Artificial Intelligence and Civil Liability for Damages

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Jurists are divided over who answers for harm caused by artificial intelligence systems: some require proof of fault, while others rely on the risk theory. Brazilian law is still working to settle the debate.

Fault or risk: two competing models

The first school of thought holds that compensation depends on proof of fault, along the lines of Article 186 of the Civil Code (Law No. 10.406/2002). Under this view, the injured party would have to prove negligence, imprudence, or lack of professional skill on the part of whoever developed or operated the system. That is an especially difficult task given the opacity of algorithms and the autonomy of automated decisions.

On the other side, a significant share of legal scholars defends strict liability, grounded in the risk theory set out in the sole paragraph of Article 927 of the same Code. From this perspective, anyone who profits from a risky technology is liable regardless of fault. The injured party need only prove the harm and its causal link to the activity.

The clash between the two positions reflects different views about who should bear the burden of innovation: the individual who was harmed, or the party that profits from exploiting the technology.

Who is liable for the harm

Identifying the responsible party is another major point of disagreement. The chain of development and use of intelligent systems includes the programmer, the supplier, the operator, and the end user, each with a different degree of control over the outcome.

One approach, anchored in the Consumer Protection Code (Law No. 8.078/1990), places liability on the supplier of the product or service, relying on Articles 12 and 14, which establish strict liability for defects. For this school of thought, an injured consumer should not have to bear the technical complexity of investigating what went wrong.

Another approach favors allocating liability in proportion to actual control. Under it, an operator who configures the system would answer differently from a developer who merely designed its architecture. The choice between these models profoundly changes the victim’s position and each party’s defense strategy.

The Brazilian landscape and the proposals under discussion

In the absence of a specific statute, courts and scholars apply the Civil Code and the Consumer Protection Code by analogy, adapting legal institutions designed for a different technological reality. This improvised solution creates uncertainty, because similar disputes end up being decided on different legal grounds.

To reduce that uncertainty, a bill creating a legal framework for artificial intelligence is moving through the National Congress. It proposes its own liability criteria and scales duties according to the risk of each application. The legislative debate pits those who prioritize protecting victims against those who fear discouraging technological progress.

Until the matter is settled, preventive guidance takes on a leading role. Companies and professionals working with new technologies can turn to the firm’s practice areas for help mapping contractual risks and drafting liability clauses suited to their activity.

The right to an explanation and algorithmic transparency

One of the most sensitive issues in the relationship between automated systems and the people they affect is access to the reasoning behind a decision. The General Personal Data Protection Law (Law No. 13.709/2018) guarantees, in Article 20, the data subject’s right to request review of decisions made solely through automated processing of personal data, including decisions that define personal, professional, consumer, and credit profiles.

In practice, exercising this right meets significant resistance. Developers often invoke trade secrets to deny access to the source code or to the model’s logic. This stance sets two legitimate interests against each other: protecting intellectual property, and ensuring that citizens can challenge, with concrete data, a decision that harmed them.

The case law beginning to take shape in disputes over credit denials, insurance contracting, and removal from digital platforms points to a need for companies to record, at least internally, the criteria that guided the system. Such records serve both the accountability required by the regulatory authority and any later judicial compensation for harm.

A lack of transparency does not eliminate liability. On the contrary, it may be treated as an aggravating factor when setting the amount of moral damages (dano moral), especially when the victim shows that the automated decision caused concrete harm and that there was no effective channel to contest it.

In this context, documenting in advance the methodologies used to develop and operate automated systems is no longer merely good practice. It works as ready-made evidence. Internal audit records, data protection impact reports, and contracts with clear clauses allocating liability make up the body of evidence that can determine the outcome of a dispute.

Liability in high-impact sectors

The level of risk associated with each use of artificial intelligence varies significantly by sector. Systems used in medical diagnosis, credit granting, insurance underwriting, and eligibility review for social benefits directly affect fundamental rights. For that reason, they receive special attention from both regulators and legal scholars.

In health care, algorithms that assist with diagnosis or treatment recommendations do not relieve the professional of liability for medical error. The system serves as a support tool; the final decision and its consequences remain the responsibility of the licensed professional. Contract clauses that try to shift liability entirely to the software developer face limits imposed by the Consumer Protection Code.

In the fields of social security and social assistance, using automated data cross-referencing to grant or suspend benefits creates situations in which people’s rights are affected by a decision they cannot always understand. The principle of the right to a full defense, enshrined in the Federal Constitution, requires that beneficiaries be able to challenge the system’s conclusion and have their case reassessed by a human decision-maker.

In consumer relations, automated rejection of an application, cancellation of a contract based on profile analysis, and algorithmic discrimination in prices and offers are practices that may be classified as abusive under Articles 39 and 51 of Law No. 8.078/1990. In these cases, the supplier’s strict liability removes the need to prove discriminatory intent. It is enough to show the harmful effect the system produced.

The regulatory trend, in Brazil and internationally, is to classify artificial intelligence applications by risk level and to require proportionate auditing, human oversight, and accountability measures for high-risk uses. Although this approach is not yet established in national legislation, it already guides the legislative debate and serves as an interpretive benchmark for judges and arbitrators who handle disputes involving emerging technologies.

Frequently Asked Questions

Who can be held liable for harm caused by an autonomous system?

Depending on the specific case, the developer, supplier, operator, or user of the system may be liable. Scholars disagree on whether to concentrate liability on the supplier, relying on the Consumer Protection Code, or to distribute it according to the control each party has over the harmful outcome.

How does the victim prove the causal link in these cases?

Proof is often difficult because of the opacity of algorithms. Those who defend strict liability, based on the risk theory in Article 927 of the Civil Code, argue that it is enough to show the harm and its connection to the activity, without proving fault on the part of the responsible party.

Is it possible to hold someone liable without a specific statute on artificial intelligence?

Yes. In the absence of a dedicated law, the Civil Code and the Consumer Protection Code apply by analogy. A bill creating a legal framework is moving through the National Congress and seeks to establish specific rules. Until it is approved, however, the adaptation of the general rules already in force prevails.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.