Artificial intelligence is now deeply embedded in modern business. From customer service automation and SaaS integrations to predictive analytics, document review, recruitment, healthcare systems, and financial decision-making, AI offers significant operational benefits.
However, as AI adoption accelerates, so too does legal exposure.
When AI systems cause harm, make incorrect decisions, misuse confidential information, or contribute to a data breach, businesses increasingly face a critical legal question:
Who is actually liable?
This is not simply a technology issue. It is a question of governance, contractual allocation of risk, regulatory compliance, and commercial accountability.
As discussed in our related analysis of broader AI liability and decision-making risk, businesses should not assume that responsibility automatically rests with the software provider. In many cases, the organisation deploying or relying on AI may remain legally exposed.
AI is a tool, not a legal person
Under current legal frameworks, AI itself is not a legal entity and cannot independently bear legal responsibility.
This means that where AI causes:
- A personal data breach;
- Financial loss;
- Defective automated decisions;
- Discriminatory outcomes;
- Confidentiality failures;
- Regulatory breaches; or
- Physical or reputational harm,
liability will generally fall on one or more human or corporate actors connected to its development, deployment, or supervision.
This may include:
- The business using the AI;
- The software provider;
- Data processors;
- Cloud or infrastructure providers;
- Employees;
- Contractors;
- Integrators; or
- Multiple parties simultaneously.
The core principle: deployment often creates responsibility
A recurring commercial misconception is that purchasing or licensing AI shifts legal risk to the technology vendor. In practice, this is often incorrect.
Where a business determines why and how AI is used, particularly where personal data or regulated decision-making is involved, it may retain primary legal responsibility.
This is particularly relevant under:
- UK GDPR;
- Data Protection Act 2018;
- Contract law;
- Negligence principles;
- Sector-specific regulation; and
- Professional compliance obligations.
If a company inputs confidential customer information into an inadequately governed AI platform, resulting in unauthorised disclosure, the deploying business may still face:
- ICO scrutiny;
- Contractual claims;
- Professional negligence concerns;
- Client disputes; and
- Reputational damage.
Data breach liability: who may be responsible?
AI-related data breaches can arise through:
- Prompt leakage;
- Misconfigured integrations;
- Insecure APIs;
- Vendor-side cyber incidents;
- Improper employee use;
- Excessive permissions;
- Unauthorised model training on sensitive data; or
- Cross-border transfer failures.
The following can be liable for the data breaches:
1. Businesses (controllers)
If your organisation determines the purpose and means of data processing, you may remain primarily accountable.
2. Vendors (processors or providers)
AI vendors may bear liability where:
- Security promises were breached;
- Contractual obligations were not met;
- Negligence occurred;
- Misrepresentations were made; or
- Product vulnerabilities caused foreseeable harm.
3. Employees
Internal misuse can create employer liability, particularly where governance, training, or oversight was insufficient.
Beyond data breaches: what if AI makes the wrong decision?
Liability is not limited to cyber incidents. AI may also create legal exposure where it:
- Rejects legitimate applicants discriminatorily;
- Produces flawed legal or financial recommendations;
- Causes healthcare errors;
- Misprices contracts;
- Generates defamatory content;
- Produces unsafe operational outputs; or
- Influences harmful human decision-making.
Research increasingly highlights the danger of “automation bias”, where human operators over-rely on AI outputs without sufficient independent judgment. This reinforces that human oversight remains legally and commercially critical.
Contractual risk
For most commercial organisations, one of the greatest legal risks lies not in AI itself, but in poorly negotiated contracts.
In many disputes, liability arises less from AI malfunction itself and more from poor governance.
Common governance failures include:
- No AI policy;
- No employee restrictions on data input;
- No DPIA (Data Protection Impact Assessment);
- Weak procurement due diligence;
- Inadequate cybersecurity review;
- No human oversight process; or
- Failure to assess cross-border regulatory implications.
In legal terms, the question is whether the business acted reasonably, competently, and proportionately in deploying AI.
When AI causes a data breach, harmful output, or commercially damaging decision, liability is rarely straightforward. However, businesses should assume from the outset that responsibility may sit closer to deployment than expected.
How IMD Corporate Can Help
At IMD Corporate, we advise businesses on:
- AI-related commercial contracts;
- SaaS and technology negotiations;
- Data protection and governance;
- Liability allocation;
- Cross-border commercial risk;
- Regulatory strategy; and
- Dispute resolution involving emerging technologies.
Our wider perspective on AI accountability, contractual exposure, and harmful automated decision-making can also be explored in our related article on who may be liable when AI causes harm or makes a wrong decision, which examines broader responsibility beyond data breach scenarios.
As AI becomes more commercially integrated, innovation must be matched by governance, contractual foresight, and legally competent oversight.
This article is for general information only and does not constitute legal or professional advice. Please note that the law may have changed since this article was published.
