I. Introduction
Artificial intelligence (AI) not only entails societal benefits but also raises concerns about the risks involved. One of the key questions in this respect is whether current liability regimes have evolved sufficiently to deal with AI-related harm. Most authors agree that, for example, the European Product Liability Directive (PLD)Footnote 1 might not suffice for a variety of reasons, the most important one being that the PLD was drafted for addressing mass-produced goods in an era when the manufacturer controlled the risks and was therefore strictly liable for damage resulting from product defects.Footnote 2 This idea is outdated from the standpoint of the more dynamic era of new technologies, where not only traditional producers but also software developers and operators may be the cause of product-related harm.
In this article, we discuss the liability for AI-related harm and, in particular, the recent European Union (EU) policy developments in the light of a law and economics framework. The advantage of the law and economics approach is that it provides a clear benchmark (social welfare) that helps in choosing suitable liability rules while taking into consideration the most important goals of such rules, namely deterrence and risk spreading. Therefore, our discussion does not touch upon the sphere of distribution issue.
More specifically, we endeavour to address two questions. First, what is, from a law and economics perspective, an optimal allocation of liability for AI-related harm? Second, to what extent do recent EU policy proposals reflect this optimal allocation? Our contribution to the scholarly discussion concerning the regulation of AI is twofold. First, this article provides a law and economics perspective for determining optimal liability rules for different parties along the value chain. Second, based on the economic lessons, we seek to highlight problems and ambiguities within the recent European proposals.
This article contains four substantive sections. We start with a concise discussion concerning the basic questions pertaining to liability for AI-related harm (Section II), and then we present the basic economic model of tort law when dealing with accidents (Section III). We continue our analysis by explaining how this basic economic model can help to determine the most suitable liability rules in the context of AI-related harm (Section IV). Finally, we present a detailed critical analysis regarding the recent EU proposals (Section V).
II. Liability for AI-related harm: setting the scene
1. AI: disruptions and risks
AI refers to a disruptive technology that can achieve specific goals by acting intelligently, in a “human-like” manner. AI differs from traditional pre-programmable software because of its ability to learn, make autonomous decisions and adjust.Footnote 3 The notion of an “AI system” is rather broad: if a machine or computer program can act with a degree of autonomy, it can be called an AI system, regardless of whether it is a component of another product or standalone software.
Just as with humans, AI may make errors that cause harm, and this harm may be material or non-material. For example, AI in medical devices or autonomous vehicles (AVs) can physically harm persons or property as well as cause pain or other suffering. AI systems can also cause different economic losses.Footnote 4 For instance, a malfunction of a road management system may result in congestion, which can lead to further losses, such as the loss of opportunity of concluding a business contract.
The potential of AI to cause harm calls for an urgent consideration of the ways to reduce such accidents. The first issue in this context is whether or not human beings should be kept “in the loop”.Footnote 5 More specifically, commentators have raised the question of whether AI systems should be assigned legal personhood in order to hold them accountable for AI-related harm. This approach, however, has been criticised not only because it ignores human oversight, but also due to its infeasibility when one considers, for example, the financial resources needed for compensation. Footnote 6 Assigning legal personhood and “personal liability” to AI systems has not received any significant support at the European level. Footnote 7 In addition, it is generally agreed that human oversight is necessary and that AI systems should not, at this point, be independent actors from a legal standpoint. Footnote 8 The existing policy debates take it as their starting point that regulation should concern the humans and entities that produce and control AI applications. It is therefore imperative to provide these actors with incentives to behave appropriately. Some features of AI, however, make risk allocation a challenging task.
First, many stakeholders and producers are involved, making it a complex task to discern the party that has caused the harm. There are parties that participate in creating a standalone AI system or a product that embeds such a system, but also parties who exercise control over the operation of an AI system.Footnote 9 Deciding how the behaviour of each of these parties should be controlled constitutes quite a challenge for regulators.
Second, the decision-making process of an AI system can be opaque. Unlike programmable machines, whose operation is predictable within the limitations of the software, an AI system is a non-transparent “black box”.Footnote 10 This opaque decision-making may generate more risk that is unknown to stakeholders, and it complicates the assessment of the probability that a harm will occur.Footnote 11 Additionally, the number of situations in which every party has behaved appropriately but an accident nonetheless occurs can increase.Footnote 12
Third, the operation of an AI system is fully or partially autonomous.Footnote 13 This increasing autonomy blurs the relationship between humans and machines.Footnote 14 This may further complicate the determination of optimal liability rules among different parties.
2. Regulating AI-related risks via extra-contractual liability
Reducing risk does not necessarily require legal instruments.Footnote 15 Risk can be optimally allocated among different parties through bargaining, if the parties in question are able to bargain with each other in a frictionless manner and all of them hold the perfect information necessary to detect the factors that can affect such risk.Footnote 16 In ideal circumstances, any legal intervention is unnecessary and inefficient, because it can result in additional transaction costs.Footnote 17
Legal instruments, however, become indispensable when contracting over risk allocation cannot result in an optimal outcome. If transaction costs are high or where there is information asymmetry, parties might not be able to agree on efficient risk allocation.Footnote 18 This happens with AI systems as well. Different parties along the supply chain may represent different legal entities and possess different amounts of information regarding the AI system. Moreover, in some cases victims are third parties that are not in contractual relationships with any of the AI stakeholders. Hence, extra-contractual liability is a crucial tool in providing the parties involved with incentives to behave appropriately, especially when no bargaining can be arranged prior to the accident.Footnote 19
3. Towards European extra-contractual liability rules?
EU-level documents thus far have discussed both liability for AI-related harm in general terms and the more specific question of revising the EU product liability regime. For the purposes of this article, both themes are relevant, as we endeavour to discuss the optimisation of extra-contractual liability rules regardless of whether they are generally applicable or limited to product liability. As of yet, the EU legislator has issued neither general AI liability rules nor final drafts; only tentative plans have emerged.
In 2017, an early Resolution of the European Parliament noted the need to set up a common liability framework in the EU for AI-related harm.Footnote 20 A broad Communication on “Artificial Intelligence for Europe” was then introduced by the European Commission in 2018.Footnote 21 This resulted, among other things, in the establishment of an Expert Group on Liability and New Technologies. It has two subgroups: the Product Liability Directive Formation and the New Technologies Formation (EG-NTF).
In 2020, the Commission’s “White Paper on Artificial Intelligence” stated that the risks involved in the use of AI systems should be addressed by legislative meansFootnote 22 and underlined the obligations of human actors.Footnote 23 Additionally, the Commission ReportFootnote 24 of the same year emphasised that besides ensuring compensation for victims, liability rules should also “provide economic incentives for the culpable parties to avoid causing such damage”.Footnote 25
The Final Report of the EG-NTF (2019) sets out that liability rules should cover all key parties along the supply chain as well as the whole lifespan of AI systems. According to that Report, “one reason why existing rules on liability may produce unsatisfactory results is that loss resulting from emerging digital technologies is not allocated to the party who is the most appropriate to bear the loss” (emphasis added). It added that losses should be borne by the cheapest cost-avoiders or cheapest insurance-takers.Footnote 26 Furthermore, harm caused by a defective emerging digital technology should trigger strict producer liability, irrespective of whether the technology is in tangible or digital form.Footnote 27
In 2020, the European Parliament issued a Resolution (EP Resolution) on civil liability for AI.Footnote 28 It called for an evaluation of the PLDFootnote 29 as well as setting out a proposal concerning the operators of AI systems. The proposed regime is premised on several key arguments of the EG-NTF Report. A risk-based approach is proposed: operators of high-risk AI systems should be subject to strict liability, and others should be subject to fault-based liability.Footnote 30 Turning to the general regulation of AI, in 2021 the Commission published a proposal for the so-called Artificial Intelligence Act (AI Act), which concerns the obligations of those who develop and deploy AI systems.Footnote 31 However, this draft AI Act does not contain any comprehensive liability rules.
At present, EU legislators are investigating the necessity of adapting the product liability rules as well as domestic liability rules for AI.Footnote 32 The Commission held a public consultation regarding this domain. Over 60% of the received responses indicated that liability rules should be further adapted in order to enhance trust in AI systems.Footnote 33
There has also been an extensive discussion of the liability for AI-related harm in academia. For example, the members of the EG-NTF were invited to further clarify the findings of their reportFootnote 34 – and they have expressed their views in the abovementioned public consultation.Footnote 35 Moreover, the inadequacy of the current product liability rulesFootnote 36 as well as the problems of the EP ResolutionFootnote 37 are being expounded by scholars.
III. The basic economic model of determining the optimal liability rule
In general, liability rules are either fault-based or strict. According to the theory of tort law and economics, social welfare serves as the criterion to determine which type of liability rule is appropriate to deal with accidents.Footnote 38 One liability rule will be more desirable than the others if it can result in a higher level of social welfare. Social welfare is not only influenced by the deterrent effect of liability rules, but also depends on the risk-shifting effect.Footnote 39 In this section, we explain how to identify a desirable liability rule when these two factors are considered.
1. Deterrence as a factor in determining optimal liability rules
From an economic perspective, the primary goal of liability rules is deterrence.Footnote 40 In a bilateral accident, where both the tortfeasor and victim contribute to an accident, a socially optimal outcome can be achieved if a liability rule can optimise the behaviour of all of the parties.Footnote 41 Whether a liability rule can achieve the socially optimal outcome depends on two variables.
On the one hand, social welfare is influenced by the precautionary measures taken by the parties. A desirable liability rule will provide the parties with an incentive to take an optimal level of care.Footnote 42 This is the point where the marginal costs of a precaution equal the marginal reduction of expected harm. By setting the due care level at this optimal level, either strict liability (with a contributory negligence defence) or a fault-based rule can induce all of the parties to take optimal precautions.Footnote 43
On the other hand, when all of the parties are expected to adopt an optimal level of care within either of the liability rule options, controlling the activity level becomes imperative.Footnote 44 In this situation, the activity level serves as the key variable to decide which liability rule prevails. Social welfare can be further improved if the relevant parties optimise their level of activity. The factors that have an impact on level of activity (such as personal utility and the intensity and frequency of an activity) can rarely be observed by outsiders.Footnote 45 By having the relevant parties internalise the accident cost, liability rules can offer the parties an incentive to optimise their level of activity. Ideally, liability rules incentivise all of the parties to adopt optimal activity level. However, economic models have proved that none of the existing liability rules can induce both parties to optimise their level of activity simultaneously.Footnote 46 This is because the residual risk that remains, when all of parties have been diligent, must be allocated to either tortfeasors (under strict liability) or victims (under fault-based liability).Footnote 47 Only the parties who are about to bear the residual risk have the incentive to further control their activity level.Footnote 48
In this regard, strict liability and fault-based rules lead to different outcomes when it comes to optimising the level of activity. By applying strict liability to specific tortfeasors, since these parties have to internalise the residual risk given that all parties are diligent, they will have an incentive to further optimise their activity level to minimise the risk borne by them. In contrast, if specific tortfeasors are subject to fault-based liability, they are not liable if they have adopted the required level of care. Hence, under fault-based rules, tortfeasors tend to adopt an excessive level of activity to maximise their personal utility.
From the deterrence perspective, therefore, the value of strict liability is to provide a party with an extra incentive to control their activities, especially when such activities are ultrahazardous with little value addition.Footnote 49 However, if adjusting the precautionary level can already appropriately control the behaviour of potential tortfeasors and reduce substantial accident costs, the benefit of controlling the activity level would be marginal, while possibly curbing valuable activities. In this case, fault-based rules would be preferable.
2. Risk-bearing as a factor in determining optimal liability rules
The efficiency of a liability rule is not only affected by its deterrent effect, but also by the effect of risk-shifting.Footnote 50 Risk-averse parties dislike uncertainties, and they prefer to shift an expected risk prior to accidents rather than to bear the losses after an accident occurs.Footnote 51 Social welfare increases if the risk is allocated to a risk-neutral (or less risk-averse) party (if such a party exists) or to a party that is easily able to spread losses. Hence, policymakers need to carefully evaluate the preferences of different parties and possible access to risk-shifting mechanisms.Footnote 52
In reality, there are also additional factors that play a role in risk-shifting.Footnote 53 These include (first-party or third-party) insurance as well as risk-sharing agreements. If risk-shifting tools are available, it is less important to allocate the risk initially to the less risk-averse party via liability rules. In other words, the deterrent effect is, then, the primary concern when deciding whether strict liability or negligence-based rules should prevail.Footnote 54
3. How the economic models influenced the liability rules in traditional mass production
In this subsection, we will explain how the liability rules applicable to different tortfeasors have usually been determined in the context of traditional mass production.
In early times, risks related to products arose from manufacturers and consumers. On the one hand, the risk could be created in the process of making the product; on the other hand, the careless behaviour of consumers could result in harm. Consumers and manufacturers could, in any event, easily meet each other in the market, and the former were able to visually evaluate the quality of a product. Therefore, the two parties could de facto allocate the risk by an agreement.Footnote 55 This has not been the case since the Industrial Revolution, and currently not only the main manufacturers and consumers, but also other parties in the supply chain could contribute to risks. As a consequence, it is complicated and costly to allocate risks (liability) by utilising contracts.Footnote 56 This was the background for introducing specific extra-contractual liability regimes regarding harm related to products.Footnote 57 The producers define the main technical features and functions of a product. They are responsible for employing qualified engineers to test the safety of products, examine their technical reliability and store all of the safety proxies and risk reports in the process of production. However, such information may not be equally accessed by courts, regulators and consumers.Footnote 58 Considering the substantial risk posed by the activity of producers, providing them with an incentive to optimise their activity level is crucial.Footnote 59
In addition, compared to consumers and third parties, producers are more capable of bearing the risk.Footnote 60 First, producers are supposed to be less risk-averse than other downstream parties and third-party victims, as they are normally entities (businesses) with assets.Footnote 61 Second, having borne the residual risk, without referring to additional risk-shifting mechanisms, producers can further spread the potential losses among consumers via the price mechanism.Footnote 62 Considering all of these factors as well as the risk posed by the producers’ actions, making producers strictly liable should reduce accident costs and deliver a higher level of social welfare.
Today, as multiple parties are involved in value chains, the situation of subsequent distributors and non-consumer operators must also be considered. These latter parties are responsible for reducing accident costs by controlling their own behaviour. Therefore, liability rules should also provide incentives to these parties along the supply chain. Whereas the main producers can define the essential features of products, these other parties cannot. Most of the risks are posed by their negligence in transiting or using the product. For these reasons, fault-based rules are normally applied to these parties.
IV. Liability for AI-related harm: a theoretical discussion
We will now apply the theoretical conclusions explained above to the AI context. In a value chain related to an AI system, multiple parties can pose a risk either by (contributing to) developing an AI system or by operating such a system.Footnote 63 Parties that contribute to the risk should be exposed to liability, taking into account their ability to invest in prevention and their risk-bearing capacity. We will discuss the liability of developers (Section IV.1) and then turn to operators (Section IV.2).
1. The liability of the “developers” of AI systems
Traditionally, it was considered that only producers of physical objects might give rise to risks. This is not, however, true anymore in the digital age, since standalone software, which is not embedded in any product, may pose risks as well.Footnote 64 Therefore, the old notion of “producers” – a key concept in the PLD and mainly referring to manufacturers of physical objects – is somewhat outdated.Footnote 65 However, the issue here is not whether we should call developers of AI systems “producers”. A more fundamental and important theoretical question is whether strict liability or fault-based rules should be applied to all developers. To address this issue, we need to go back to the criteria that have been explained in Section III.
In the era of AI, digital features have the potential to substantially affect the functioning and performance of a product.Footnote 66 The quality of an AI system might even be more important than the physical device.Footnote 67 Additionally, the developer of an AI system holds much information that cannot be easily accessed or understood by outsiders.Footnote 68 In particular, the utility gained from one algorithmic structure and the risk related to it may only be assessed in an accurate manner by the developer itself. From this perspective, developers should be considered as the party that can avoid the risk connected to the design process at the lowest cost, especially when compared to the victim.Footnote 69 Hence, it is imperative to provide developers with an extra incentive to control their activity beyond precautional measures. In addition, developers are often business entities and are therefore actors that have “deep pockets”.Footnote 70 According to the implications of economic analysis, developers should be placed under an incentive mechanism that is similar to the one applied to traditional producers.Footnote 71 By exposing the developers of AI systems to strict liability, a higher level of social welfare is expected to be reached.
In optimising the activity level of developers, the predictability of a risk should be taken into account.Footnote 72 Developers’ strict liability should be limited to the risk that can be predicted based on the state of the art.Footnote 73 These comments bring us back to the point that the primary goal of strict liability is deterrence. If the deterrent effect is marginal, a liability burden that is too heavy will mostly just curb beneficial activities.Footnote 74
2. The liability of the “operators” of AI systems
Operators of AI systems are in a position where they can create and reduce risks as well, and this calls for liability rules to provide them with incentives to behave appropriately. A key issue is whether operators should be subject to strict liability or fault-based rules. The features of AI systems as well as the context in which they are deployed complicate the assessment as to which parties should be induced to optimise their activity level. At least three factors should be considered in determining the operators’ liability in the era of AI.
a. The severity of risk
When strict liability and fault-based liability are being compared, one crucial question from the deterrence perspective is whether parties should be incentivised to further control their activity level even after the optimal level of precaution has been attained. The answers to this question, however, can vary from one scenario to another, depending on the severity of the potential harm related to the activity of an operator. The answer is in the affirmative if the activity of a certain party is ultrahazardous, since an additional incentive of behaving properly can reduce significant social losses.Footnote 75 In contrast, if a system only causes other than severe harm, it makes little sense to apply strict liability, which would inhibit useful activities.
It follows that a risk-based approach should be used to determine the liability of operators. In fact, such an approach is nothing novel. For example, legislators have recognised the important roles of those who keep or control dangerous assets such as animals, hazardous substances and vehicles.Footnote 76 Strict liability induces these parties to optimise their activity.Footnote 77 In most other cases, fault-based liability serves as the default regime for operators.Footnote 78
In the context of AI, however, the question that should be further addressed is: how are we to determine whether a specific application of AI is ultrahazardous or not?Footnote 79 The use of AI not only generates conventional safety risks, but also has been linked with, among others, threats to fundamental rights.Footnote 80 The law shall further crystallise the scope of ultrahazardous risks with regard to AI. One issue to be noted here is that while the materialised harm of some ultrahazardous risks cannot be easily remedied via the tort system (eg in the form of non-material harm or pure economic losses), it does not influence our evaluation of whether such ultrahazardous risks shall be deterred.Footnote 81 Deterrence and compensation are two different issues. We can further develop alternative mechanisms for the purpose of remedy besides the tort regime.
b. The heterogeneity of operators
The heterogeneity of operators raises further issues that should be considered. Traditionally, “operation” means that a party exercises a control over a thing and benefits from owning, deploying or using it. In the era of AI, the parties to which this applies are frontend-based. They may generate harm through their decision-making concerning matters such as when and how to operate the AI system, and it is therefore justified to provide the operators with incentives to behave appropriately.Footnote 82 As in traditional contexts, operators should be subject to fault-based liability in situations where AI systems cannot be described as particularly dangerous. Strict liability would not produce any significant benefit and might curb valuable activities. Strict liability for frontend operators cannot be easily justified unless the particular AI application is ultrahazardous.
In the context of AI applications, there are a variety of parties that exercise control over AI systems by offering essential and ongoing backend services.Footnote 83 These make sure that an AI system is able to properly interact with the environment, so that frontend operators as well as third parties can rely on the performance of AI systems. For example, when an AV is running on a road, its operation relies on the service provided by various backend parties, such as data providers, cloud service providers, road managers, navigation satellite system providers and so on. They influence the operation of an AI system not only via their strategic behaviour, but also, more importantly, through the functioning of their service.Footnote 84 It is difficult to discern whether a certain backend service is included in the same “system” as the actual AI application or whether it is a separable operational process.Footnote 85 In any event, the risk can be considered to be posed by the entire interactive system as a whole.
The role of backend operators has gone beyond our traditional understanding of what “operation” signifies, and the “borderline” between “operation” and “creation” is becoming elusive. The practical relevance of backend services in the context of many AI applications suggests that backend operators should be provided with incentives to optimise their activities rather than merely to respect the basic precautionary measures.Footnote 86 Considering the way in which developers and backend operators complement each other’s activities, it would be strange if they were subject to different liability rules. Unlike frontend operators, backend operators should therefore be subject to strict liability regardless of the nature of the AI application.
c. The level of automation and the degree of control
An AI system may be operated by more than one party. While backend operators will exercise control over the AI system on a continuous basis, frontend operators will determine its actual use. The implications of misbehaviour by frontend operators depend on the degree of control they have over an AI application.Footnote 87
It is usually assumed that by having frontend operators internalise some accident costs (via a fault-based liability) we are able to reduce social costs. This will provide frontend operators with incentives for efficient precaution. This incentive mechanism, however, may not work as expected in the era of AI. As the level of automation increases, the “space left” for a frontend operator to make decisions is limited. If an AI application is highly autonomous, frontend operators are less likely to cause severe accidents by their own actions. Therefore, exposing the frontend operators, in this situation, to a major burden of liability might not really reduce accidents.Footnote 88 However, even if a machine is operating autonomously, frontend operators should not be entirely immune from liability. Frontend operators may still contribute to accidents by failures to maintain or update their applications. In other words, a “driver” of an AV will never be a mere passenger considering their duties in safeguarding the operation of the vehicle.Footnote 89
3. Summary
The conclusion based on the law and economics analysis is, with respect to the liability of the developers of AI systems, straightforward: the developers of AI systems can usually be considered to have a substantial influence on accident risk. Therefore, it makes sense to hold them (strictly) liable.
The situation is, however, more complex as regards the operators of AI. It is reasonable that operators are liable for accidents, because operators may inflict harm. Nevertheless, all of the operators should not necessarily be subject to the same liability rule. The liability of an operator should be determined by considering three factors: the severity of risk, the heterogeneity of operators and the automation level of an AI system. Taking all of these factors into consideration, frontend operators should, as a starting point, be subject to fault-based liability. However, it is imperative to provide them with an extra incentive (strict liability) to adjust their level of activity where their misbehaviour has the potential to result in significant harm and they exercise a substantial degree of control over the AI system. Therefore, the liability for frontend operators shall be assessed in concrete contexts.
The control exercised by backend operators can be significant. Their actions or omissions can make the entire AI system fail and generate notable social losses. Therefore, it is necessary to provide them with an additional incentive to further control their activity. Backend operators should, as a starting point, be subject to strict liability.
V. Evaluating the European policy developments
In this section, we utilise the theoretical considerations described above in commenting upon policy developments and documents published at the EU level. We will critically analyse first the proposals regarding the liability of developers (Section V.1) and then those regarding the liability of operators (Section V.2).
1. A critical analysis: the liability of developers
As mentioned in Section IV.1, strict liability should be applied to developers considering their essential role in deciding the features of AI systems. This idea is also visible in the EU-level policy discussions.
In general, there are two institutional options to accommodate this incentive mechanism. On the one hand, the already-existing product liability regime can be extended to recognise the developers of AI systems as traditional producers. On the other hand, a separate sui genesis liability regime can be designed specifically for AI system developers.Footnote 90 The first option has appeared to tempt the legislators. For example, the members of the EG-NTF argued that the PLD should apply to “products regardless of the technology on which they are based”.Footnote 91 In this case, “developers” of digital goods would be perceived as “producers”, and their behaviour would thus be evaluated under the framework of product liability. Strict liability would, therefore, apply to the harm that is caused by defective AI systems.
Nonetheless, this approach presents some challenges. According to the existing PLD, only “movables” fall into the scope of “products”.Footnote 92 Digital goods (such as software) have not been regarded as “products”, neither within the meaning of the PLD nor in the national laws of most EU Member States.Footnote 93 The limited scope of “product” has precluded software developers from being liable under the PLD. Therefore, it should be ensured that harm caused by defective software could be covered under the revised, new product liability rules. Additional challenges, such as how to prove that the harm was caused by a defective software application, should also be carefully considered.Footnote 94
Another issue to be addressed is whether developers should be responsible for harm if they have adopted an optimal activity level. This question comes close to the issue of whether the so-called development risk defence should continue to exist in the AI era.Footnote 95 One remarkable change proposed by the EG-NTF is removing the development risk defence from the producers of AI systems.Footnote 96 The result would be that a developer is subject to strict liability even if the defect can be detected only after the product is placed on the market.Footnote 97 Since an AI system may be subject to some updates, its producer may be considered as the party who can efficiently reduce the risk. It is thus reasonable to have the producer bear some residual risk relating to the obligation to update the AI system in a timely manner. However, the analysis in Section IV.1 has indicated that continuous control only justifies the application of strict liability to developers if the risk can be predicted based on the state of scientific knowledge (which is also developing continuously). With respect to harm that occurs when developers have already optimised their activity, applying strict liability may have a counterproductive effect. It might prevent some accidents, but it could significantly deter beneficial activity as well. Accordingly, the only justification for removing the development risk defence would be that developers have a better risk-shifting capacity. In all, whether the development risk defence shall be retained or not is a matter of compensation more than a question of deterrence. Therefore, a reasonable approach for policymakers would be to pay more attention to developing compensation mechanisms that would be separate from liability rules and applicable to situations where the developers have already optimised their activity.
2. A critical analysis: the liability of operators
This subsection will critically analyse whether the European proposals regarding the liability of operators are efficient. We will analyse first the liability of backend operators (Section V.2.a) and then that of frontend operators (Section V.2.b).
a. Backend operators
As indicated in Section IV.2, the services offered by backend operators can be essential for an AI system. Consequently, a backend service provider often plays a fundamental role. Backend operators should thus be subject to strict liability regardless of their risk profile.
The issue of backend operators has apparently challenged European policymakers. There appear to be divergent views as to whether and how backend operators should be subject to strict or fault-based liability. For example, the EP Resolution proposes that the risk-based approach should be utilised to determine the liability of backend operators. Within this framework, backend operators of high-risk AI systems would be subject to strict liability, while other backend operators would be liable only if a harm is caused by their fault.Footnote 98 However, the EP Resolution also indicates that backend operators should be covered by the notion of “producers” and be subject to strict product liability regardless of their risk profile.Footnote 99
It seems that the latter approach of coining backend operators as producers is consistent with the lessons from law and economics. This approach, however, is by no means entirely problem-free. For example, the issue of whether backend operators can be equated with producers is complex as such.Footnote 100 In addition, strict product liability is nowhere near a “pure” strict liability in the economic sense but is conditioned by additional requirements. Under the European product liability regime, the claimant must in any event prove a “defect”.Footnote 101 In the future, if policymaking is developed in this direction, it is paramount that this issue of proving a defect is specifically addressed to facilitate claims as well as to avoid legal uncertainty.Footnote 102 Otherwise, some social losses might not be internalised by backend operators, and they would, consequently, not be incentivised to behave appropriately. How this issue should be tackled and to what extent it could happen ex ante by means of legislation area complex questions and cannot be discussed here in detail.Footnote 103
b. Frontend operators
The severity of risk and the level of automation would, as explained in Sections IV.2.a and IV.2.c, play a central role in determining the liability of frontend operators. Where the activities of frontend operators are hazardous, they should be provided with extra incentives to control their level of activity. In addition, the liability of frontend operators should be calibrated in accordance with their actual degree of control over a specific AI application.
Under the proposal contained in the EP Resolution, frontend operators would be subject to fault-based liability in settings that are not considered high risk. This is consistent with law and economics as well as the overall evolution of the liability of (frontend) operators in other contexts. In the era of AI, policymakers should be careful in defining high-risk AI, also bearing in mind that, in other contexts, “high-risk things” have traditionally been a very small group, including, for example, dangerous chemicals or nuclear power plants.
The EP Resolution does not specify high-risk AI systems, but the newly proposed AI Act offers a wide range of AI applications that would be categorised as high risk.Footnote 104 It is uncertain whether a similar list would also be utilised in the context of future liability rules. A list such as the one now published would mean that the scope of strict liability is broad.Footnote 105 It is too early to assert whether the use of AI would ultimately extend or reduce the overall scope of ultrahazardous activities recognised by legislation.Footnote 106 Some issues should, in any event, be carefully considered and addressed as far as possible. First, for a given accident (eg a traffic accident), victims shall not be treated differently, regardless of whether they have been harmed by AI or not.Footnote 107 This in nature is a compensation issue. From a deterrence perspective, the equal treatment of victims does not mean that the liability rules for all tortfeasors should be identical. In the era of AI, considering the different automation levels of an AI system in a given scenario, the degree of control exercised by frontend operators is correspondingly different. Therefore, it is reasonable to crystallise liability rules in line with the degree of control. Second, the existing European strict liability rules are mostly rules of national laws.Footnote 108 While harmonising the liability rules for frontend operators of AI systems may reduce the divergence between the EU Member States concerning this specific matter, the novel rules and pre-existing national liability rules on dangerous activities might form an incoherent whole within each Member State,Footnote 109 even if a highly fragmented legal landscape and uncertainty about applicable rules can also be problematic and costly.
Moving on, our next question is whether the European proposals take the automation level into account appropriately when determining the liability of frontend operators. The EP Resolution noted that, where there are multiple operators, “the proportion of liability shall be based on the respective degree of control the operators had over the risk connected with the operation and functioning of the AI system”. Additionally, the EG-NTF explained that “strict liability should lie with the person who is in control of the risk connected with the operation of emerging digital technologies”, and if there are multiple operators, “strict liability should lie with the one who has more control over the risks of the operation”.Footnote 110 This language is problematic, since backend operators are always the parties that can efficiently reduce social losses caused by backend services, regardless of the degree of control exercised by frontend operators. It seems that both the EP Resolution and the EG-NTF Report are determined to find the cheapest cost-avoider between frontend and backend operators, even if these two parties are not comparable with each other and cannot be considered mutually exclusive.
From an institutional perspective, what really matters is determining the (burden of) liability of frontend operators in accordance with their degree of control over an AI system. Regarding this issue, there is no “one-size-fits-all” solution for all AI applications.Footnote 111 The liability of frontend operators can only be accurately decided with an approach that is both sector-based and evidence-based.Footnote 112 Because of this, merely adopting AI technology does not lead to any clear, automatic implications in terms of altering the existing liability rules.
VI. Conclusion
In this article, we explained how a law and economics analysis can contribute meaningfully to the debate about the liability rules that should be applied to AI-related harm. In the EU, we have seen several policy initiatives and preparatory documents concerning such harm. Notably, there has not been any clear, final set of future rules on the table yet. The situation remains open in terms of what kind of liability rules – if any – will be enacted in the near future by EU legislators.
There are several comments that can nevertheless be put forward in terms of ideas and discussions observable in EU-level policy papers. Most importantly, the official proposals have not been entirely clear and consistent on the question of who exactly should be strictly liable and in which particular situations.Footnote 113 However, this question is key to the formulation of liability rules. A welcome sign, in any event, is that, for instance, the Commission documents that have set out preliminary ideas as to liability seem to recognise that the efficiency perspective is crucial when deciding what kind of liability framework should be adopted (or retained).Footnote 114
Our analysis has underlined that developers exert a considerable influence on accident risk and often also have “deep pockets”. Accordingly, they should be subject to strict liability. Such a regime would generate incentives for both optimal care and optimal activity levels as well as facilitating the effective spreading of risk.
Similarly to other frontend operators, the frontend operators of AI systems should, in principle, be subject to fault-based liability, unless their activities could cause significant social losses. The risk-based approach proposed by EU legislators is a step in the right direction,Footnote 115 but it should be further developed to clearly define the situations in which frontend operators are strictly liable. This matter should be addressed on a sectoral basis. It is not possible to establish a harmonised, one-size-fits-all liability regime regarding this question at the EU level. Additionally, it is important to assess the current Member State laws on civil liability and evaluate whether they lead to satisfactory results, as well as whether there would be too much divergence across the Union from the standpoint of the single market.Footnote 116
Moreover, the issue of the liability of backend operators should be considered separately from the position of frontend operators. The essential role played by backend operators signifies that they are a party “creating” rather than “operating” AI systems. Strict liability would ensure that backend operators have appropriate incentives.
Several further comments can be made. For example, current EU policy documents focus on identifying “the appropriate party”Footnote 117 that should bear risks. However, from an economic perspective, there need not be a single appropriate party – all actors that influence accident risk should be incentivised to take preventative measures. The control exercised by frontend operators does not eliminate the need to provide incentives to backend operators. The relevant question is whether all parties involved should be exposed to strict or fault-based liability and whether the liability of various stakeholders should be separate or rather solidary. In addition, problems could arise in the case of the insolvency of one of the stakeholders. For this reason, the EU documents published also propose the introduction of compulsory solvency guarantees such as mandatory liability insurance.Footnote 118 Whether the compulsory purchase of liability insurance for relatively new risks, such as AI-related harm, is justified is open to debate.Footnote 119 It is also noteworthy that seeking maximum deterrence may well open the compensatory floodgates. Compensating AI-related damage by other means and mechanisms than by mere liability rules merits further attention. These questions as well as many others would undoubtedly benefit from further research.
Acknowledgments
The authors would like to acknowledge the project funding granted by the Academy of Finland, decision number 330884 (2020).
Competing interests
The authors declare none.
