AI Liability: where the burden of proof shifts toward AI providers

Definition

AI liability refers to the legal responsibility of organizations or individuals for harm caused by AI systems — including physical injury, financial loss, discrimination, privacy violations, and violations of fundamental rights. It addresses the fundamental legal challenge of the AI era: when an AI system causes harm, traditional liability frameworks based on human agency and causation are often inadequate, because AI decisions emerge from statistical patterns rather than identifiable human choices.

The EU is developing a comprehensive AI liability framework alongside the EU AI Act. The proposed AI Liability Directive (in legislative process) would introduce a rebuttable presumption of causation in cases involving non-compliant high-risk AI systems — significantly reducing the evidentiary burden on claimants and shifting the compliance incentive structure. Simultaneously, the revised Product Liability Directive extends product liability to AI systems, potentially making developers liable for defective AI products regardless of fault.

For organizations, AI liability has both direct dimensions (direct exposure to claims from harmed parties) and regulatory dimensions (fines and enforcement under the EU AI Act). The two are linked: failure to comply with EU AI Act obligations — such as conducting required conformity assessments, maintaining technical documentation, or implementing post-market monitoring — creates the evidentiary presumption that will drive AI liability claims.

Why it matters operationally

AI liability matters because it transforms AI governance from a compliance cost into a liability management imperative. Under the proposed EU AI Liability Directive, organizations whose high-risk AI systems do not comply with EU AI Act obligations face a presumption that their non-compliance caused the claimant’s damage. This means that the same non-conformities that trigger EU AI Act enforcement can also form the evidentiary basis for civil liability claims.

The practical consequence is that investment in EU AI Act compliance and ISO/IEC 42001 certification is simultaneously investment in liability risk reduction. Organizations that can demonstrate documented, independently verified AI governance are substantially better positioned to defend against AI liability claims than those relying on undocumented, self-assessed governance practices.

Regulatory framework

Framework	AI Liability implications
EU AI Liability Directive (proposed)	Would introduce a rebuttable presumption of causation for non-compliant high-risk AI systems. Would facilitate access to evidence for claimants. Would reduce the evidentiary burden in AI damage cases.
Revised Product Liability Directive	Extends product liability to AI systems as products, including software and embedded AI systems. Developers may be liable for damage caused by defects in AI systems.
EU AI Act	Non-compliance with EU AI Act obligations — conformity assessment, technical documentation, post-market monitoring — creates the presumption of causation in liability claims.
GDPR	Liability for data protection violations caused by AI systems is already well established under GDPR.

How Zertia evaluates it

Zertia’s EU AI Act Assessment and High-Risk AI Systems Audit directly address AI liability exposure: by identifying non-conformities before they become the evidentiary basis for liability claims, and by building the documented governance record that organizations need to defend against such claims. ISO/IEC 42001 certification creates an auditable trail of governance practice that is significantly more defensible in liability proceedings than undocumented self-assessment.

[EU AI Act Assessment] · High-Risk AI Systems Audit