AI Governance and Liability in Europe

1. Introduction

AI governance and liability concerns the legal rules governing the design, development, procurement, deployment, monitoring, supervision and retirement of artificial-intelligence systems, together with responsibility for harm caused by those systems.

There is no single autonomous European cause of action called “AI governance liability.” Instead, liability is constructed from several overlapping areas of law, including:

the EU AI regulatory framework;

product safety and product liability;

GDPR and data protection;

consumer protection;

contract and tort/delict;

professional negligence;

employment and equality law;

corporate and directors' duties;

cybersecurity;

administrative law;

fundamental rights;

financial-services regulation; and

environmental and sector-specific legislation.

The central legal principle is:

The use of AI does not transfer legal responsibility from the human or organization controlling the system to the algorithm itself.

A governance failure can therefore become the factual foundation for civil, administrative, regulatory or, in appropriate circumstances, personal liability.

2. Meaning of AI Governance

AI governance refers to the institutional framework used to ensure that an AI system is:

lawful;

safe;

reliable;

transparent;

appropriately supervised;

technically controlled;

auditable;

secure;

non-discriminatory;

accountable; and

consistent with the organization's legal obligations.

It covers the entire AI lifecycle:

Design → Data → Development → Testing → Procurement → Deployment → Monitoring → Incident Response → Modification → Retirement

A governance failure at any stage can potentially contribute to liability.

3. Main Forms of AI Governance Failure

Common failures include:

1. Failure to identify AI risks

An organization deploys an AI system without conducting an adequate risk assessment.

2. Inadequate data governance

The system uses:

inaccurate data;

unlawful personal data;

biased datasets;

unauthorized copyrighted material;

outdated information.

3. Inadequate testing

The organization deploys an AI system without sufficient validation.

4. Insufficient human oversight

Employees simply accept AI recommendations without meaningful review.

5. Failure to monitor

The organization fails to identify:

model drift;

systematic errors;

discriminatory outcomes;

security vulnerabilities.

6. Inadequate documentation

The organization cannot demonstrate:

how the system works;

what data it used;

who approved it;

what testing occurred.

7. Failure to report incidents

A serious AI incident is not properly investigated or reported.

8. Improper procurement

An organization purchases an AI system without assessing:

legal compliance;

cybersecurity;

data provenance;

performance;

vendor responsibility.

9. Failure to respond to known problems

Management knows an AI system is producing harmful results but continues using it.

4. AI Governance and the EU AI Act

The EU AI Act is central to European AI governance.

Its approach is substantially risk-based.

Broadly, AI systems may fall into different regulatory categories depending upon their intended purpose and potential risk.

Governance obligations can involve:

risk management;

data and data governance;

technical documentation;

record keeping;

transparency;

human oversight;

accuracy;

robustness;

cybersecurity;

post-market monitoring;

incident reporting.

For high-risk AI systems, governance obligations are particularly significant.

The important legal consequence is that AI governance is increasingly moving from being merely a matter of corporate best practice to being a matter of regulatory compliance.

5. Governance Does Not Equal Liability

A crucial distinction must be maintained.

Governance violation

An organization breaches an AI regulatory requirement.

Civil liability

A person proves a legally recognized cause of action and recoverable damage.

These are not automatically identical.

For example:

A company violates an AI documentation requirement but nobody suffers legally compensable damage.

There may be regulatory consequences without a successful damages action.

Conversely:

An AI system causes personal injury through negligent design.

A civil claim may exist even if the exact regulatory provision relied upon by the claimant does not itself create a private damages action.

6. The Core AI Liability Chain

A useful framework is:

AI system

↓

Responsible actor

↓

Governance duty

↓

Governance failure

↓

AI malfunction or harmful decision

↓

Causation

↓

Damage

↓

Legal remedy

The most difficult stages are usually:

identifying the responsible actor;

proving the governance failure;

proving causation;

obtaining sufficient evidence from an opaque AI system.

7. Who Can Be Responsible?

Potentially responsible actors include:

AI developer

The entity creating the AI model or software.

Provider

The entity placing an AI system on the market or making it available.

Deployer

The organization using the AI system.

Importer/distributor

Relevant where the AI-enabled product enters the European market through supply chains.

Employer

Where AI is used in workplace decisions.

Financial institution

Where AI is used for credit, investment or insurance decisions.

Healthcare organization

Where AI is used for diagnosis or treatment.

Public authority

Where AI is used in governmental decision-making.

Corporate directors

Where directors personally breach their own legal duties.

8. Important European Case Law

European courts have not yet produced a large body of judgments expressly titled “AI governance liability.”

Accordingly, the most reliable approach is to combine:

direct AI/automated-decision authorities; and

established technology, data-protection, product-safety and corporate-governance authorities.

The following cases are particularly important.

Case 1 — SCHUFA Holding AG

CJEU, Case C-634/21, 7 December 2023

Facts and issue

The case concerned automated creditworthiness scoring.

SCHUFA generated a score that could significantly influence whether a third party would enter into a contractual relationship with an individual.

Principle

The CJEU interpreted Article 22 GDPR concerning automated individual decision-making.

The judgment demonstrates that an automated score can have legal significance where it effectively determines another person's decision.

AI governance relevance

Organizations using AI scoring systems need to consider:

how scores are generated;

whether automated processing materially determines decisions;

whether individuals have appropriate safeguards;

whether human intervention is genuinely meaningful.

Liability significance

A company cannot necessarily avoid responsibility by arguing:

“The AI merely produced a score; a human technically made the final decision.”

Importance: One of the strongest European authorities for AI governance involving automated decisions.

Case 2 — Google Spain SL v AEPD and Mario Costeja González

CJEU, Case C-131/12, 13 May 2014

Principle

The CJEU recognized significant legal responsibilities associated with large-scale technological processing of personal information.

The case concerned search engines rather than AI.

Governance relevance

The underlying reasoning is important for AI systems because organizations designing and operating technological information-processing systems may have legal obligations concerning:

personal data;

transparency;

individual rights;

removal or correction;

lawful processing.

AI significance

An organization cannot necessarily characterize itself as merely a passive intermediary where it exercises substantial control over an automated processing system.

Importance: Foundational technology/data-governance authority.

Case 3 — Nowak v Data Protection Commissioner

CJEU, Case C-434/16, 20 December 2017

Principle

The CJEU interpreted the concept of personal data broadly.

Information may constitute personal data where it relates to an identified or identifiable individual.

AI governance relevance

AI systems routinely create or infer information about individuals.

Examples include:

risk scores;

behavioral profiles;

employee assessments;

customer profiles;

predictive classifications.

Organizations therefore need governance mechanisms capable of identifying and controlling personal-data processing.

Liability significance

Incorrect AI-generated profiles can create legal problems where:

inaccurate data are used;

individuals cannot correct information;

automated profiling causes harm;

data are processed without an appropriate legal basis.

Case 4 — Orange România SA v ANSPDCP

CJEU, Case C-61/19, 11 November 2021

Principle

The CJEU emphasized that consent must be:

freely given;

specific;

informed;

unambiguous.

AI governance relevance

AI systems frequently depend on personal information.

Governance must therefore establish:

the legal basis for processing;

what information is collected;

why it is collected;

how it is used;

whether consent is genuinely valid where consent is relied upon.

Example

A company cannot necessarily place a pre-selected acceptance mechanism in a digital interface and then claim that the customer gave informed consent to extensive AI profiling.

Importance: Strong authority concerning AI data-governance processes.

Case 5 — Planet49 GmbH

CJEU, Case C-673/17, 1 October 2019

Principle

Consent must involve an active and informed choice.

Governance relevance

AI businesses frequently combine:

cookies;

tracking;

profiling;

personalization;

targeted advertising;

recommendation systems.

A governance framework must distinguish between:

technical ability to collect information

and

legal authority to collect and use it.

Liability significance

Improper consent architecture can expose an organization to regulatory action and potentially contribute to private claims under applicable national law.

Case 6 — Digital Rights Ireland Ltd

CJEU, Joined Cases C-293/12 and C-594/12, 8 April 2014

Principle

The CJEU invalidated the EU Data Retention Directive because the interference with fundamental rights was insufficiently constrained.

The judgment strongly emphasized:

proportionality;

necessity;

safeguards;

privacy;

protection of personal data.

AI governance relevance

The case is particularly significant for large-scale AI systems involving:

mass data processing;

surveillance;

predictive analytics;

behavioral profiling.

The existence of technological capability does not establish legal justification.

Governance lesson

An AI system should not simply be designed around:

“What data can we collect?”

The legally relevant question is:

“What data may we lawfully collect and process for this purpose?”

Case 7 — Tele2 Sverige AB and Watson

CJEU, Joined Cases C-203/15 and C-698/15, 21 December 2016

Principle

The CJEU imposed strong requirements concerning generalized data retention and access.

The case reinforced:

necessity;

proportionality;

safeguards;

judicial/independent oversight.

AI governance relevance

It provides an important analogy for AI surveillance and predictive systems.

Organizations deploying AI to analyze communications or behavior should consider:

purpose limitation;

proportionality;

access controls;

retention periods;

oversight.

Importance: Particularly relevant to AI surveillance governance.

Case 8 — Glawischnig-Piesczek v Facebook Ireland

CJEU, Case C-18/18, 3 October 2019

Principle

The CJEU considered the responsibilities of online platforms concerning unlawful content and monitoring obligations.

AI governance relevance

Modern content-moderation systems frequently use:

automated detection;

machine learning;

classification models;

automated removal.

The case illustrates how technological systems can become intertwined with legal obligations imposed on platform operators.

Governance significance

Organizations need procedures for:

detection;

review;

escalation;

removal;

restoration;

compliance monitoring.

AI deployment does not remove responsibility for legally required outcomes.

Case 9 — Boston Scientific Medizintechnik GmbH and Others

CJEU, Joined Cases C-503/13 and C-504/13, 5 March 2015

Principle

The CJEU considered product defects in medical devices and accepted that a class of products could be considered defective where there was an increased risk of failure.

AI governance relevance

This is particularly important for AI-enabled medical products.

It demonstrates the significance of:

safety expectations;

systemic risks;

product defects;

risk management.

Governance lesson

A manufacturer should not necessarily wait until every individual product causes harm before responding to evidence of systemic safety problems.

Case 10 — Schmitt v TÜV Rheinland

CJEU, Case C-219/15, 16 February 2017

Principle

The case concerned the role and obligations of a notified body in relation to medical devices.

AI governance relevance

The case illustrates how responsibility may be distributed across a technological supply and conformity-assessment chain.

For AI-enabled regulated products, liability questions may involve:

manufacturer;

conformity-assessment organization;

regulator;

distributor;

deployer.

Importance

It demonstrates that governance responsibility can extend beyond the immediate developer.

9. Corporate Governance and AI

AI governance increasingly becomes a board-level corporate-governance issue.

Directors may need to ensure that their companies have adequate systems concerning:

AI inventory;

risk classification;

compliance;

cybersecurity;

data governance;

procurement;

internal controls;

incident response;

employee training;

documentation.

A director does not need to personally understand every technical detail of a machine-learning model.

But directors may need to ensure that the organization obtains appropriate expertise and establishes reasonable oversight.

10. Director Liability

Traditional corporate law provides an important framework.

Re D'Jan of London Ltd

[1994] 1 BCLC 561

The case illustrates that directors can incur personal consequences for failing to exercise appropriate care.

Applied to AI governance, a director might face questions where they:

approve deployment without basic risk assessment;

ignore known AI failures;

fail to establish necessary controls;

disregard professional advice;

conceal significant AI incidents.

However:

An AI failure does not automatically make directors personally liable.

The director's own breach must generally be established under the relevant national law.

11. Re Barings plc (No. 5)

[1999] 1 BCLC 433

This case is important for the principle that directors cannot completely abdicate oversight responsibilities.

AI relevance

Suppose a financial company delegates all AI risk management to a technical team.

The board cannot necessarily respond:

“The engineers were responsible, so the board had no responsibility.”

Delegation may be appropriate, but oversight can remain necessary.

The principle is highly relevant to:

algorithmic trading;

AI credit scoring;

automated compliance;

AI investment systems.

12. Dorchester Finance Co Ltd v Stebbing

[1989] BCLC 498

The case concerns directors' duties and the minimum standard of care.

AI governance application

Directors who approve major AI deployments without:

understanding the basic risks;

obtaining competent advice;

reviewing governance arrangements;

may face questions concerning whether they discharged their responsibilities appropriately.

Again, this is an analogical corporate-law authority, not an AI-specific judgment.

13. Chandler v Cape plc

[2012] EWCA Civ 525

The case concerned parent-company responsibility.

AI governance relevance

AI systems are frequently deployed through corporate groups.

For example:

Parent company → centralized AI platform → subsidiary deployment

Questions may arise about whether the parent company:

designed the system;

controlled its use;

established group-wide policies;

knew of the risks;

assumed responsibility for governance.

The case demonstrates that corporate structure alone does not always answer responsibility questions.

14. Vedanta Resources plc v Lungowe

[2019] UKSC 20

The UK Supreme Court considered when a parent company may owe its own duty of care concerning activities of a subsidiary.

AI governance relevance

The analogy is important for multinational AI systems.

A parent company that:

establishes detailed AI policies;

provides centralized AI technology;

controls compliance;

represents that it manages AI risk;

may potentially create questions concerning its own responsibility.

The key issue is actual involvement and assumption of responsibility, not simply ownership.

15. Okpabi v Royal Dutch Shell plc

[2021] UKSC 3

The Supreme Court again considered parent-company responsibility.

AI relevance

Large corporate groups increasingly operate centralized:

AI systems;

data infrastructure;

cybersecurity systems;

compliance functions.

If the parent genuinely manages or supervises those functions, corporate structure alone may not prevent claims concerning the parent's own conduct.

16. AI Governance and Fundamental Rights

European AI governance is strongly influenced by fundamental rights.

Potentially relevant rights include:

Article 8 ECHR

Private and family life.

Relevant to:

surveillance;

profiling;

facial recognition;

biometric AI.

Article 6 ECHR

Fair hearing.

Relevant to:

AI-assisted judicial or administrative decision-making;

automated evidence assessment.

Article 14 ECHR

Non-discrimination.

Relevant to:

discriminatory algorithms;

employment AI;

credit scoring;

welfare systems.

Article 1 of Protocol No. 1

Property protection.

Potentially relevant to:

automated financial decisions;

business restrictions;

AI-related economic regulation.

17. AI Governance in Public Administration

Public authorities face additional obligations.

An authority using AI to:

allocate benefits;

determine immigration applications;

assess welfare eligibility;

identify fraud;

rank applicants;

may have to comply with:

legality;

procedural fairness;

reasons;

proportionality;

equality;

judicial review;

fundamental rights.

M.M. v Minister for Justice

CJEU, Case C-277/11, 22 November 2012

The case emphasized the importance of effective procedural safeguards in administrative decision-making.

The principle is relevant to AI-assisted administrative decisions because affected persons may need a meaningful opportunity to challenge the factual and legal basis of a decision.

18. AI and the Right to Reasons

A major governance issue is explainability.

Suppose an authority says:

“The algorithm determined that you are ineligible.”

That may be insufficient where law requires meaningful reasons.

Governance should therefore allow institutions to determine:

what data were used;

what factors materially influenced the result;

what decision rule applied;

whether human review occurred.

An AI system that cannot provide information necessary for legally required review may be inappropriate for certain uses.

19. AI Governance and Discrimination

AI governance should include discrimination testing.

Potential sources of discriminatory outcomes include:

historical datasets;

proxy variables;

biased labels;

unequal sampling;

feedback loops;

geographical proxies;

socioeconomic proxies.

A governance system should therefore test:

input data;

model performance;

outcome distribution;

error rates;

disparate impacts;

human-review processes.

20. AI Governance and Cybersecurity

AI systems can create cybersecurity risks through:

prompt injection;

data poisoning;

model theft;

unauthorized access;

adversarial attacks;

training-data manipulation;

malicious outputs.

Cybersecurity is therefore not merely an IT issue.

It can become a liability issue where inadequate security causes:

data breaches;

financial loss;

physical harm;

unauthorized decisions.

A governance framework should integrate AI security into the organization's broader risk-management system.

21. AI Governance and Product Liability

For AI incorporated into physical products, liability may arise from defective design or insufficient safety.

Examples include:

autonomous vehicles;

medical devices;

industrial robots;

smart machinery;

AI-controlled consumer products.

The Boston Scientific line of authority is important because it demonstrates that systemic safety risks can have legal significance.

The relevant question becomes:

Was the AI-enabled product as safe as persons were reasonably entitled to expect under the applicable law?

22. AI Governance and Consumer Protection

Consumer-facing AI raises issues including:

misleading AI claims;

hidden automation;

dark patterns;

false claims of accuracy;

manipulation;

undisclosed personalization;

unfair contractual terms.

A company saying:

“Our AI is 99.9% accurate”

may face legal consequences if that statement is unsupported.

Governance should therefore include review of AI marketing claims.

23. AI Governance and Contractual Liability

Contracts should establish:

who controls the AI;

who validates it;

who supplies data;

who monitors it;

who responds to incidents;

who owns audit logs;

who bears regulatory responsibility;

indemnification arrangements;

cybersecurity obligations.

However, a contractual allocation of risk between companies does not necessarily eliminate liability owed to consumers or third parties.

24. Vendor and Procurement Liability

Organizations frequently purchase AI from external providers.

A governance failure can occur when an organization simply assumes:

“The vendor is responsible for compliance.”

That is dangerous.

The purchaser should consider:

vendor due diligence;

model documentation;

security testing;

data provenance;

regulatory compliance;

audit rights;

incident notification;

subcontractors;

model updates;

termination rights.

A company may remain responsible for the way it deploys an AI system even if the underlying technology came from another company.

25. AI Governance and Evidence

One of the most important practical aspects of liability is documentation.

An organization should be capable of demonstrating:

what AI systems it uses;

why each system is used;

who approved deployment;

what risk classification was applied;

what testing occurred;

what data were used;

what human oversight exists;

what incidents occurred;

what corrective actions were taken.

Without records, an organization may struggle to defend itself against allegations of negligent governance.

26. AI Audit Trails

An effective audit trail can contain:

This documentation can become important evidence in litigation and regulatory investigations.

27. AI Governance and Causation

Governance failure alone does not necessarily establish damages.

For a civil claim, the claimant may need to demonstrate:

Governance failure

↓

AI malfunction

↓

Harmful decision

↓

Causation

↓

Damage

For example:

Failure to test AI → AI incorrectly rejects loan → business cannot obtain financing → business suffers loss.

The claimant still needs to establish that the governance failure caused the relevant loss.

28. Defences

Organizations may defend AI governance claims by demonstrating:

Reasonable governance

The organization had appropriate policies and controls.

Independent validation

The AI had been properly tested.

Human oversight

A competent human reviewed important decisions.

No causation

The alleged governance failure did not cause the damage.

Unforeseeable event

The incident resulted from an unforeseeable external event.

Compliance

The system complied with applicable legal requirements.

Contributory fault

The claimant contributed to the harm.

Third-party responsibility

Another entity caused the relevant failure.

29. Remedies

Possible remedies include:

Damages

Compensation for legally recoverable loss.

Injunctions

Preventing continued deployment of an unlawful AI system.

Regulatory penalties

Fines or supervisory measures.

Corrective action

Re-training or modifying the model.

Reassessment

Repeating decisions affected by defective AI.

Data correction

Correcting inaccurate personal information.

Deletion/restriction

Where required by data-protection law.

Product recall

For unsafe AI-enabled products.

Contractual remedies

Termination, damages or indemnification.

Declaratory relief

Judicial determination of unlawfulness.

30. AI Governance in Different Sectors

31. Six Core Governance Duties

A useful European AI governance model can be organized around six duties:

1. Duty to identify

Identify foreseeable AI risks.

2. Duty to validate

Test whether the system works reliably.

3. Duty to supervise

Ensure meaningful human oversight.

4. Duty to monitor

Continuously assess performance.

5. Duty to document

Maintain evidence of compliance.

6. Duty to respond

Correct, suspend or terminate systems when serious problems emerge.

Failure in one or more of these areas can become evidence in a liability claim.

32. Ten Important Authorities at a Glance

33. Direct and Analogical Authorities

It is important to distinguish the legal weight of these authorities.

More directly relevant to automated systems

SCHUFA is particularly important because it directly addresses automated scoring and decision-making.

Directly relevant to technology governance

Google Spain, Nowak, Orange România and Planet49 establish important principles concerning data processing, profiling and consent.

Product-safety analogies

Boston Scientific and Schmitt are particularly useful for AI-enabled regulated products.

Corporate-governance analogies

Re Barings, Re D'Jan, Dorchester Finance, Chandler, Vedanta and Okpabi provide useful principles concerning managerial oversight and assumption of responsibility.

Accordingly, European AI governance law is presently best understood as an intersection of existing legal doctrines plus increasingly specific AI regulation, rather than as one completely autonomous liability regime.

34. Practical AI Governance Framework

A European organization deploying AI should ideally maintain:

A. AI inventory

Every significant AI system should be identified.

B. Risk classification

Determine the legal and operational risk.

C. Responsible owner

Assign a named organizational function responsible for governance.

D. Data assessment

Determine:

source;

legality;

accuracy;

sensitivity;

retention;

permitted use.

E. Model validation

Test:

accuracy;

robustness;

bias;

security;

reliability.

F. Human oversight

Define when human intervention is mandatory.

G. Monitoring

Monitor performance after deployment.

H. Incident response

Create a mechanism for:

detection;

escalation;

investigation;

correction;

reporting.

I. Documentation

Maintain an auditable record.

J. Retirement

Remove systems that can no longer be safely or lawfully operated.

35. Overall Legal Test

When evaluating an AI governance liability claim, the following ten questions are particularly useful:

Who deployed the AI?

Who controlled it?

What legal duty applied?

What governance controls were required?

Were those controls actually implemented?

Was the AI reasonably tested?

Was meaningful human oversight provided?

Did the governance failure cause the harmful output or decision?

What damage resulted?

What remedy is legally available?

36. Conclusion

AI governance and liability in Europe is developing into a comprehensive accountability framework rather than a single cause of action.

The fundamental principle is:

AI can perform the function, but the law continues to look for the person or organization responsible for designing, deploying, controlling, supervising and benefiting from that function.

The most important cases include SCHUFA, Google Spain, Nowak, Orange România, Planet49, Digital Rights Ireland, Tele2 Sverige/Watson, Glawischnig-Piesczek, Boston Scientific, and Schmitt. Together, they demonstrate how European law addresses automated decision-making, data governance, proportionality, transparency, platform responsibility, product safety and technological accountability.

The corporate cases Re Barings, Re D'Jan, Dorchester Finance, Chandler, Vedanta and Okpabi further demonstrate that delegation to technology or subsidiaries does not necessarily eliminate managerial or corporate responsibility.

The strongest AI governance liability claim therefore normally follows this structure:

AI deployment → governance duty → inadequate risk assessment/testing/data/oversight → foreseeable AI failure → harmful decision or event → causation → legally recognized damage → liability and remedy.

In practical terms, the best protection for an organization is not simply a disclaimer stating that “AI may make mistakes.” It is demonstrable governance: risk assessment, appropriate data controls, validation, human oversight, monitoring, auditability, incident response and documented accountability.