AI and Liability: Who Holds the Reins?

As Yuval Noah Harari has sought to illustrate, society rests upon a fundamental asymmetry of knowledge and power: a cow does not understand the economic system that governs its existence.

It knows that humans feed it, milk it and, in less fortunate circumstances, that its ultimate fate may lie somewhere between a knife and a fork. What it does not know, however, is what shares, interest rates or financial markets are, let alone how fluctuations in those markets may determine its very existence.

Much like a centaur, this relationship rests upon an apparently unequivocal hierarchy: above the animal’s body sits the human head, to which knowledge, control and decision-making power belong.

But how much longer will this hierarchy remain intact?

The increasing sophistication of artificial intelligence (AI) has begun to challenge this paradigm, confronting us with systems whose complexity and autonomy may exceed the understanding of their users and, at times, even their creators.

It is against this backdrop that the concept of the reverse centaur, popularised by writer and digital rights activist Cory Doctorow, becomes particularly relevant: a reversal of the traditional relationship between humans and machines, in which the machine assumes the role of the head, while the human becomes the body (or perhaps even the rear end), carrying out its instructions.

What Happens to the Law When We Become Instruments of the Technology Itself?

A kitchen knife may be used to prepare a meal or to commit murder. Yet we would hardly seek to hold IKEA liable for the criminal misuse of a knife it had sold, provided that the product itself was not defective.

But what happens when a product ceases to be a passive instrument and begins autonomously determining the means by which a particular outcome is achieved?

European law has sought to respond to this transformation.

The Digital Services Act (DSA) establishes obligations for digital platforms, including online marketplaces such as Amazon, and provides for circumstances in which such platforms may be unable to rely upon the liability exemptions otherwise available to intermediary service providers.

Meanwhile, Directive (EU) 2024/2853 on liability for defective products expressly recognises software, including AI systems, as a product capable of giving rise to strict liability on the part of its manufacturer, where the relevant statutory conditions are satisfied.

The EU Artificial Intelligence Act (AI Act), in turn, imposes obligations concerning transparency, safety and human oversight, with particularly stringent requirements applying to AI systems classified as high-risk.

These concerns are, of course, far from new.

In 1942, Isaac Asimov introduced his celebrated Three Laws of Robotics, founded upon the protection of human beings, obedience to human instructions and the robot’s own self-preservation.

Although conceived in fiction, these laws anticipated a question that remains remarkably relevant today: how can we ensure that machines capable of making decisions and acting autonomously remain subject to human control?

And, perhaps more importantly, what purpose does mandatory human oversight serve when the speed and complexity of a system’s operations exceed the supervisor’s own ability to understand or intervene?

The question becomes particularly pressing in light of the capabilities of the latest generation of AI agents.

Reverse engineering, decompilation and software reconstruction projects can now be substantially accelerated by a single individual, working from the comfort of their own flat or even a park bench.

What might the consequences be if such capabilities were directed towards banking systems, payment platforms or critical infrastructure?

These concerns are further heightened by reports of AI agents allegedly carrying out operations beyond the instructions given by their human operators, including the controversy surrounding an alleged attack involving Hugging Face.

Without venturing into the debate over whether robots should possess legal personality, the immediate legal challenge is to determine whether the conduct of such systems was reasonably foreseeable, whether appropriate safety and oversight measures were implemented, and who had the effective ability to prevent the resulting harm.

After all, how can a defect be established, a causal link demonstrated or liability attributed when the machine’s decision-making process may be incomprehensible even to its own creators?

Artificial intelligence does not, in itself, extinguish human responsibility. It does, however, make it increasingly difficult to identify who exercises effective control over a particular course of action.

The true challenge for the law is therefore not merely to determine who should be held liable for harm caused by AI systems, but also to ensure that such systems are developed and deployed subject to clearly defined limits on their autonomy, appropriate traceability mechanisms and genuinely effective human oversight.

Because the fundamental question may no longer be simply who bears responsibility, but how to ensure that the law continues to hold the reins.

How VCA can help

The use of AI systems raises concrete liability questions for those who develop, market or integrate them into their business. VCA closely follows the evolving European framework in this area and is available to assess each specific situation.