Civil Law and Artificial Intelligence Liability in Europe

1. Introduction

Artificial Intelligence (AI) liability in Europe concerns civil responsibility for harm caused by AI systems, including generative AI, automated decision-making systems, autonomous vehicles, medical AI, industrial AI, recommendation systems, and AI agents.

European AI liability is not governed by one single traditional tort rule. Instead, liability may arise through a combination of:

contractual liability;

non-contractual/tort liability;

product liability;

professional negligence;

consumer protection;

data-protection law;

fundamental-rights protections;

sector-specific legislation;

the EU AI Act;

national civil codes.

A major difficulty is that AI systems may be autonomous, probabilistic, adaptive and technically complex. Consequently, proving:

wrongful conduct → defect/breach → causation → damage

can be considerably more difficult than in ordinary civil litigation.

As of 2026, there is still no mature body of European case law establishing a comprehensive AI-specific civil-liability doctrine. Courts therefore apply established principles from product liability, data protection, medical technology, software and automated decision-making to AI-related disputes.

2. Meaning of AI Civil Liability

AI civil liability means the legal responsibility of an AI developer, provider, deployer, manufacturer, professional or other actor to compensate a person who suffers legally recognised damage because of an AI system.

Examples include:

Medical AI

An AI system incorrectly identifies a tumour and the patient suffers injury because treatment is delayed.

Autonomous vehicles

An automated driving system incorrectly identifies a pedestrian and causes an accident.

Financial AI

An algorithm incorrectly evaluates a consumer's creditworthiness and causes financial loss.

Employment AI

An automated recruitment system unlawfully discriminates against an applicant.

Generative AI

An AI system generates defamatory or otherwise unlawful material causing damage.

Industrial AI

An AI-controlled machine malfunctions and causes physical injury.

3. European Legal Framework

Several EU legal instruments are particularly important.

A. EU AI Act

The AI Act — Regulation (EU) 2024/1689 — establishes a risk-based regulatory framework for AI.

It classifies AI systems according to risk and imposes obligations concerning matters such as:

risk management;

data governance;

technical documentation;

record keeping;

transparency;

human oversight;

accuracy;

robustness;

cybersecurity;

post-market monitoring.

However:

The AI Act is primarily a regulatory framework; it is not itself a complete general civil-damages regime.

A company violating the AI Act may face regulatory consequences, while a person harmed by an AI system may separately pursue civil remedies under applicable national or EU private-law rules.

4. Revised EU Product Liability Framework

The Product Liability Directive (EU) 2024/2853 significantly modernises European product-liability law for the digital economy.

The modern framework expressly accommodates products involving:

software;

digital manufacturing;

AI-related products;

updates and upgrades;

cybersecurity-related defects.

This is important because older product-liability concepts were primarily designed around physical products.

A defective AI-enabled product can therefore potentially generate product-liability consequences.

5. AI Liability Directive

The proposed AI Liability Directive was designed to facilitate civil claims involving AI by addressing difficult questions concerning:

disclosure of evidence;

causal presumptions;

interaction with the AI Act.

However, its legislative status must be distinguished from enacted law. It should not be treated as an already applicable general European AI-damages regime.

Thus, for present civil claims, national tort/product-liability/contract doctrines remain extremely important.

6. Main Types of AI Liability

AI-related civil liability can broadly be divided into:

1. Contractual liability

Where an AI provider breaches a contract.

2. Tort/delict liability

Where an AI system causes unlawful harm independently of a contractual relationship.

3. Product liability

Where an AI-enabled product is defective.

4. Professional liability

Where a professional improperly relies on AI.

5. Data-protection liability

Where AI processing unlawfully causes damage through personal-data processing.

6. Consumer liability

Where AI services breach consumer-protection obligations.

7. Employer liability

Where automated employment systems cause unlawful discrimination or other harm.

7. Developer, Provider and Deployer

A crucial issue is determining who should bear responsibility.

Developer

The developer creates the AI model or algorithm.

Potential problems:

defective architecture;

inadequate testing;

biased training data;

foreseeable misuse;

inadequate safeguards.

Provider

The provider makes the AI system commercially available.

Potential problems:

inadequate instructions;

insufficient warnings;

inadequate monitoring;

failure to provide necessary safeguards.

Deployer

The deployer uses the AI system in a real-world environment.

Potential problems:

inappropriate use;

failure to supervise;

reliance on inaccurate output;

failure to update the system.

Professional user

Doctors, lawyers, banks and engineers may have independent duties.

They cannot necessarily escape professional responsibility by saying:

“The AI told me to do it.”

8. Case Law

European AI liability law is still developing, so the most useful cases include both direct AI/algorithm cases and cases establishing principles that can be applied to AI.

Case 1 — SCHUFA

CJEU, Case C-634/21, SCHUFA Holding

This is one of the most important European cases concerning automated decision-making.

The dispute concerned credit-scoring and automated processing of personal data.

The CJEU examined Article 22 GDPR and the legal consequences of automated decision-making.

Principle

A person's legal position cannot simply be determined through an automated process while the system's role is artificially characterised as merely preparatory.

AI relevance

The case is important for AI systems used in:

credit scoring;

insurance;

recruitment;

housing;

financial services.

If an AI system effectively determines a person's outcome, the operator may face significant legal obligations.

Liability significance

If unlawful automated processing causes financial or other legally recognised damage, compensation may potentially be sought under applicable data-protection rules.

9. Case 2 — Dun & Bradstreet Austria

CJEU, Case C-203/22

This case concerned the transparency requirements surrounding automated decision-making and the information individuals may receive concerning the logic involved.

The CJEU addressed the relationship between:

automated decision-making;

explanation of decision logic;

trade secrets;

data-subject rights.

AI relevance

Modern AI systems are often described as:

“black boxes.”

Where a person suffers harm because of an automated decision, the ability to understand how the system reached the decision can be critical.

Civil-liability significance

Information rights can become important evidence in a later damages claim.

Thus:

transparency → evidence → causation → liability

can form an important chain.

10. Case 3 — Google Spain

CJEU, Case C-131/12, Google Spain SL and Google Inc. v AEPD and Mario Costeja González

This landmark case concerned search engines and personal data.

The CJEU recognised significant responsibility for search-engine operators in relation to processing personal data.

AI relevance

The case established an important principle for digital intermediaries:

Technological operators can have independent legal responsibilities even when their systems process information originally created by others.

This is relevant to AI providers because an AI provider may not necessarily avoid responsibility merely by saying:

“The information came from third-party data.”

11. Case 4 — Wirtschaftsakademie Schleswig-Holstein

CJEU, Case C-210/16

The case concerned Facebook fan pages and joint responsibility for personal-data processing.

The CJEU recognised that an entity could have responsibility in relation to processing even though it did not itself operate the underlying platform infrastructure.

AI relevance

AI systems frequently involve multiple actors:

developer → cloud provider → model provider → deployer → user

The case supports a broader principle that responsibility may arise from a person's role in determining or influencing processing, rather than merely from physical ownership of the technology.

12. Case 5 — Fashion ID

CJEU, Case C-40/17, Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW

This case concerned the use of Facebook's social plugin on a website and responsibility for data processing.

The CJEU examined circumstances in which an organisation using a third-party technological tool could bear responsibility for data processing.

AI relevance

This is particularly useful for:

embedded AI tools;

third-party AI APIs;

AI recommendation engines;

AI analytics;

automated advertising.

A company integrating an external AI system may therefore have its own legal responsibilities.

13. Case 6 — Boston Scientific Medizintechnik

CJEU, Joined Cases C-503/13 and C-504/13

This case concerned defective medical devices.

The CJEU addressed the concept of a product defect where products belonging to a particular group or production series presented an abnormal risk.

AI relevance

This case is extremely useful for AI-enabled medical devices.

Suppose:

An AI-controlled medical device has a systemic software defect.

The claimant may argue that the product presented a level of safety that persons were entitled to expect.

The case demonstrates that product liability can address systemic technological risks, not merely a single physical manufacturing error.

14. Case 7 — Sanofi Pasteur

CJEU, Case C-621/15, W and Others v Sanofi Pasteur

The case concerned product liability and causation where scientific evidence could not establish a conventional causal mechanism with absolute certainty.

Importance

The CJEU recognised the importance of evidential circumstances when determining whether a causal relationship can be established.

AI relevance

AI disputes may involve similar evidentiary uncertainty.

For example:

Did an algorithm actually cause the claimant's financial loss?

or:

Did the AI's diagnostic recommendation cause the patient's injury?

AI systems can contain thousands of variables, making traditional causal proof difficult.

Sanofi Pasteur therefore provides an important conceptual reference for dealing with scientific and technical uncertainty in product-liability litigation.

15. Case 8 — Uber Spain

CJEU, Case C-434/15, Asociación Profesional Elite Taxi v Uber Systems Spain

Although primarily a regulatory/services case, this judgment is relevant to understanding technology platforms.

The CJEU examined Uber's role in organising and controlling a service rather than treating it merely as a neutral technological intermediary.

AI relevance

The principle is useful when analysing AI platforms.

Where a company:

designs the system;

controls the algorithm;

determines operating conditions;

sets parameters;

supervises the service;

its legal position may be different from that of a passive software supplier.

16. Case 9 — Google v CNIL

CJEU, Case C-507/17

The case concerned the territorial scope of delisting obligations.

The CJEU distinguished between:

EU-wide obligations;

global obligations.

AI relevance

AI systems operate globally.

An AI model may be:

developed outside the EU;

trained using global datasets;

hosted outside Europe;

offered to European users.

Therefore, territorial questions can become important in AI liability.

17. Case 10 — Asociación Nacional de Fabricantes de Chocolates v AI Systems? No Direct General AI Rule

An important research principle is that courts should not invent an AI-specific case-law doctrine simply because an algorithm is involved.

European courts generally start with the applicable legal right:

copyright → GDPR → product liability → contract → tort → consumer law

and then determine whether the AI activity violates that right.

Therefore, an AI case should not automatically be treated as a completely new category of civil law.

18. Duty of Care

A central concept in negligence-based AI liability is the duty of care.

An AI provider may be expected to:

conduct appropriate testing;

identify foreseeable risks;

monitor performance;

correct known defects;

provide warnings;

implement cybersecurity;

maintain appropriate documentation;

prevent foreseeable misuse.

The exact standard depends upon:

jurisdiction;

sector;

type of AI;

foreseeable harm;

professional standards;

contractual obligations.

19. AI Training Data as a Source of Liability

Poor training data can create civil risks.

Examples:

Biased dataset

An employment AI systematically rejects candidates from a protected group.

Inaccurate dataset

A financial AI uses incorrect financial information.

Outdated dataset

A medical AI relies upon obsolete medical information.

Copyright-infringing dataset

Training material is unlawfully copied.

Personal-data problem

Training data contains personal information processed unlawfully.

Therefore:

data governance can become a civil-liability issue.

20. Algorithmic Bias

AI discrimination can create liability under:

equality law;

employment law;

consumer law;

data-protection law;

tort/delict law;

contractual law.

Examples include AI used for:

recruitment;

credit;

insurance;

housing;

education.

The difficult issue is often proving that the algorithm caused the discriminatory outcome.

21. Causation in AI Cases

Traditional civil liability usually requires some form of causal connection between:

wrongful conduct → damage

AI creates complex causal chains.

Example:

Developer error

↓

biased training data

↓

algorithmic prediction

↓

bank rejects loan

↓

consumer loses business opportunity

↓

economic loss

The claimant must establish the legally relevant causal connection.

22. The Black-Box Problem

AI systems may be difficult to understand even for their developers.

A claimant may ask:

Why did the AI produce this result?

The defendant may respond:

The model is probabilistic and no single rule explains the result.

This creates a major evidentiary problem.

European regulation increasingly addresses:

documentation;

logging;

transparency;

human oversight;

risk management.

These requirements may indirectly make civil litigation easier because they can generate evidence about the AI system's operation.

23. Human Oversight

Human oversight is particularly important in high-risk AI.

A company should not necessarily treat an AI result as automatically correct.

For example:

AI rejects a patient's treatment recommendation.

A doctor may have a professional duty to independently assess the AI output.

Similarly:

AI rejects an employee candidate.

The employer may need appropriate human review.

Failure of human oversight can therefore become an independent basis for liability.

24. Autonomous AI Agents

The rise of AI agents creates additional civil-law questions.

An AI agent may:

send emails;

purchase goods;

negotiate contracts;

modify databases;

execute financial transactions;

communicate with customers.

Suppose an AI agent mistakenly purchases €500,000 of goods.

Potential questions include:

Was there valid authority?

Was the transaction authorised?

Was the AI acting as an agent of the company?

Who bears the loss?

Was the system defectively designed?

Did the user provide adequate limits?

Was the counterparty entitled to rely on the AI's conduct?

European contract and agency law may therefore become increasingly important.

25. AI and Contractual Liability

A contract may specify:

accuracy requirements;

uptime;

response times;

safety requirements;

permitted use;

human review;

data security;

indemnification.

If the AI provider fails to meet contractual obligations, ordinary contractual remedies may apply.

Possible remedies include:

damages;

termination;

price reduction;

repair/correction;

specific performance, depending on national law.

26. AI and Product Liability

AI can become part of a product.

Examples:

autonomous vehicle;

smart medical device;

AI-controlled robot;

industrial machine;

smart home system.

A product may be defective because of:

Design defect

The AI architecture is inherently unsafe.

Manufacturing/deployment defect

The particular software version is defective.

Information defect

Users were not adequately warned.

Update defect

A software update introduces a dangerous malfunction.

Cybersecurity defect

A vulnerability allows an attacker to manipulate the AI system.

27. Software Updates

Modern AI systems are continuously updated.

This creates a difficult question:

Which version of the AI system caused the damage?

Evidence may include:

model version;

software release;

update history;

training changes;

system logs;

user configuration.

The new EU product-liability framework's treatment of software and related digital elements is therefore especially relevant.

28. Professional Liability

Professionals cannot automatically transfer responsibility to AI.

Doctor

Doctor uses diagnostic AI incorrectly.

Lawyer

Lawyer relies on AI-generated legal research without verification.

Engineer

Engineer relies upon AI structural calculations.

Accountant

Accountant accepts incorrect AI-generated financial analysis.

The relevant professional standard may require reasonable verification.

Therefore:

AI assistance does not automatically eliminate professional negligence.

29. Consumer Protection

AI consumer services can create claims involving:

misleading information;

hidden automated processes;

unfair commercial practices;

defective services;

unfair contractual clauses;

manipulative personalisation.

For example:

A consumer purchases a financial product after receiving an AI-generated recommendation that materially misrepresents the product.

The provider's liability may depend upon consumer law, contract and sector-specific financial regulation.

30. Data Protection and Compensation

Article 82 GDPR is particularly important.

A person may seek compensation where unlawful processing of personal data causes legally recognised material or non-material damage.

AI systems can create data-protection risks involving:

unlawful training data;

profiling;

automated decision-making;

inaccurate personal data;

sensitive data;

unlawful inference;

data retention.

The CJEU's automated-decision and data-processing jurisprudence therefore provides an important foundation for AI civil claims.

31. Economic Loss

AI can cause purely economic damage.

Examples:

incorrect automated trading;

erroneous credit scoring;

algorithmic pricing;

defective financial forecasting;

business interruption.

Whether purely economic loss is recoverable depends heavily upon the applicable national law and legal basis.

Therefore, a claimant must identify the precise civil-law cause of action rather than simply stating:

“The AI made a mistake.”

32. AI and Medical Liability

Medical AI presents particularly serious liability questions.

Possible chain:

AI diagnostic error

↓

doctor relies on AI

↓

incorrect treatment

↓

patient injury

Potential defendants may include:

AI developer;

hospital;

physician;

medical-device manufacturer;

software provider.

The Boston Scientific and Sanofi Pasteur jurisprudence is particularly useful for understanding how product defect and causation principles may operate in technology-intensive medical disputes.

33. Autonomous Vehicle Liability

Autonomous vehicles raise questions concerning:

manufacturer responsibility;

software defects;

sensor failure;

algorithmic decision-making;

cybersecurity;

driver responsibility;

maintenance;

updates.

Traditional road-accident law may interact with product liability.

A major question is:

If the human driver did everything reasonably expected but the AI system made the harmful decision, should responsibility shift toward the manufacturer/provider?

The answer depends upon the applicable national legislation and factual circumstances.

34. AI Cybersecurity Liability

AI systems may be manipulated through:

adversarial attacks;

prompt injection;

data poisoning;

model theft;

malicious inputs;

compromised updates.

Suppose an attacker manipulates an AI-controlled machine and causes injury.

Civil-law questions include:

Was the cybersecurity protection adequate?

Was the attack foreseeable?

Did the provider breach a duty of care?

Was the product defective?

Did the victim contribute to the damage?

Is the attack an intervening cause?

35. Defences

Potential defendants may argue:

1. No defect

The AI system performed according to its specifications.

2. Misuse

The user used the system contrary to instructions.

3. Intervening cause

A third party caused the harm.

4. Lack of causation

The claimant cannot prove that the AI caused the damage.

5. State-of-the-art defence

Applicable only where the relevant statutory regime recognises such a defence.

6. Victim contribution

The claimant contributed to the damage.

7. Contractual limitation

Subject to mandatory consumer/product-liability rules and national law.

36. Evidence in AI Litigation

AI litigation can depend heavily on technical evidence.

Important evidence includes:

training datasets;

model documentation;

system architecture;

logs;

prompts;

output records;

version history;

risk assessments;

testing records;

audit reports;

cybersecurity records;

human-review records.

The Dun & Bradstreet jurisprudence demonstrates why information concerning automated decision-making can be legally important.

37. Burden of Proof

One of the biggest difficulties is:

The claimant may suffer harm without knowing how the AI produced the result.

This can create information asymmetry.

The AI provider may possess:

model information;

training information;

technical logs;

testing results.

The claimant may possess only the harmful output.

This is one reason European legislation has increasingly focused on documentation and transparency.

38. AI Liability Chain

A useful conceptual model is:

Developer

↓

Model/provider

↓

Integrator

↓

Deployer

↓

AI decision

↓

Human action

↓

Damage

↓

Civil claim

Courts may need to determine which link in this chain is legally responsible.

Sometimes several actors may share responsibility.

39. Joint Liability

Suppose:

developer creates defective AI;

hospital deploys it without testing;

doctor relies on it without review.

A claimant may attempt to establish responsibility against several actors.

National law determines:

joint and several liability;

contribution between defendants;

apportionment;

indemnification.

Therefore, AI disputes may become multi-defendant civil actions.

40. AI Liability and Fundamental Rights

AI civil liability can overlap with:

privacy;

equality;

human dignity;

freedom of expression;

property;

consumer rights.

The CJEU's digital jurisprudence demonstrates that technological systems must operate within broader European rights frameworks.

41. Comparative Case-Law Table

42. Important Distinction: AI Regulation vs AI Liability

This distinction is essential for exams.

AI Act

Primarily establishes:

regulatory obligations + risk management + compliance

Civil liability

Primarily concerns:

harm + legal duty + breach/defect + causation + damages

Therefore:

An AI system can comply with regulatory requirements and still potentially cause civil liability in a particular case.

Conversely:

A regulatory violation does not automatically answer every question of civil damages.

The applicable national civil-law rules remain important.

43. Future European AI Liability

The major future issues are likely to include:

liability for autonomous AI agents;

AI-generated contracts;

autonomous financial transactions;

AI medical diagnosis;

autonomous vehicles;

AI robots;

AI cybersecurity failures;

algorithmic discrimination;

AI hallucinations;

AI-generated defamation;

AI copyright infringement;

defective AI updates;

AI training-data defects;

causation in black-box systems;

disclosure of technical evidence;

responsibility between developers and deployers;

cross-border AI claims;

insurance for AI risks.

44. Simple Example

Suppose a hospital purchases an AI diagnostic system.

The system has a known defect causing it to miss certain cancers.

Step 1 — Developer

Did the developer design or test the system inadequately?

Step 2 — Provider

Did the provider give adequate warnings and instructions?

Step 3 — Hospital

Did the hospital deploy the system appropriately?

Step 4 — Doctor

Did the doctor reasonably review the AI recommendation?

Step 5 — Patient

Did the patient suffer legally recognised damage?

Step 6 — Causation

Can the claimant establish that the AI error materially contributed to the injury?

Step 7 — Remedy

Depending on the applicable law, potential remedies could include compensation and other civil relief.

This illustrates why AI liability is often a multi-layered responsibility problem.

45. Conclusion

European AI civil liability is developing through the interaction of traditional civil-law principles and new AI regulation.

The most important legal concepts are:

duty of care → defect/breach → causation → damage → remedy

AI does not eliminate these principles; instead, it makes them technically more complicated.

The most important existing jurisprudence includes SCHUFA for automated decision-making, Dun & Bradstreet for transparency and explainability, Google Spain, Wirtschaftsakademie and Fashion ID for responsibility in digital systems, and Boston Scientific and Sanofi Pasteur for product defects and causation. These cases are not all direct AI-liability cases; rather, they provide the legal principles that European courts can apply to AI-related disputes.

The central future challenge is therefore not simply:

“Who created the AI?”

but:

“Which actor controlled the relevant risk, what legal duty applied, what went wrong, and can the claimant prove that the AI-related conduct caused legally compensable damage?”

Exam-Ready Keywords

AI civil liability, artificial intelligence, AI Act, AI Liability Directive, Product Liability Directive, contractual liability, tort/delict, negligence, duty of care, defective AI, software defect, algorithmic error, automated decision-making, Article 22 GDPR, Article 82 GDPR, explainability, transparency, black-box problem, human oversight, causation, evidentiary uncertainty, product liability, professional negligence, medical AI, autonomous vehicles, AI agents, cybersecurity, algorithmic discrimination, economic loss, material damage, non-material damage, developer liability, provider liability, deployer liability, joint liability, risk management, audit logs, model documentation, training data, model updates, Boston Scientific, Sanofi Pasteur, SCHUFA, Dun & Bradstreet, Google Spain, Wirtschaftsakademie, Fashion ID, Uber Spain, Google v CNIL.