Civil Law and Comparative AI Liability Systems

Civil liability for artificial intelligence concerns who must compensate a person when an AI system causes legally recognised harm. The responsible party may be a developer, manufacturer, supplier, business deploying the system, professional relying on it, or another participant in its operation.

There is no single international AI liability system. Courts generally apply existing rules on negligence, contractual obligations, defective products, data protection, and discrimination. The central challenge is adapting those rules to systems whose outputs may be difficult to explain and whose development involves several organisations.

“Civil law” has two meanings here: private liability, as distinct from criminal responsibility, and the continental legal tradition represented by countries such as France, Germany, and Spain. Both meanings are relevant to the comparison below.

The discussion includes seven cases, distinguishing decisions directly concerning automated systems from earlier authorities relevant by analogy.

1. The principal foundations of AI civil liability

Fault or negligence

Fault-based liability asks whether a defendant failed to exercise the care legally required in the circumstances.

Possible failures include:

• Releasing a system without adequate testing.
• Using unsuitable or inaccurate data.
• Deploying AI outside its intended operating conditions.
• Ignoring known errors or discriminatory outcomes.
• Failing to provide warnings, monitoring, or appropriate human review.

For example, a hospital deploying diagnostic software may face a claim if it ignores documented limitations and allows the system to determine treatment without appropriate clinical oversight.

An incorrect output does not itself establish negligence. The claimant ordinarily needs to identify a legally relevant failure, compensable damage, and a causal connection.

Contractual liability

AI suppliers and users may owe obligations under licensing agreements, service contracts, warranties, or professional engagements.

A contractual claim may concern promised functionality, security, availability, suitability, or support. Whether the supplier promised a particular result or merely reasonable care depends on the agreement and applicable law.

Contractual limitations may allocate losses between businesses, but their enforceability depends on mandatory rules, consumer protection, and other restrictions. An agreement between a developer and a deploying business also does not automatically eliminate an injured third party’s statutory rights.

Product liability

Product liability focuses on whether a product was defective and caused covered damage. Under a no-fault product liability regime, the claimant need not prove negligent manufacturing or design, but must still satisfy the regime’s requirements concerning defect, damage, and causation.

For AI, disputed questions include:

• Whether software falls within the relevant definition of a product.
• Whether a harmful output reflects a safety defect.
• Whether inadequate cybersecurity or updates contributed to the damage.
• Which organisation qualifies as the manufacturer or another liable economic operator.

Data protection and discrimination

An AI system can function exactly as designed and still operate unlawfully. A scoring model may use personal data unlawfully, while a recruitment system may disadvantage a protected group.

These claims require separate analysis. Statistical inaccuracy, unlawful discrimination, and a GDPR infringement are different legal issues; each has its own elements and remedies.

2. Comparison of major liability approaches

In France, Articles 1240–1241 provide the general fault framework, while Article 1242 addresses, among other matters, responsibility for things under one’s custody. Its application to a physical robot is conceptually different from its application to a remotely supplied software model; identifying legal custody cannot simply be assumed. Légifrance

In Germany, Section 823(1) BGB protects specified interests, including life, health, and property. Pure financial loss generally requires another legal basis, such as contract, infringement of a protective statute, or another applicable tort provision. Section 280 addresses damages for breach of contractual duties. This distinction can materially affect claims involving incorrect financial predictions or automated commercial advice. gesetze-im-internet.de

In Spain, Article 1902 establishes the general obligation to repair damage caused through fault or negligence. Article 1903 concerns responsibility for specified persons, while Article 1101 provides a foundation for contractual damages. AI software is not automatically an employee or another person falling within Article 1903; the claimant must identify an applicable basis for the defendant’s responsibility. boe.es

3. The EU position: enacted rules and withdrawn proposals

Two instruments must be distinguished.

The revised Product Liability Directive

Directive (EU) 2024/2853 expressly includes software within its product liability framework and treats software developers or producers as manufacturers in relevant circumstances.

It also provides mechanisms for disclosure and rebuttable presumptions under specified conditions. These address difficulties such as technical complexity and unequal access to evidence; they do not create automatic compensation whenever AI produces an adverse result.

The directive covers specified categories of damage, rather than every financial or reputational consequence of an AI output. Member States must transpose it by 9 December 2026, and its new regime applies to products placed on the market or put into service after that date. Consequently, its temporal scope must be checked before relying on it in a particular dispute. EUR-Lex

The proposed AI Liability Directive

The separate proposal intended to adapt non-contractual civil liability rules to AI was withdrawn by the Commission on 6 October 2025. Its proposed evidential mechanisms should therefore not be presented as operative EU law. European Parliament

4. Seven relevant case laws

Case 1: SCHUFA Holding (Scoring), Case C-634/21, Court of Justice of the European Union, 7 December 2023

Facts: A credit information agency generated a probability score concerning an individual’s ability to meet financial obligations. Other businesses used such scores when deciding whether to enter contractual relationships.

Decision: Automated generation of a credit score can fall within Article 22 GDPR where a third party gives that score a determining role in its decision concerning the individual.

Relevance to AI liability: Responsibility cannot necessarily be avoided by describing an algorithmic score as merely preliminary information. Courts must examine how decisively it influences the eventual decision.

Example: A lender’s nominal human approval stage may require scrutiny if staff routinely adopt the score without meaningful assessment.

Limit: This was a ruling on automated decision-making and data protection. It did not establish that every refusal of credit based on a score gives rise to damages. EUR-Lex

Case 2: Dun & Bradstreet Austria, Case C-203/22, Court of Justice of the European Union, 27 February 2025

Facts: The dispute concerned access to meaningful information about automated creditworthiness assessment.

Decision: The explanation must enable the individual to understand the procedure and principles actually applied to their personal data and to challenge the automated decision. Merely supplying a complex formula or algorithm does not necessarily satisfy that requirement. Trade secrecy does not justify an unconditional refusal; protected information may require assessment by the competent authority or court.

Relevance to AI liability: Access to an understandable explanation can help establish whether incorrect data, unlawful criteria, or defective processing contributed to an adverse outcome.

Example: A claimant challenging a score needs information showing how their data affected the result, rather than an unexplained numerical output.

Limit: The judgment concerns information rights. It does not independently establish the existence or amount of compensable loss. curia.europa.eu

Case 3: UI v Österreichische Post AG, Case C-300/21, Court of Justice of the European Union, 4 May 2023

Facts: Österreichische Post processed information to infer political affinities. An individual sought compensation for alleged non-material harm.

Decision: GDPR compensation requires three cumulative elements:

1. An infringement of the GDPR.
2. Material or non-material damage.
3. A causal connection between the infringement and that damage.

A mere infringement is insufficient. However, national law cannot require non-material damage to exceed a minimum seriousness threshold.

Relevance to AI liability: The judgment supplies a central framework for compensation claims arising from unlawful profiling and other AI-related personal data processing.

Example: Unlawful inference of sensitive characteristics may support a claim where the claimant proves resulting harm and causation.

Limit: Removing a seriousness threshold does not remove the requirement to demonstrate actual damage. curia.europa.eu

Case 4: Boston Scientific Medizintechnik, Joined Cases C-503/13 and C-504/13, Court of Justice of the European Union, 5 March 2015

Facts: The proceedings involved implanted pacemakers and defibrillators belonging to groups or production series with potential defects.

Decision: Given the devices’ function and the safety patients could expect, products belonging to the affected group or series could be classified as defective without proving the individual defect in each device. Necessary replacement surgery could constitute compensable personal injury damage.

Relevance to AI liability by analogy: The judgment is relevant to shared safety defects across products, including potentially AI-enabled medical devices.

Example: Evidence that a common software version creates a serious safety risk could be important across several devices using that version.

Limit: This was a medical-device product liability ruling. It does not establish that every shared model error makes every deployment legally defective. curia.europa.eu

Case 5: N.W. and Others v Sanofi Pasteur MSD, Case C-621/15, Court of Justice of the European Union, 21 June 2017

Facts: A claim alleged that a hepatitis B vaccine caused multiple sclerosis, raising questions about proof in the absence of scientific consensus.

Decision: National evidential rules could permit defect and causation to be established through serious, specific, and consistent evidence, subject to safeguards. The claimant’s burden of proof could not simply be displaced through automatic presumptions.

Relevance to AI liability by analogy: A claimant may face technical uncertainty without having direct access to every internal mechanism of a system. Circumstantial and expert evidence may therefore matter.

Example: Logs, repeatable failures, incident reports, and expert testing could collectively support an argument about a harmful system malfunction.

Limit: The judgment neither creates an AI-specific presumption nor permits causation to be inferred merely because harm followed use of a technology. Cour de justice de l’Union européenne

Case 6: Quoine Pte Ltd v B2C2 Ltd, [2020] SGCA(I) 02, Singapore Court of Appeal, 24 February 2020

Facts: Automated cryptocurrency trades occurred at highly abnormal exchange rates. The platform operator subsequently reversed them.

Decision: The majority upheld the breach-of-contract claim because the operator lacked a contractual entitlement to reverse the transactions. It also considered unilateral mistake in automated contracting, examining the relevant programmer’s knowledge in relation to the deterministic algorithm. The breach-of-trust finding was reversed.

Relevance to AI liability: Automated execution does not remove transactions from ordinary contractual analysis. Contract terms, attribution, mistake, and authority remain important.

Example: A business cannot necessarily cancel an automated transaction simply because its system produced an unexpected commercial outcome.

Limit: The algorithm was deterministic. The reasoning cannot be transferred mechanically to adaptive machine-learning systems. elitigation.sg

Case 7: R (Bridges) v Chief Constable of South Wales Police, [2020] EWCA Civ 1058, Court of Appeal, 11 August 2020

Facts: Police use of live automated facial recognition was challenged under human rights, data protection, and equality law.

Decision: The Court of Appeal found deficiencies concerning the legal framework’s limits on discretion, the data protection impact assessment, and compliance with the public sector equality duty.

Relevance to AI liability: Lawful deployment requires more than acquiring technology from a supplier. Decisions about watchlists, operating locations, impact assessment, and potential bias are legally significant.

Example: A deploying authority may have independent obligations to investigate discriminatory effects rather than relying entirely on a vendor’s assurances.

Limit: This was a public-law challenge. It did not establish a general private damages entitlement for everyone scanned by facial recognition technology. judiciary.uk

5. The most difficult issues in an AI compensation claim

Identifying the responsible defendant

An AI supply chain may include a foundation-model developer, application developer, integrator, data supplier, deploying organisation, and professional user.

Their potential responsibility depends on their respective conduct and legal obligations. For example:

This is an investigative framework, not a rule that every listed actor is automatically liable.

Proving causation

A claimant must connect the actionable failure to the harm.

Suppose diagnostic AI misses a tumour. Relevant questions include whether the system was defective, whether the clinician used it appropriately, whether independent review would have identified the tumour, and whether earlier diagnosis would have changed the patient’s outcome.

A poor output, professional negligence, and an unavoidable medical outcome must be examined separately.

Obtaining evidence

Useful evidence may include:

• The model and software version used.
• Inputs, outputs, and operational logs.
• Testing and validation records.
• Instructions and warnings.
• Update history and previous incidents.
• Records showing what human reviewers actually did.

Technical opacity is therefore both an engineering issue and a procedural issue concerning access to proof.

Distinguishing kinds of loss

Physical injury, property damage, lost profits, distress, reputational harm, and discrimination are not interchangeable categories.

A defective-product claim may cover particular injuries while leaving a purely commercial loss to contract law. A data protection claim may provide compensation for proven non-material damage while requiring an infringement and causation. Selecting the correct cause of action is often as important as identifying the technical error.

6. Applying the comparison to an automated lending example

Assume a bank rejects a loan because its scoring system incorrectly treats a customer as a serious credit risk.

The legal analysis would proceed through several questions:

1. Data accuracy: Did the system use incorrect personal information?
2. Decision-making: Did the score determine the refusal, and was any human review meaningful?
3. Explanation: Can the customer understand and challenge the relevant processing?
4. Conduct: Did the bank or supplier fail to meet an applicable duty?
5. Damage: Did the customer suffer demonstrable financial or non-material harm?
6. Causation: Would a lawful and accurate assessment probably have produced a different outcome?

SCHUFA informs the automated-decision question; Dun & Bradstreet Austria informs explanation rights; and Österreichische Post governs the basic GDPR compensation requirements. National contract and tort law may supply additional routes.

The central comparative principle is that AI autonomy does not itself settle legal responsibility. A successful civil claim identifies the relevant human or corporate obligation, establishes its breach or another applicable liability condition, and connects that condition to legally recoverable harm.