AI Developer Liability: The Chain of Accountability

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Holding artificial intelligence developers accountable is one of the greatest legal challenges of our time, and it calls for new regulatory frameworks to protect fundamental rights.

Civil Liability for Artificial Intelligence: Where Things Stand

The legal relationships involved in artificial intelligence systems are undergoing a profound transformation. As algorithms make decisions that directly affect people’s lives (granting credit, diagnosing illness, deciding administrative matters), it becomes essential to understand who is answerable for the harm these technologies cause. This article examines a question that goes beyond the purely technological debate and enters the realm of fundamental rights: the chain of accountability for AI developers.

Under Brazilian law, the Civil Code already sets out general principles of civil liability that can be applied to harm caused by intelligent systems. Article 927 and the provisions that follow it require a person to repair the damage caused by an unlawful act, while the sole paragraph of Article 927 provides for strict liability (liability without fault) for activities that, by their nature, create a risk to the rights of others. This body of law is relevant, but it was not designed to deal with the complexity of autonomous decision-making systems.

The Legal Framework for Artificial Intelligence, now under discussion in Brazil’s National Congress as Bill 2338/2023, seeks to establish specific rules for holding accountable the parties involved in the life cycle of AI systems. The bill recognizes that the chain of responsibility does not stop at the developer of the algorithm. It extends to everyone who takes part in designing, implementing, operating, and monitoring these systems.

We note that international experience has been fundamental in guiding the Brazilian debate. The European Union, through the AI Act (its Artificial Intelligence Regulation), adopted a risk-based approach that classifies AI systems according to their potential to cause harm. That classification directly shapes the degree of responsibility assigned to the different parties in the chain, creating obligations proportional to the level of risk identified.

Identifying the Parties in the Chain of Accountability

To understand the chain of accountability properly, we need to identify each party involved in the life cycle of an artificial intelligence system. The chain is made up of multiple actors, each with specific obligations and responsibilities that vary with the degree of control they exercise over the system and the potential for harm associated with their role.

The first link in the chain is the developer of the base model. This is the company or institution that designs and trains the underlying algorithm, defining its architecture, selecting the training data, and setting its operating parameters. This party bears primary responsibility for the safety and reliability of the system, because decisions made at this early stage can have consequences throughout the rest of the chain. Training failures, bias in the input data, and the absence of adequate safety mechanisms are clear grounds for liability.

The second link consists of the companies that adapt and customize AI models for specific applications. These technology integrators are responsible for making sure the system is suited to its intended use, for conducting safety testing, and for putting the necessary safeguards in place. When an integrator uses a generic model for medical or legal purposes without proper adaptation and validation, for example, it takes on a significant share of responsibility for any resulting harm.

The third link is the operator, meaning the legal entity that actually deploys and uses the AI system in its business. Hospitals that use AI for diagnoses, financial institutions that use algorithms for credit analysis, and public agencies that adopt automated decision-making systems are all examples of operators. Their responsibility includes choosing the system appropriately, monitoring its performance on an ongoing basis, and ensuring human oversight when needed.

The accountability of AI developers cannot be treated in isolation: each party in the chain answers in proportion to the control it exercises over the system and the risk its participation introduces.

Finally, there are the data suppliers, who feed the systems the information used in both training and operation. The quality, representativeness, and lawfulness of the data are decisive for the proper functioning of AI. Failures in the supply of data can cause significant harm, especially when they involve sensitive personal data protected by Brazil’s General Data Protection Law (Law 13.709/2018).

Types of Liability and Criteria for Attribution

Now let’s look at the different types of liability that apply to the parties in the AI chain, taking into account the particular features of autonomous systems and the need to protect the rights of those affected effectively. The central debate is whether to adopt fault-based liability or strict liability (liability regardless of fault) for the different parties and situations.

Fault-based liability requires proof that the party acted with negligence, recklessness, or lack of skill. In the AI context, this would mean proving that the developer did not take reasonable safety measures, that the integrator did not conduct adequate testing, or that the operator did not put the necessary monitoring in place. This type of liability is traditional in Brazilian civil law, but it creates significant practical difficulties when applied to complex AI systems. The algorithmic “black box” makes it hard to pinpoint the failure and the party responsible for it.

Strict liability, by contrast, does not require proof of fault. It requires only proof of the harm and of a causal link. Under the Consumer Protection Code (Law 8.078/1990), this type of liability already applies to consumer relationships, which covers many of the situations in which AI systems are used to offer products and services to end consumers. We believe that applying strict liability to high-risk AI systems is the best way to protect citizens’ rights effectively, especially given the information gap between developers and users.

Another key point is the possibility of joint and several liability among the different parties in the chain. When harm results from the combined failures of several parties (for example, bias in the data together with a lack of human oversight by the operator), all of them may be called on to answer jointly to the injured person. Each retains a right of recourse against the others in proportion to their respective contributions to the harm.

The Role of Causation in Autonomous Systems

Proving causation in AI systems poses unprecedented challenges in the law of civil liability. In traditional harm cases, the relationship between the conduct and the result is usually identifiable. AI systems, however, operate through decision-making processes that are not always transparent or explainable. This algorithmic opacity creates an evidentiary barrier that can make it impossible to protect the rights of those affected unless adequate mechanisms are adopted.

In this context, explainability and algorithmic transparency become important as legal duties of developers and operators. The obligation to document how the system works, to keep records of automated decisions, and to provide understandable explanations of the criteria the algorithm uses is not merely good practice. It is an essential requirement for making proper accountability possible.

Prevention Mechanisms and AI Governance

Beyond liability after harm has occurred, we also look at the preventive mechanisms that form part of the chain of responsibility for AI developers. Adopting sound algorithmic governance practices not only reduces the risk of harm but also serves as a defense in any lawsuit, showing that the party was diligent in meeting its duties.

Among the most important preventive mechanisms is the algorithmic impact assessment. In this procedure, the developer or operator systematically analyzes the risks associated with the AI system before it is deployed. The assessment should consider potential impacts on fundamental rights, identify vulnerable groups that could be disproportionately affected, and establish measures to mitigate the risks identified.

Algorithmic auditing is another essential mechanism. It is an independent review of how the AI system works, carried out by qualified professionals, with the aim of identifying bias, security flaws, and deviations in performance. We believe that requiring periodic audits of high-risk AI systems is a proportionate and necessary measure to ensure the accountability of the parties in the chain.

Meaningful human oversight (human-in-the-loop or human-on-the-loop) adds another layer of protection. In decisions that significantly affect individual rights, having a qualified human being in the decision-making process makes it possible to catch algorithmic errors and correct unfair decisions before they cause irreversible harm.

Record-Keeping and Traceability

Keeping detailed records of how the AI system operates (decision logs, data used, parameters applied) is essential for both prevention and accountability. These records make it possible to reconstruct the algorithmic decision-making process, which helps identify the cause of the harm and the party responsible. Developers and operators are advised to establish robust data logging and retention policies, while also complying with the requirements of the LGPD (Brazil’s General Data Protection Law) on the protection of personal data.

Regulatory Outlook and Future Challenges

Brazil’s regulatory framework for the liability of AI developers is still under construction. Beyond the previously mentioned Bill 2338/2023, other legislative initiatives seek to address specific aspects of liability, such as the use of AI in the public sector, in judicial decisions, and in health care. We are following the progress of these discussions closely. They tend to consolidate fundamental principles such as transparency, algorithmic non-discrimination, and liability proportional to risk.

One of the most significant challenges we see is the question of jurisdiction and the territorial reach of liability rules. AI systems are often developed in one country, trained on data from multiple jurisdictions, and operated globally. This transnational dimension calls for international cooperation and regulatory harmonization mechanisms, which are still at an early stage of development.

Another important challenge is the continuous evolution of AI systems. Models that learn and adapt over time (continuous learning) can display behavior their original developers did not anticipate. This raises complex questions about how long a developer’s responsibility lasts and whether continuous monitoring is needed even after the system has been handed over to the operator.

We believe that building an adequate liability regime for AI requires balancing the protection of citizens’ rights against the promotion of technological innovation. Overly restrictive rules can stifle the development of beneficial solutions, while the lack of adequate regulation can leave citizens unprotected against algorithmic harm. The most promising path is a risk-based approach, with obligations proportional to the seriousness of the potential harm and the degree of autonomy of the system.

This topic is directly related to LGPD and liability, which we cover in a dedicated article.

This topic is directly related to civil liability for damages, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.