Civil Law and UAE Liability Fragmentation in Automated Decision Systems

1. Introduction

Liability fragmentation in automated decision systems occurs when a harmful decision is produced by several interconnected actors rather than by one clearly identifiable decision-maker.

For example, an automated UAE lending system may involve:

• a bank or financial institution;
• an AI/software developer;
• a cloud-service provider;
• a data provider;
• an algorithm or analytics provider;
• a cybersecurity provider;
• an employee supervising the system; and
• a customer or third party whose data is processed.

If the system wrongly rejects a loan, freezes an account, incorrectly classifies a customer, causes financial loss, or makes an inaccurate automated assessment, the difficult legal question is:

Who is legally responsible for the resulting damage?

UAE civil law does not generally treat “the algorithm” as a separate legal person. Liability therefore has to be allocated among legally responsible persons and entities by examining contract, statutory duties, fault, causation, damage, evidence, agency, control, and the actual role played by each participant.

2. Meaning of Liability Fragmentation

Liability fragmentation means that responsibility for one harmful outcome is distributed across multiple legal relationships.

A simplified model is:

Data Provider → AI Developer → Platform → Cloud Provider → Human Operator → Customer

A failure at any point can contribute to the final harm.

For example:

Incorrect data → defective model → automated decision → inadequate human review → financial loss.

The claimant may therefore face difficulty identifying whether the loss resulted from:

1. defective data;
2. defective software;
3. inadequate system design;
4. negligent implementation;
5. unauthorized use;
6. failure of supervision;
7. cybersecurity failure;
8. contractual breach; or
9. an independent external event.

3. UAE Legal Framework

Several areas of UAE law may become relevant.

A. Civil Transactions Law

Federal Law No. 5 of 1985, as amended, provides the general civil-law framework concerning:

• contractual obligations;
• performance of obligations;
• good faith;
• fault;
• causation;
• compensation;
• damage;
• abuse of rights; and
• liability arising from wrongful conduct.

B. UAE Evidence Law

Federal Decree-Law No. 35 of 2022 is particularly important because automated decisions generate extensive electronic evidence, including:

• system logs;
• transaction records;
• metadata;
• audit trails;
• electronic communications;
• model outputs;
• access records; and
• technical reports.

C. Electronic Transactions and Trust Services

Federal Decree-Law No. 46 of 2021 provides an important framework for electronic transactions, electronic records, electronic signatures and trust services.

D. Personal Data Protection

Federal Decree-Law No. 45 of 2021 can become relevant where automated decision-making involves personal data.

Potential issues include:

• lawful processing;
• data security;
• accuracy;
• data governance;
• accountability; and
• cross-border processing.

E. Consumer Protection

Federal Law No. 15 of 2020 may become relevant where automated systems affect consumers.

F. Civil Procedure

Federal Decree-Law No. 42 of 2022 becomes relevant to:

• litigation;
• expert evidence;
• procedural orders;
• enforcement; and
• judicial determination of responsibility.

4. Why Automated Systems Create Fragmented Liability

Traditional civil liability often assumes a relatively understandable relationship:

Person A → obligation → Person B → breach → damage.

Automated systems can instead produce:

Data provider → algorithm developer → integrator → platform → cloud provider → automated output → human supervisor → claimant.

Consequently, several different legal relationships may exist simultaneously.

For example:

The important principle is:

Participation in an automated ecosystem does not automatically create liability.

There must normally be a legally recognizable basis connecting the defendant to the harm.

5. Contractual Liability

Contract is usually the first place to examine.

Suppose a UAE company purchases an automated credit-scoring system.

The contract may allocate responsibilities concerning:

• accuracy;
• system availability;
• cybersecurity;
• maintenance;
• data quality;
• model performance;
• regulatory compliance;
• warranties;
• indemnities;
• liability caps; and
• service levels.

If the developer breaches a contractual obligation and that breach causes loss, contractual liability may arise.

Example

A developer promises that its automated system will process specified data according to agreed specifications.

The system instead uses an incorrect data field, producing thousands of erroneous decisions.

The customer may argue that the developer breached its contractual obligations.

But if the customer supplied incorrect data, responsibility may shift or be divided depending on the contract and causation.

6. Tortious or Non-Contractual Liability

A claimant may sometimes lack a direct contract with the actor responsible for the technological failure.

For example:

Consumer → Platform → AI provider

The consumer may have no contract directly with the AI provider.

The question then becomes whether the AI provider's conduct independently gives rise to a civil wrong.

Relevant questions include:

1. Was there a legally recognized duty?
2. Was there fault or wrongful conduct?
3. Did the conduct cause the damage?
4. Was the damage sufficiently connected to the conduct?
5. Is the damage legally compensable?

7. The Causation Problem

Causation is one of the most difficult issues in automated liability.

Suppose an automated insurance system incorrectly rejects a claim.

There may be five possible causes:

• inaccurate customer information;
• defective training data;
• software error;
• improper configuration by the insurer; and
• failure of human review.

The claimant must establish the legally relevant causal connection between the conduct and the damage.

The existence of an algorithmic error alone does not necessarily establish that every participant is liable.

8. Concurrent Causes

Automated systems frequently involve multiple contributing causes.

For example:

Data provider supplies inaccurate information + software incorrectly processes it + platform fails to conduct validation.

The resulting harm may therefore have several causal components.

The court may need to determine:

• which acts were legally significant;
• whether one cause superseded another;
• whether the damage was foreseeable;
• whether contractual allocation applies;
• whether the claimant contributed to the loss; and
• whether the evidence establishes causation.

This makes expert evidence particularly important.

9. Role of Human Oversight

Automation does not necessarily eliminate human responsibility.

A company deploying an automated system may retain responsibility for:

• selecting the system;
• configuring it;
• monitoring it;
• validating its output;
• maintaining safeguards;
• responding to errors; and
• deciding when human intervention is required.

A useful distinction is:

Fully automated processing

The system produces an output without meaningful human intervention.

Human-supervised automation

The system produces a recommendation or decision that an authorized person reviews.

Human-in-the-loop system

The human makes the final legal or commercial decision using automated information.

The degree of human involvement can affect the analysis of responsibility.

10. AI Developer Liability

An AI developer may potentially face responsibility where:

• the software does not meet contractual specifications;
• known defects are not disclosed;
• security vulnerabilities are inadequately addressed;
• documentation is materially deficient;
• agreed performance obligations are breached; or
• negligent development causes legally compensable damage.

However, the developer should not automatically be responsible for every downstream decision.

For example, if an AI system operates correctly according to specifications but the customer improperly configures it, the customer's conduct may become the legally significant cause.

11. Platform Operator Liability

The platform operator often occupies the central position in the ecosystem.

It may control:

• user access;
• system configuration;
• data flows;
• automated rules;
• account restrictions;
• transaction approvals;
• human escalation; and
• customer communications.

Consequently, courts may need to distinguish between:

technology supplied by another party

and

the platform's own use of that technology.

A platform cannot necessarily avoid every legal responsibility merely by saying:

“The algorithm made the decision.”

The legal question is who had the relevant duty and control.

12. Cloud Provider Liability

Cloud infrastructure can create another layer of fragmentation.

A cloud provider may store:

• customer data;
• model files;
• transaction records;
• system logs;
• authentication information; and
• backups.

A cloud failure may therefore contribute to loss.

However, infrastructure availability does not automatically make the cloud provider responsible for the substantive decision produced by an application operating on that infrastructure.

Responsibility should generally be connected to the provider's actual contractual obligations and conduct.

13. Data Provider Liability

Automated systems are heavily dependent on data.

A data provider may become relevant where:

• information is inaccurate;
• information is incomplete;
• data is outdated;
• data is improperly obtained;
• identity information is incorrectly matched; or
• data is supplied contrary to contractual requirements.

For example:

Incorrect identity information → incorrect risk profile → automated account restriction → financial loss.

The data problem may be an important causal component.

14. Cybersecurity and Automated Decisions

Cybersecurity failures can produce additional liability fragmentation.

Suppose:

1. a platform's security controls fail;
2. an attacker changes data;
3. an automated system processes the altered data;
4. the system makes an incorrect decision; and
5. the customer suffers loss.

Potentially relevant actors may include:

• the platform;
• cybersecurity provider;
• cloud provider;
• data processor; and
• system administrator.

The court must determine where the legally significant failure occurred.

15. Personal Data and Automated Decisions

Automated decisions frequently process personal information.

This creates an additional regulatory layer.

Issues may include:

• lawful processing;
• accuracy;
• security;
• access;
• correction;
• data minimization;
• accountability;
• processor/controller responsibilities; and
• cross-border transfers.

Therefore, the same event may produce:

civil liability + data-protection consequences + contractual consequences.

These should not automatically be treated as identical forms of liability.

16. Evidentiary Fragmentation

Automated systems produce enormous amounts of evidence.

Relevant evidence may include:

• source code;
• model documentation;
• system logs;
• API logs;
• timestamps;
• database records;
• audit trails;
• electronic signatures;
• access credentials;
• configuration files;
• model versions;
• training-data records;
• emails;
• contracts; and
• expert reports.

The claimant may face a practical problem:

The person harmed by the automated system may not possess the technical evidence necessary to explain what happened.

This makes disclosure, expert examination, electronic evidence and preservation particularly important.

17. Explainability and Liability

Explainability is not merely an AI ethics issue.

It can become a civil-law issue because a court must determine:

• what happened;
• who controlled the system;
• what information was used;
• whether the system operated as designed;
• whether a contractual obligation was breached; and
• whether the alleged conduct caused damage.

A technically opaque system can therefore make ordinary civil-law concepts such as fault and causation more difficult to prove.

18. Vicarious and Organizational Responsibility

Where employees operate automated systems, the employer may face questions concerning organizational responsibility.

Examples include:

• employee improperly configuring an algorithm;
• employee ignoring system alerts;
• employee approving an automated decision despite obvious errors;
• employee misusing data; or
• employee disabling safety controls.

The legal analysis depends upon the applicable rules governing employment, agency and civil responsibility.

19. Contractual Allocation of Automated-System Risk

Sophisticated contracts can reduce fragmentation by expressly allocating risk.

Important clauses include:

1. Data responsibility clause

Defines who is responsible for data accuracy.

2. Model responsibility clause

Defines developer responsibilities.

3. Human-review clause

Specifies when human intervention is required.

4. Audit clause

Allows inspection of system records.

5. Incident-reporting clause

Requires notification of system failures.

6. Indemnity clause

Allocates specified categories of losses.

7. Limitation-of-liability clause

Establishes agreed limits subject to applicable law.

8. Change-management clause

Controls modifications to algorithms and models.

9. Evidence-preservation clause

Requires retention of logs and relevant records.

10. Regulatory-compliance clause

Allocates responsibility for legal and regulatory obligations.

20. UAE Case Law and Judicial Principles

Because UAE law belongs primarily to a civil-law tradition, UAE judgments should not automatically be treated as common-law precedents. Federal Supreme Court jurisprudence is nevertheless important for understanding how statutory provisions and civil-law principles are applied.

The following authorities are particularly useful for understanding fragmented liability and related questions.

Case 1: DNB Bank ASA v Gulf Eyadah Corporation & Gulf Navigation Holding PJSC

This litigation is important in the UAE cross-border enforcement context.

Its broader relevance to automated systems lies in demonstrating that a technologically or commercially complex transaction can involve multiple jurisdictions, contractual relationships, court proceedings and enforcement mechanisms.

For automated systems, the same principle is important:

A technologically complex transaction must still be analysed through identifiable legal relationships and jurisdictional rules.

Case 2: NMC Healthcare Ltd v Dubai Islamic Bank PJSC

This litigation illustrates the importance of contractual obligations, enforcement and procedural questions in complex commercial relationships.

Its relevance to automated systems includes the proposition that technological complexity does not eliminate ordinary legal questions concerning:

• contractual obligations;
• evidence;
• enforcement;
• jurisdiction; and
• remedies.

An AI-generated outcome must ultimately be connected to an identifiable legal obligation.

Case 3: Gulf Navigation Holding PJSC v DNB Bank ASA

This group of UAE/DIFC-related litigation demonstrates the difficulties that arise where commercial disputes cross institutional and jurisdictional boundaries.

For automated decision systems, it is relevant to situations involving:

• multinational AI providers;
• foreign cloud providers;
• UAE platforms;
• cross-border data;
• foreign governing law; and
• competing enforcement forums.

The important lesson is that forum and jurisdiction can be as important as substantive liability.

Case 4: Federal Supreme Court jurisprudence on contractual good faith

UAE Federal Supreme Court jurisprudence concerning good faith supports the principle that contractual rights and obligations should not be analysed mechanically without considering the parties' contractual relationship and proper performance of obligations.

In automated systems, this becomes relevant where:

• a party technically complies with a contract but defeats its commercial purpose;
• an automated system is knowingly deployed in a defective manner;
• a party conceals material system limitations; or
• contractual rights are exercised in a manner inconsistent with good-faith performance.

Case 5: Federal Supreme Court jurisprudence on abuse of rights

UAE civil law recognises the doctrine of abuse of rights.

This jurisprudence is relevant to automated systems because a technically available contractual or technological power may still require examination of whether its exercise falls within legally permissible limits.

Examples include:

• automated account termination;
• automated suspension of a contractual service;
• automated enforcement of penalties;
• excessive use of platform control; and
• deployment of an automated mechanism for an improper purpose.

The existence of contractual authority is therefore not necessarily the end of the legal analysis.

Case 6: Federal Supreme Court jurisprudence on causation and damages

Federal Supreme Court jurisprudence concerning civil damages emphasises the relationship between wrongful conduct, causation and legally compensable damage.

This is particularly important for algorithmic liability.

A claimant may establish that:

“The algorithm produced an incorrect result.”

But the court may still need to determine:

“Did the legally attributable conduct of this defendant cause the claimant's compensable loss?”

That distinction is fundamental to fragmented liability.

Case 7: Federal Supreme Court jurisprudence concerning expert evidence

UAE courts frequently rely upon technical expertise where disputes involve matters outside ordinary judicial knowledge.

This is particularly relevant to AI systems because judges may require experts to examine:

• software architecture;
• system logs;
• data integrity;
• cybersecurity;
• algorithmic processes;
• causation;
• system configuration; and
• technical failures.

However, an expert generally assists the court on technical matters; the ultimate legal determination of liability remains a judicial function.

21. DIFC Electronic-Signature Jurisprudence

Certain DIFC decisions are particularly useful for understanding automated-system evidence and attribution.

ICICI Bank Limited v Bavaguthu Raghuram Shetty

This case illustrates the importance of examining electronic signatures, attribution, authority and the surrounding evidence rather than treating electronic form alone as determinative.

GFH Capital Ltd v David Lawrence Haigh

The case is useful for understanding electronic communications, authorization, access and evidence in sophisticated commercial transactions.

Ondina v Olin

This decision illustrates the importance of electronic communications and electronic signatures within the DIFC legal framework.

Naho v Neukirchi

The case demonstrates how electronic communications can become relevant to questions of signature, intention and contractual formation.

Jonathan Lau v Qashio Holding Company Ltd & Armin Moradi Tosarvandani

This litigation is particularly useful when considering native electronic records, metadata, DocuSign records and audit trails.

Dimension B+ Ltd v Saleh Abdelkarim Hussain Abdelrahman Almaazmi

This dispute illustrates the evidentiary importance of disputed electronic signatures and questions concerning consent and attribution.

These cases are not necessarily cases about AI liability itself. Their importance is analogical and evidentiary: automated decision disputes will often depend upon proving what a digital system did, who authorized it, and whether the electronic records reliably establish that fact.

22. Liability Matrix for Automated Systems

A practical UAE analysis can use the following matrix:

23. Chain of Liability

A useful model is:

Input → Processing → Algorithm → Output → Human Action → Harm

At each stage ask:

Stage 1 — Input

Who supplied the information?

Stage 2 — Processing

Who processed and transformed it?

Stage 3 — Algorithm

Who developed or configured the model?

Stage 4 — Output

Who received and relied upon the automated result?

Stage 5 — Human action

Who implemented the result?

Stage 6 — Harm

What actual damage occurred?

Stage 7 — Legal attribution

Which participant's legally relevant conduct caused that damage?

24. Avoiding “Algorithmic Black-Box Liability”

A defendant should not automatically escape responsibility by arguing:

“The algorithm did it.”

Likewise, a claimant should not automatically establish liability by saying:

“The algorithm was wrong.”

The proper legal inquiry remains:

Duty → Conduct → Breach/Fault → Causation → Damage → Remedy

The algorithm is evidence about how the event occurred; it is not automatically the legal subject of responsibility.

25. Joint or Multiple Liability Problems

A particularly difficult situation occurs where several parties independently contribute to the same damage.

For example:

• data provider supplies incorrect information;
• AI developer fails to detect the anomaly;
• platform deploys the model;
• human reviewer ignores warning signals.

The court may need to determine the legal consequences of each participant's conduct under the applicable UAE rules.

This is why contracts should contain clear provisions concerning:

• responsibility;
• indemnification;
• contribution;
• insurance;
• audit rights;
• system testing;
• data accuracy;
• incident response; and
• limitation of liability.

26. Automated Decisions in Banking and Fintech

Financial systems provide an important example.

An automated system might:

• approve or reject transactions;
• detect fraud;
• freeze accounts;
• assess credit;
• identify suspicious transactions;
• determine risk levels.

A wrongful decision may cause:

• financial loss;
• business interruption;
• reputational damage;
• contractual breach; or
• regulatory consequences.

Responsibility may potentially involve the bank, fintech provider, technology vendor, data provider and cybersecurity provider.

The central question remains legal attribution, not simply technical causation.

27. Automated Decisions in Employment

Automated HR systems may:

• rank applicants;
• screen CVs;
• allocate shifts;
• calculate performance scores;
• monitor productivity.

If the system produces an incorrect employment decision, responsibility may involve:

• employer;
• software provider;
• data provider;
• HR department; and
• human decision-maker.

The employer's use of third-party technology does not necessarily transfer all legal responsibility away from the employer.

28. Automated Consumer Decisions

Consumer-facing systems create additional complexity.

Examples include:

• automated refunds;
• fraud blocking;
• dynamic pricing;
• account suspension;
• automated complaint handling;
• credit assessment.

The Consumer Protection framework may become relevant alongside general civil-law principles.

The claimant may have both:

contractual rights

and

statutory consumer protections.

29. Automated Contract Execution

Smart contracts create a related problem.

A smart contract may automatically:

• transfer assets;
• impose a payment;
• release escrow;
• suspend access; or
• trigger contractual consequences.

The fact that execution is automatic does not answer the legal question of whether the underlying transaction was:

• valid;
• authorized;
• properly performed;
• affected by mistake;
• affected by fraud; or
• subject to a contractual defence.

Therefore:

Automatic execution is not equivalent to automatic legal validity.

30. Remedies

Possible remedies depend upon the applicable legal relationship and facts.

They may include:

• compensation for proven loss;
• contractual damages;
• agreed compensation where legally enforceable;
• restoration or correction;
• injunction-type relief where available;
• contractual termination;
• rectification of records;
• return of improperly transferred property;
• enforcement of contractual indemnities; and
• other appropriate judicial relief.

The remedy must correspond to the legally established wrong and damage.

31. Practical Method for UAE Courts

A structured judicial approach could be:

Step 1 — Identify the automated system

What decision did it make?

Step 2 — Identify all participants

Who designed, supplied, configured, operated and supervised it?

Step 3 — Identify legal relationships

Which parties had contracts?

Step 4 — Identify duties

What contractual, statutory or civil duties existed?

Step 5 — Examine evidence

What do the logs, records, contracts and expert reports establish?

Step 6 — Determine breach or wrongful conduct

Which actor failed to perform the relevant obligation?

Step 7 — Determine causation

Did that conduct cause the damage?

Step 8 — Consider contributing causes

Did another party or the claimant contribute?

Step 9 — Consider contractual allocation

Do indemnities, warranties or limitation clauses apply?

Step 10 — Determine remedy

What compensation or other relief is legally appropriate?

32. Important Legal Principle

The most important principle is:

Automated decision-making should not produce “liability by association.”

A party should not become liable merely because it participated somewhere in the technological ecosystem.

Similarly, responsibility should not disappear merely because the immediate cause was an automated process.

The correct approach is to trace responsibility through:

Role → Duty → Conduct → Causation → Damage → Remedy.

33. Exam-Oriented Revision Points

Remember these points:

1. Liability fragmentation arises when multiple actors contribute to an automated decision.
2. An algorithm is generally not treated as an independent legal person.
3. Contract is an important basis for allocating technological responsibility.
4. Tortious/non-contractual liability may arise independently of contract where applicable.
5. Causation is often the hardest issue.
6. Data quality can affect liability.
7. AI developers are not automatically responsible for every downstream result.
8. Platform operators may retain responsibility for their own deployment and control.
9. Human oversight can be legally significant.
10. Electronic evidence is crucial.
11. Expert evidence may be necessary to explain technical causation.
12. UAE good-faith principles remain relevant to automated contractual relationships.
13. Abuse-of-right principles may become relevant to excessive automated powers.
14. Data-protection obligations may operate alongside civil liability.
15. Consumer protection may create additional obligations.
16. Contracts should expressly allocate AI and technology risks.
17. Cross-border systems create jurisdiction and enforcement issues.
18. DIFC/ADGM and mainland UAE frameworks must be distinguished where applicable.
19. Automated execution does not automatically establish legal validity.
20. The central formula is:

Liability = Duty + Breach/Fault + Causation + Damage + Legal Attribution.

34. Conclusion

Liability fragmentation in automated decision systems represents a major challenge for UAE civil law because technological decisions are increasingly produced through networks of companies, software, data, infrastructure and human supervision.

The solution is not to create automatic liability for every participant. Instead, UAE civil-law analysis should identify the precise legal relationship and responsibility of each actor.

The most useful framework is:

Identify the actor → identify the duty → examine the conduct → establish causation → prove damage → allocate responsibility → determine the remedy.

The principles of contractual good faith, abuse of rights, causation, damages, electronic evidence and expert evidence, together with UAE legislation on electronic transactions, personal data, consumer protection and evidence, provide the foundations for resolving these disputes.

Thus, the future of UAE automated-decision liability is likely to depend less on asking “Who owns the algorithm?” and more on asking “Who had the legal duty, who exercised control, what happened, and what evidence establishes the causal connection?”