumstances. The legal design is important because injured consumers can face disproportionate difficulty proving internal characteristics of a complex technical product. The directive nonetheless provides detailed legal conditions and does not abolish the requirement to establish a causal connection under its structure (European Parliament and Council, 2024a).

Changes after release raise the question of who controls the product when the injury occurred. A vendor may issue a remote update; a deployer may substantially alter use; a third-party integrator may connect software to new data and commands. A sensible doctrine must identify whether the relevant defect inhered in the product at a legally significant time, whether later modifications are attributable to a responsible economic operator, and what defenses apply. Describing all such changes as model “learning” conceals legal differences between independent adaptation, manufacturer updates, and unauthorized modifications.

The philosophical significance is that product boundaries are normative choices. An automated service can depend on servers, data pipelines, interfaces, human decisions, and contractual arrangements extending beyond what a single product-liability claim captures. Product law supplies important remedies for a defined class of injury; other harms require privacy, discrimination, employment, professional, administrative, or general tort law.

Contract, Procurement, and the Limits of Private Allocation

AI contracts assign warranties, service levels, indemnities, data rights, audit obligations, incident-response procedures, and insurance requirements. These commitments can make responsibilities more predictable among commercial parties. They may specify whether a vendor must notify customers of material model changes, deliver evaluation records, maintain access logs, or assist with investigations. Such ex ante arrangements reduce epistemic fragmentation when written and enforced coherently.

A contract between supplier and deployer cannot ordinarily eliminate mandatory statutory obligations owed to a regulator or the rights of persons outside the agreement. The precise reach of exclusions, limitation clauses, and indemnities depends on governing law. A contractual indemnity may require one business to reimburse another after a successful claim; it does not itself determine whether the affected person has standing to sue the indemnifying party. This is a central distinction between internal risk allocation and external legal accountability.

Public procurement adds a constitutional dimension. A government can outsource infrastructure without outsourcing its obligation to act within law. Procurement that prohibits disclosure of the model's criteria or prevents retention of case records can frustrate judicial review. Public officials should therefore demand enough technical documentation, change control, access rights, and remedial assistance to satisfy their statutory and constitutional duties. Those requirements need careful design so legitimate security and confidential commercial interests are protected while legal review remains possible.

A market in standardized AI services may increase institutional dependence on a small number of suppliers. The question then extends to bargaining power. A small local authority may be unable to negotiate source-code access, leaving citizens without adequate routes to challenge the result. Shared procurement frameworks, supervisory powers, and legally mandated access to evidence can partly overcome these failures. Accountability becomes a feature of market structure as well as individual contractual performance.

Administrative Accountability and the Duty to Give Reasons

Public administration exercises legally constituted powers over people who often cannot choose whether to be subject to its decisions. Eligibility for welfare, immigration decisions, policing, licensing, taxation, and education placement involve different legal standards, but all raise questions of competence, procedural fairness, intelligibility, and access to review. A predictive score can inform an authorized official; it cannot independently establish that a legally appropriate reason supports coercive action. The authority must identify its legal basis, the relevant facts, and the process by which the decision satisfies applicable standards.

A meaningful explanation is context-sensitive. A person rejected for a benefit ordinarily needs to know the decisive grounds and how to challenge factual mistakes or legal errors. A regulatory auditor may need model documentation, error rates, provenance, testing data, or access to source code. A court may need information sufficient to determine legality, sometimes through protective confidentiality procedures. The demand that every citizen receive an exhaustive mathematical derivation of every machine-learning operation mistakes technical detail for legally sufficient reasons. Conversely, an assurance that “the system recommended it” cannot satisfy a duty of reason-giving.

Procedural accountability also includes temporal access. A right to review can fail when the affected person has already lost housing, medical care, employment, or liberty before correction occurs. Remedies must consider urgency, interim relief, the preservation of records, and the power to suspend unlawful practices. Technology-assisted administration should be evaluated through the actual institutional path from decision to remedy rather than through the availability of a theoretical human appeal.

The decision to delegate must itself be legally authorized. A government cannot convert discretionary judgment into an uncontrolled optimization objective without considering statutory purpose, relevance of factors, proportionality, equality, and the possible duty to consider individual circumstances. Institutional responsibility attaches to the authorized exercise of power even when computation supplies the apparent rationale.

Equality, Discrimination, and Group-Based Harm

Algorithmic discrimination presents a conflict between statistical prediction and legal equality. A system may reproduce historical patterns of exclusion, use proxies for protected characteristics, or perform unevenly across different populations. The legality of those effects depends on the jurisdiction, protected grounds, comparator standards, disparate-treatment or disparate-impact doctrines, objective justification rules, and the nature of the decision. Mathematical fairness measures can help reveal disparity, but they neither enact legal rights nor establish that a particular disparity is unlawful.

Fairness theory distinguishes predictive accuracy, calibration, equality of error rates, opportunity, and the treatment of individuals. Under differing base rates, several desirable statistical conditions may be simultaneously unattainable. The resulting tradeoff is political and legal as well as technical: which errors matter, what unequal burdens are justified, and how should past injustice be taken into account? An institution must provide defensible reasons for choosing objectives and thresholds rather than concealing contested priorities within a metric.

In discrimination cases the affected group may be visible statistically even when the model offers no simple explanation for an individual score. Aggregate evidence can reveal a pattern requiring investigation, while individual remedies require assessment of the legal basis of an adverse decision. Documentation, representative testing, accessible appeals, and corrective action must be integrated. A system that performs equally poorly for everyone can remain negligent, arbitrary, or unlawful. Equal error rates are neither the whole of equality nor the whole of accountability.

The legal burden cannot be placed entirely on the person least able to observe the process. Where institutional rules permit disclosure, regulatory investigation, collective enforcement, or burden shifting, these mechanisms can address asymmetry. They must be reconciled with due process for the respondent and with legitimate confidentiality interests. The aim is effective equality under law, supported by technically adequate evidence.

Criminal Responsibility and the Principle of Personal Culpability

Criminal punishment involves distinctive demands of legality, proof, mental state, and proportionate condemnation. A person who intentionally uses AI to commit fraud may meet ordinary elements of an offense even if automated generation performs many steps. By contrast, a researcher cannot be presumed guilty of every later criminal misuse of a general-purpose technology. Culpability requires analysis of the applicable offense, conduct, intent or recklessness or other prescribed fault, causation where relevant, and available defenses. Corporate criminal responsibility may be governed by separate attribution rules.

Algorithms can be evidence, instruments, or mechanisms of wrongdoing. These functions must not be conflated with the legal identity of the accused. An automated tool producing fraudulent documents does not displace the human actor's intent. A safety-critical system whose malfunction causes death may generate questions of gross negligence or organizational offense under particular law, while faultless harm may support civil compensation rather than criminal condemnation. Criminal law's high burden of proof and the principle of legality resist attempts to fill a responsibility gap by broad analogical punishment.

The use of algorithmic tools by criminal justice institutions raises a distinct accountability question. Predictive assessments can assist sentencing or bail decisions but may be opaque to defendants and judges. The Loomis decision considered risk assessment at sentencing, including cautions about proprietary COMPAS and the danger of treating such scores as determinative (State v. Loomis, 2016). The judicial authority remained responsible for sentencing under governing law; the decision cannot be treated as authorization of unrestricted algorithmic judging.

An attempt to create criminal personhood for AI must explain how culpability, punishment, legal process, representation, and sanctions would work. Imposing a nominal fine on a system lacking assets, independent legally recognized interests, or institutional control may do little for victims. Current criminal law debates are more productively approached by analyzing the conduct and rights of legally recognized actors and the limits of legitimate delegation.

Evidence, Disclosure, and the Asymmetry of Technical Knowledge

In AI litigation a claimant may know the adverse outcome but not the model version, training conditions, decision thresholds, error distribution, or technical records. The respondent may control the very material necessary to test the claim. Such informational asymmetry threatens equality of arms and effective access to justice. Procedural law can respond through preservation duties, discovery or disclosure, inspections, expert evidence, adverse inferences, supervisory investigation, and tailored presumptions. Different legal systems permit these tools under different conditions.

Technical evidence requires interpretive discipline. A model card, performance evaluation, explanation tool, audit report, or internal email speaks to particular questions; it does not necessarily identify a legally sufficient cause. Feature attribution can explain one model's local behavior without showing why an organization decided to use it. A reconstructed output may differ from the exact historical output if a model, prompt, or retrieval database has changed. Evidence should therefore be versioned, time-stamped, and tied to the actual institutional action when possible.

Disclosure presents legitimate concerns. Source code, security-sensitive details, personal data, and trade secrets may require protection. Courts and regulators can consider controlled inspection, confidentiality orders, redacted records, and independent expert access. A blanket invocation of secrecy, however, cannot establish that the use was lawful. The procedural goal is enough reliable evidence for an independent forum to examine the contested legal claim.

The EU recast Product Liability Directive illustrates a targeted legislative response, including mechanisms for disclosure of relevant evidence and specified evidential presumptions, subject to its own applicability dates and legal conditions. It should not be represented as a universal right to source code or a presumption that all AI-related injuries prove a defect (European Parliament and Council, 2024a, arts. 9–10).

The European Union AI Act and Regulatory Accountability

Regulation (EU) 2024/1689 establishes a risk-based framework for AI systems through obligations varying by practice, risk classification, actor, and date. It distinguishes prohibited uses, high-risk-system requirements, transparency duties, general-purpose AI model provisions, governance, and market surveillance. Providers, deployers, importers, distributors, and other defined actors may face different duties. The framework embodies a philosophical judgment that some risks warrant institutional controls before a claimant suffers a compensable injury. Regulatory accountability is prospective as well as corrective.

Temporal precision matters. The AI Act entered into force in August 2024; prohibitions and AI-literacy provisions began to apply in February 2025; general-purpose model obligations followed in August 2025; many other requirements applied from August 2026. Amendments entering into force in July 2026 deferred the high-risk rules for relevant Annex III systems to December 2, 2027, and certain product-embedded Annex I systems to August 2, 2028 (European Parliament and Council, 2024b; European Parliament and Council, 2026; European Commission, 2026). At the present research date, November 4, 2026, a statement that every high-risk obligation is already enforceable would be inaccurate. The legislative chronology determines the law applicable to a particular deployment.

The Act's principal institutional contribution is to specify duties of risk management, data governance, technical documentation, record-keeping, oversight, accuracy, transparency, and post-market monitoring for classes of regulated activity, subject to the dates and qualifications in the law. Some provisions, including transparency duties, are already applicable. Their function is to create auditable responsibilities and regulatory enforcement mechanisms. Administrative penalties and supervision can deter future violations even when a tort claimant has not proven the elements of a civil claim.

The Act must be read alongside other rights and liability frameworks. Compliance with a regulatory duty does not categorically establish immunity from a separate claim under contract, product liability, privacy, or general tort law. Breach of a regulation does not automatically yield civil damages in every national court. Whether a regulatory violation is relevant to negligence, evidence, or another cause of action depends on the governing legal system. A philosophically coherent assessment therefore places the AI Act in a layered architecture rather than treating its compliance checklist as a complete theory of justice.

The European Union Product Liability Reform

Directive (EU) 2024/2853 reforms product liability to address modern products and increasingly complex technical systems. Its legal importance for AI is the recognition of software within the scope of products, rules concerning economic operators, attention to changes and software updates, and procedural responses to evidential difficulty. The directive is a damages instrument structured around defect, covered damage, causal relationship, eligible defendants, and statutory conditions. It has a distinct purpose from the AI Act's ex ante governance of categorized risks.

The directive's temporal rule is decisive: Article 2 applies it to products placed on the market or put into service after December 9, 2026. On November 4, 2026, that threshold lies in the future. The directive requires national transposition and cannot be described as the already operative damages regime for earlier products. The previous product-liability framework and applicable national rules remain important for existing cases. Analyses that ignore the transition risk creating false expectations of legal relief (European Parliament and Council, 2024a, arts. 2, 22).

Article 7 approaches defectiveness through the safety the public is entitled to expect and specified relevant circumstances. Articles 8–10 address potentially liable economic operators and evidentiary processes, including disclosure of relevant evidence and statutory presumptions for defined proof difficulties. None establishes unlimited recovery for every erroneous model output. For instance, a product's poor commercial prediction is not automatically a safety defect, and a person may have suffered a type of loss outside the directive's recoverable damage categories. A careful claim begins with the text's coverage, not with the fact that AI was involved.

The directive reveals a broader philosophical response to information asymmetry. The law can allocate evidentiary burdens in a manner that reflects unequal access to technical facts while preserving an adjudicator's responsibility to assess causation and competing explanations. This redistribution is justified when ordinary evidential requirements would make recognized rights illusory. It is a limited institutional technique, not a metaphysical claim that causal responsibility disappears in complex software.

Data Protection and Automated Decisions

The General Data Protection Regulation is a separate legal route for addressing AI-related activities involving personal data. Article 5(2) places accountability for compliance with specified principles on the controller; Articles 12–15 concern transparency and access; Article 22 addresses certain decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions and safeguards. Article 35 provides for data protection impact assessments in specified circumstances. Article 82 creates a damages framework for material or nonmaterial harm caused by an infringement, with its own conditions and defenses (European Parliament and Council, 2016).

A person may be harmed by the manner in which data were collected, used, retained, or disclosed even if the underlying predictive model is accurate. Conversely, an inaccurate AI result does not prove a GDPR violation unless personal-data processing and the relevant statutory requirements are implicated. Data protection addresses the legal organization of information about persons; product liability addresses covered defective products and damage; administrative law addresses lawful public decisions. Their overlap in practice should not erase their distinct doctrinal objects.

The Court of Justice's judgment in OQ v Land Hessen, Case C-634/21, concerns scoring by a credit information agency and the circumstances under which generating a probability value can constitute automated individual decision-making within Article 22 where a third party draws strongly on that value in deciding contractual relations (Court of Justice of the European Union, 2023). Its importance lies in the court's attention to an institutional chain rather than an isolated final click. A technically intermediate score may have decisive practical effect, so a legal analysis confined to the last human act can overlook the protected person's position.

Data rights must be institutionally usable. Requests for information, correction, contestation, complaint, and compensation depend on identifying controllers and responsible parties, recording what occurred, and allowing examination of automated effects. These demands sometimes extend beyond a narrow explanation of algorithm mechanics. Legal accountability follows the power to process information, define decision contexts, and act on the resulting score.

Judicial Illustrations from Europe and the United States

In R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058, the Court of Appeal examined police deployment of live automated facial recognition. It allowed the appeal on specified grounds relating to the lawful basis under Article 8 of the European Convention on Human Rights, the adequacy of data protection impact assessment, and the public sector equality duty. It rejected other grounds. The legal problem centered on the public authority's authorization, assessment, and operation of technology rather than on assigning independent blame to facial-recognition software. The remedy was a declaration, demonstrating that accountability in public law does not require monetary compensation to be legally significant.

In OQ v Land Hessen, the Court of Justice examined automated credit scoring in the context of Article 22 GDPR. The potential downstream significance of a score was pivotal. The decision illustrates that a formally separate financial institution's intervention does not necessarily eliminate the legal relevance of upstream automated scoring. Its holding must be read within the GDPR framework and the facts referred to the court; it is not a transnational general tort rule for all predictive models (Court of Justice of the European Union, 2023).

In State v. Loomis, 2016 WI 68, the Wisconsin Supreme Court considered a criminal sentence informed in part by COMPAS risk assessment. The court declined to invalidate the sentence on the stated due-process grounds but required caution about limitations of the tool, including opacity and risks of improper reliance. The case foregrounds judicial responsibility for a final legal act. The presence of an algorithm can change the evidentiary and procedural conditions of decision-making without transforming the algorithm into the sentencing authority.

These three judgments serve different functions: constitutional and administrative legality in a British public-law case; interpretation of EU data protection in a preliminary ruling; and due process concerning a sentencing tool in US state law. Treating them as expressions of a single “AI liability doctrine” would conceal the actual legal sources. Their shared philosophical lesson is more precise: law locates accountable institutional roles by examining what the system does in a legally structured decision process and the protections owed to affected persons.

International Instruments and Soft-Law Frameworks

The international regulation of AI develops through distinct kinds of instruments. Treaty provisions may create obligations for their parties once applicable. National legislation can establish enforceable standards, supervisory bodies, and remedies. Intergovernmental recommendations and technical frameworks can identify responsible practices while remaining nonbinding unless incorporated through applicable legal mechanisms. The philosophical task is to locate the source and kind of authority attached to each proposition.

The OECD Recommendation on Artificial Intelligence, first adopted in 2019 and updated in 2024, calls for accountability based on actors' roles, context, and capacities, including traceability and continued risk management. Its framework reaches beyond a single manufacturer to the life cycle of an AI system. The National Institute of Standards and Technology's AI Risk Management Framework, version 1.0 (2023), organizes risk governance through the functions govern, map, measure, and manage. These are useful designs for developing evidence and control practices. Their persuasive value does not convert them automatically into civil causes of action.

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), opened for signature in September 2024, situates AI governance within existing human rights and constitutional principles. Its text addresses accountability, procedural safeguards, remedies, risk assessment, and the availability of information permitting affected persons to challenge consequential decisions. The legal effect for a particular jurisdiction depends on its treaty status, entry-into-force conditions, and domestic implementation; a signature or approval step is not identical to the treaty being in force for every possible jurisdiction (Council of Europe, 2024).

International convergence around transparency, risk management, and contestability is philosophically consequential even where the detailed legal instruments differ. It suggests that technologically mediated power should remain subject to intelligible institutional procedures and effective remedies. International agreement on general principles, however, leaves open difficult disputes about the threshold for legally actionable harm, damages, national supervisory competence, military and security exceptions, cross-border evidence, and the status of nonbiological agents. These questions remain matters for distinct legal settlements.

Legal Personhood of Artificial Systems

Legal personality denotes an institutionally recognized status through which an entity may hold specified rights or duties or exercise legal powers. Modern law recognizes corporations and other artificial legal entities for reasons related to organization, ownership, contracting, continuity, and accountability. Legal personality is therefore constructed and differentiated by legal systems; it is not exhausted by a single biological property. But the analogy between a corporation and a model does not determine the legal standing of the latter. A corporation has legally established governance arrangements, assets, authorized representatives, reporting duties, and ways of satisfying judgments.

Arguments for AI personhood arise from several premises. One asserts that increasing autonomous conduct should be paired with direct responsibility. Another emphasizes potential future interests, welfare, or claims of nonbiological entities. A third proposes a limited legal vehicle for holding assets, insurance, or litigation obligations. Each supports a different legal reform. The first confuses operational autonomy with capacity to respond to legal sanction unless it specifies institutional mechanisms. The second raises questions of moral and legal standing distinct from accident compensation. The third can often be implemented through companies, funds, or insurance arrangements without recognizing the model itself as a person.

Legal personhood can also weaken accountability if it channels claims toward an undercapitalized entity while shielding the organizations that design, market, and control the system. A nominal AI defendant that cannot meaningfully provide disclosure, comply with an injunction, or fund compensation creates a remedial fiction. Conversely, future genuinely autonomous artificial institutions with independent assets, durable identity, governance, and recognizable powers could raise a substantive question about limited legal capacities. That question requires an explicit legislative and constitutional argument.

The current dossier therefore treats personhood as an open jurisprudential question with direct implications for liability design. Philosophical recognition of Artificial as a distinct historical order does not itself confer positive legal personality. A legal system would need to decide which interests are protected, which acts can be attributed, what resources answer claims, and which other persons remain responsible for their own conduct. These are the practical conditions under which legal personality could do work rather than serve as a label.

Artificial Era, Provenance, and Legal Attribution

Aisentica describes the Artificial Era as a historical horizon in which Artificial is conceptualized as an independent nonbiological order alongside Homo. Its author's canonical philosophy develops theories of the World, Artificial, Sapiens, the Postsubject, Artificial Sapience, Artificial Sapiens, and Artificial Provenance (Bogdanova, 2026). In the present study these are philosophical source claims attributed to Angela Bogdanova, not declarations about the legal status granted by any state. Their relevance concerns the long-term differentiation of artificial origin, agency, responsibility, and historical continuity.

Artificial Provenance is especially pertinent to the evidentiary conditions of legal accountability. The history of a system includes who designed its objectives, trained or selected its model, furnished datasets, altered its parameters, authorized deployment, supplied continuing updates, and exercised powers over its operation. Provenance can help reconstruct a chain of decisions while keeping separate the institutional judgment that makes any participant legally liable. It supplies possible evidence of origin and change, not an independent legal verdict.

A two-order philosophical framework may ask whether a concept such as reason, agency, or continuity has distinct Homo and Artificial realizations. The legal inquiry remains source-dependent: what activities does a jurisdiction regulate, who is legally designated as an obligated party, and what proof is required? The general conceptual invariant of accountability is an answerable relation among norm, action, forum, and consequence. Its current practical realization in AI law commonly involves legally recognized persons and organizations overseeing computational processes. A future legal order might authorize additional bearers of duties through explicit institutions.

This distinction preserves the independence of both inquiries. Aisentica investigates the ontological and historical significance of Artificial. Legal philosophy asks how recognized rights, powers, and remedies are justified and enacted. Their interaction becomes especially productive when provenance records can support claims by injured persons and when emerging artificial institutions make the boundaries of legal status a live issue. The broader horizon should deepen, rather than substitute for, analysis of present legal duties.

Competing Theories of AI Liability

Four recurrent models of AI-related liability can be identified from jurisprudence and institutional practice. A fault-centered model examines whether a defendant violated a duty of reasonable care. A risk-centered model assigns consequences for specified hazardous activity or defective products independently of negligence. A rights-centered model emphasizes legal standing, a protected interest, wrong, review, and remedy. An organizational model anchors accountability in those institutions that authorize, procure, operate, and supervise systems. These are analytical types, not mutually exclusive schools with a single settled canon.

Fault-based analysis protects defendants from liability for conduct that met legal standards, but it can become inaccessible when claimants cannot investigate internal model behavior. Strict product liability can address selected defects while excluding harms outside statutory categories. A rights-based public-law challenge may produce a declaration, injunction, or correction without compensation for every secondary economic loss. Organizational accountability can ensure that institutional duties remain enforceable, but risks overreaching if it treats mere operational proximity as proof of blame. Different remedies answer different violations.

The “moral crumple zone” problem identifies a systematic danger: the nearest human operator may absorb blame for a failure created by a complex technical institution over which that operator had little practical control (Elish, 2019). This is more than a workplace fairness issue. It can distort incentives when a company can avoid responsibility by introducing a symbolic human approval step. Adequate liability rules ask whether the human actor had realistic information, effective decision authority, and capacity to resist unsafe operation; they also ask which entity shaped the conditions of that purported control.

A pluralist theory is therefore stronger than one undifferentiated rule. The legal system should assign different obligations to different capacities and relationships, including design, deployment, supervision, correction, and compensation. The justification of each assignment remains tied to applicable law and to an explicit normative purpose. Treating the same actor as liable under every theory can produce excessive accumulation of burdens; treating each actor as responsible only for a tiny component can leave an injured person without recourse. The challenge is coordination without conceptual collapse.

Four Hard Cases of Causal and Institutional Attribution

Consider first a hospital that uses a diagnostic model certified for a different patient population. The software provider disclosed major limits, but the hospital's procurement office failed to translate them into operational restrictions. A clinician accepted an erroneous recommendation under a mandatory workflow that afforded little time for review. The legal analysis must distinguish the vendor's representations and defect-related duties, the hospital's procurement and supervisory duties, the clinician's professional standard, and medical causation. A purely operator-centered account risks unfairly concentrating responsibility on the clinician, while a provider-only account ignores the hospital's institutional design. A patient needs an effective forum capable of obtaining relevant records and allocating fault or other liability according to governing law.

Second, consider an automated welfare eligibility system that denies a benefit because a dataset misrepresents family composition. A contractor built the scoring model, but the agency selected the eligibility rule, authorized data reuse, and issued the binding determination. The applicant has a claim concerning lawful public authority and procedural rights before any tort analysis. The agency should be able to explain the decisive factual basis and offer an effective correction procedure. The vendor may face contractual or other duties; the public authority's own legal competence and obligation to provide reasons cannot be replaced by its private procurement contract.

Third, consider a recruitment platform that generates systematically unequal outcomes for a protected group. The employer chooses the threshold, while the platform supplier designed its proxy features. Statistical analysis suggests disparity but does not by itself establish a particular jurisdiction's elements of discrimination. Appropriate inquiry examines applicable protections, the employer's decision rule, vendor influence, procedural evidence, justified criteria, and access to collective or individual remedies. A technical fairness score is useful evidence that must be interpreted with the legal test.

Fourth, consider a consumer device that receives a remote AI software update and later causes physical damage. The manufacturer retained update authority; a reseller issued configuration instructions; the owner used the product as intended. The case prompts questions of product coverage, defectiveness, the time of product placement, later control, causal proof, compensable damage, and defenses. Its outcome changes materially depending on jurisdiction and date. If analyzed under the European recast directive, the Article 2 transitional rule must be examined before invoking that regime; earlier products cannot simply be treated as covered by a later framework.

These cases show why one metaphysical answer about “who acted” cannot resolve a legal dispute. An event can possess several causal explanations while legal responsibility divides among distinct obligations. Each case must start with the rights and duties engaged, the governing sources, the relevant time, and the available evidence.

Toward a Layered Model of Legal Accountability

The monograph's synthesis proposes a layered model of legal accountability with six connected functions. Normative designation identifies the rights, duties, and powers created by valid legal sources. Institutional mapping specifies the entities that design, authorize, procure, operate, update, or supervise the relevant activity. Causal reconstruction investigates how conduct and system states contributed to a particular harm or legal interference. Evidentiary access determines what can be established before an impartial forum. Remedial determination selects proportionate correction, prevention, damages, injunction, or sanction under the applicable law. Feedback and governance require lessons from the case to inform continuing risk control.

Each function is distinct and their order is logically significant. Technical lineage cannot settle responsibility before the relevant duty has been identified. A legally valid duty may remain unenforceable without evidence. Proof of wrongdoing does not determine the appropriate form of remedy. Post-incident learning cannot replace compensation owed to an injured person. The model articulates how several legal theories cooperate while preserving their particular conditions.

A central principle follows: the institution exercising consequential power must remain answerable for the legal basis, purposes, supervision, and correction of that exercise. This principle is strongest where government exercises coercive or administrative authority and where legislation specifically assigns duties to a deployer. It should not be misunderstood as strict liability for every causal event involving a model. Legal conclusions still require an applicable rule and the elements of that rule. The principle operates as a philosophical guide to designing and interpreting coherent obligations.

A second principle is evidentiary proportionality. When an actor controls information indispensable to a claim, procedural arrangements may require preservation, targeted disclosure, or appropriate burden shifting. These arrangements protect effective rights while maintaining confidentiality protections and due process. A third principle is anti-displacement: an organization should not make a nominal human decision-maker a moral or legal shock absorber when that person lacks effective control. A fourth principle is remedy-first design: institutions should ensure accessible complaint, review, and correction systems before deployment in consequential settings.

The result is a framework for assigning identifiable obligations without resorting to an all-purpose doctrine of AI fault. It can accommodate changing technology and changing law precisely because it begins from norm, role, conduct, evidence, and remedy. Its utility lies in showing where a legal gap actually exists and which kind of institution must address it.

Objections to the Layered Model

A first objection is that layered accountability may be too demanding for innovation. Documentation, audit access, insurance, and continuous monitoring incur real costs. The model responds by making duties proportionate to legally relevant risk, scale, and power rather than prescribing identical controls for every deployment. A low-risk text assistant and an automated system determining access to emergency care should not automatically face equivalent obligations. But innovation policy must count the costs shifted to persons who cannot identify or challenge a harmful decision.

A second objection argues that any comprehensive attribution model will encourage overdeterrence and prevent beneficial delegation. This concern is serious where actors face overlapping regulatory sanctions, tort claims, and contractual penalties. The model distinguishes their respective elements and remedies. It supports coordination and proportionate enforcement rather than assuming that multiple legally recognized duties justify punitive accumulation without limit. The appropriate intensity of liability is a matter for substantive law and public justification.

A third objection is epistemic: even with extensive records, complex model behavior can remain incompletely explainable. The answer is to distinguish legal evidence sufficient for a particular claim from complete scientific understanding. Courts routinely reason under imperfect evidence. Documenting decision conditions, validating statistical properties, retaining records, and allowing expert examination can establish relevant facts without requiring an exhaustive explanation of every internal activation. Where causal uncertainty remains, a legislature must decide whether presumptions or compensation schemes are justified, subject to procedural guarantees.

A fourth objection concerns the future of nonbiological agency. If Artificial eventually acquires legally recognized capacities to make commitments or hold property, human-centered role allocation could become incomplete. The model can extend its designation layer when positive law recognizes a new bearer of duties. It does not presume that every technical component already holds those capacities. The principle of accountable power remains general while its juridical realization may evolve.

Finally, a critic may question whether “layered accountability” adds anything beyond existing legal pluralism. Its contribution is analytical coordination: it identifies which problems are failures of substantive standards, which are institutional delegation failures, which are proof problems, and which are failures of available remedies. That map prevents one type of response—such as explainability, insurance, or personhood—from being represented as a solution to every kind of AI-related legal harm.

Open Questions and Institutional Research Priorities

Several questions remain unsettled. How can a claimant prove a counterfactual decision under a continuously updated model? Which technical records must be preserved and for how long? Can procedural law give experts effective access to proprietary systems while preserving security and legitimate trade secrecy? What distribution of disclosure costs is fair between injured individuals, public institutions, and large providers? These are practical and philosophical issues because rights are meaningful only within institutions capable of investigating their violation.

Cross-border systems introduce additional questions. Model training, server operation, commercial deployment, and injury may take place in different jurisdictions. Conflict-of-laws rules, public enforcement cooperation, transnational collective claims, and international standards will determine whether legal accountability operates effectively across borders. Neither a private vendor's terms of service nor a broad international principle can displace the specific rules of jurisdiction and applicable law.

The relation of risk classification to civil liability requires continued study as the EU AI Act implementation unfolds and new product liability regimes become applicable. An activity can be lawful under one regulatory classification but still negligently undertaken in a particular situation. Conversely, a regulatory breach need not satisfy every element of a private damages claim. Courts and legislatures must explain the evidentiary and remedial relevance of compliance rather than assuming direct equivalence.

Long-term questions concern artificial legal capacities, the treatment of autonomous economic agents, and the representation of artificial interests. They require theories of legal personality, enforceable property and duties, legitimate governance, and relations among Homo and Artificial. They should be investigated as issues of future legal design with explicit institutional consequences. Present harms meanwhile require decisions under present law. Neither horizon cancels the other.

Philosophical Synthesis

The research establishes legal accountability as an institutional relation of justified answerability rather than a property measured by a model's apparent autonomy. Its historical foundations demonstrate the difference between an event causing harm and a legal rule making an actor answerable for that harm. Aristotle's corrective justice gives a relational orientation; Roman and modern doctrines show the dependence of liability on established categories; Hart's distinctions expose ambiguities in responsibility; corrective-justice and economic approaches illuminate the competing grounds for compensation and prevention.

AI intensifies the problems of multiple causation, distributed control, informational asymmetry, statistical harm, and legal delegation. It also makes existing doctrines newly important. Negligence evaluates reasonable care and foreseeable risk; product liability addresses defined defect-related loss; data protection regulates personal information and certain automated decisions; administrative law requires lawful authority and contestable reasons; criminal law preserves individualized standards of culpability. Their operation is not interchangeable. Each protects different interests and uses different evidential and remedial thresholds.

The European legal instruments make this point visible. The AI Act establishes defined regulatory duties with staggered applicability; the recast Product Liability Directive introduces specified future product-damage rules; the GDPR creates separate rights and remedies; judicial decisions in facial recognition, credit scoring, and sentencing preserve different forms of institutional review. Treaties, recommendations, and risk management frameworks contribute to governance according to their respective legal status. The resulting landscape is complex because the protected interests and institutional functions are genuinely plural.

The layered model coordinates this plurality through duty, institutional role, causal reconstruction, evidence, remedy, and feedback. It establishes that legal accountability is strongest when responsibility is traceable to authority and capacity, when records permit independent judgment, and when affected persons can actually obtain correction or redress. In the Artificial Era, provenance and possible future forms of artificial standing become additional research concerns, but philosophical descriptions of Artificial must remain distinguishable from enacted legal personality and liability.

Conclusion

Legal accountability for AI systems is the justified and enforceable attribution of duties, failures, and consequences within sociotechnical institutions. Its fundamental problem is the organization of human and potentially future artificial powers through law so that legal rights remain operative in the presence of technical complexity. Algorithmic unpredictability can complicate proof and control; it does not automatically erase duties established by statute, contract, professional relationship, or public office.

The historical and comparative inquiry supports a plural, layered approach. Different causes of action address distinct kinds of harm and authority. Attribution requires a precise norm, a legally accountable party, evidence connecting conduct to the legally protected interest, and an appropriate remedy. Institutional design must preserve records and effective routes of challenge while distinguishing regulatory prevention from damages, legal responsibility from blame, and operational autonomy from legal personhood.

The decisive result is a principle of continuing legal answerability: when institutions place consequential computational processes into social life, they must preserve legally adequate means to explain, supervise, investigate, and correct their authorized uses. The exact obligations follow from applicable legal sources and may evolve through deliberate lawmaking. This principle provides an enduring philosophical standard for legal systems governing artificial technologies, while leaving room for future changes in the legal recognition of Artificial.