Civil Liability for Harm Caused by Artificial Intelligence

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Artificial intelligence is already causing real harm to individuals and businesses, yet Brazilian law is still working out who should answer for those injuries.

The Rise of Artificial Intelligence and the New Legal Risks

Social and economic relationships are undergoing a profound transformation as artificial intelligence systems come into wider use. Algorithms make decisions that affect credit, health care, public safety, consumer transactions, and even people’s personal freedom. In this setting, one question grows more urgent every day: when an artificial intelligence system harms someone, who should be held liable?

Civil liability, as structured by Brazil’s Civil Code and Consumer Protection Code, was designed for situations in which the causal chain between human conduct and harm can be traced with relative ease. AI systems add a new layer of complexity. Many of them operate as “black boxes,” with inner workings that are opaque even to their own developers. That opacity makes it harder to establish the causal link and, as a result, to assign liability.

Harm caused by AI can take many forms: discriminatory automated decisions in hiring, mistaken medical diagnoses generated by algorithms, accidents caused by autonomous vehicles, privacy violations by facial recognition systems, and financial losses from algorithmic trading in the capital markets. Each of these situations poses its own challenges for the legal system and calls for a careful look at the foundations of the civil liability rules that apply.

Foundations of Civil Liability as Applied to Artificial Intelligence

Under Brazilian law, civil liability traditionally rests on two pillars: fault-based liability (based on fault, under Article 186 of the Civil Code) and strict liability (liability without fault, provided for in Article 927, sole paragraph, of the Civil Code and widely adopted by the Consumer Protection Code). When we examine harm caused by AI systems, strict liability emerges as the most appropriate path in most cases.

The reason is simple. Requiring the victim to prove fault on the part of an AI system’s developer or operator would impose a burden of proof that is almost impossible to meet. How could an ordinary consumer show that there was negligence in the programming of an algorithm whose workings he or she cannot even understand? The risk-based theory of liability, firmly established in Brazilian law, offers a fairer answer: whoever develops or uses potentially harmful technology must bear the risks inherent in that activity.

In consumer relationships, the framework is even clearer. Articles 12 and 14 of the Consumer Protection Code establish the strict liability of the supplier for defects in a product or service. An AI system offered to consumers that malfunctions falls squarely within this rule. The supplier is liable whether or not it was at fault; the victim need only show the harm and its causal link to the defective product or service.

The opacity of artificial intelligence algorithms cannot be used as a shield to excuse those who profit from them.

The development risk theory is also relevant here. It asks whether a supplier can be held liable for defects that could not have been known when the product was placed on the market. With AI, this debate takes on special features, because machine learning systems can develop unpredictable behavior after deployment as they process new data and adjust their internal parameters.

The Chain of Liability: Developer, Operator, and User

One of the most complex aspects of civil liability for AI-related harm is identifying who is responsible. Unlike a traditional product, an artificial intelligence system involves multiple parties in its creation and operation. We see at least three central figures in this chain: the developer (who creates and trains the algorithm), the operator (who deploys and uses the system in its business), and the end user (who interacts directly with the technology).

A developer may be held liable when the harm stems from flaws in the algorithm’s design, from bias in the training data, or from deficiencies in the system’s safety mechanisms. An operator is liable when the harm results from the way the system was implemented, configured, or maintained. For example, a financial institution that uses a credit-scoring algorithm can be held liable if the system produces discriminatory decisions, even if a third party developed the algorithm.

In many cases, the developer and the operator will be jointly and severally liable, especially in consumer relationships. An injured consumer can sue any party in the chain, and those parties then have a right of recourse against one another in proportion to each one’s share of responsibility. This joint and several liability is essential to ensuring that the victim is actually compensated and is not harmed by the complexity of the technology’s supply chain.

As for the user, liability is assessed case by case. If the user employed the AI system in a way other than the one it was designed for, or ignored clear warnings from the supplier, the liability of the other parties may be excluded or reduced. We stress, however, that this exclusion should be read narrowly, especially when the user is a consumer, in keeping with the principle of consumer vulnerability.

Brazil’s AI Legal Framework and Civil Liability

Brazil has been debating the regulation of artificial intelligence intensely in recent years. Several bills are moving through the National Congress with the aim of creating a regulatory framework for AI, including specific provisions on civil liability. We follow these legislative discussions closely, because how they are resolved will directly affect how the courts treat AI-related harm.

Among the central points of the legislative debate is whether to adopt a risk-based liability system. Under this approach, AI systems classified as “high risk” (those that affect fundamental rights, health, safety, or liberty) would face a stricter liability regime, with heightened duties of transparency, auditability, and accountability. Lower-risk systems would be subject to lighter regulation.

International experience also offers important reference points. The European Union, through the AI Act (the Artificial Intelligence Regulation), established a regulatory model based on risk tiers that has influenced discussions in many countries, Brazil included. The European proposal for a directive on civil liability for AI also made relevant contributions, such as the reversal of the burden of proof in certain situations and a right to information about how the system works.

Whether or not specific legislation is passed, we believe Brazilian law already has enough tools to handle most cases of AI-related harm. The Civil Code, the Consumer Protection Code, the General Data Protection Law, and the Marco Civil da Internet (Brazil’s Internet Civil Rights Framework) provide a normative basis that, when interpreted systematically and in light of current conditions, allows the parties involved to be held properly liable. Legislation specific to AI will refine and add detail to this framework; it will not fill a complete legal vacuum.

Evidentiary Challenges and the Role of Algorithmic Transparency

One of the biggest practical obstacles to holding anyone liable for AI-related harm is gathering evidence. How do you show that an algorithm made a discriminatory decision if its inner workings are inaccessible? How do you establish the causal link between the system’s defect and the harm suffered when even the developers cannot fully explain the algorithm’s behavior?

In this context, algorithmic transparency is not merely a desirable ethical principle but a legal necessity. Without mechanisms for auditing and understanding the decisions AI systems make, the right to compensation becomes illusory. That is why we argue that transparency should be treated as a legal duty of AI developers and operators, and that breaching it can, by itself, constitute a wrongful act giving rise to liability.

Reversing the burden of proof is also an essential tool in these cases. Given the information gap between the victim and the parties that develop and operate AI systems, it is reasonable to require those parties to show that the system worked properly and that there is no causal link between its operation and the alleged harm. This reversal is already accepted in consumer law, and a judge may order it under Article 6, item VIII, of the CDC (Brazil’s Consumer Protection Code) when the allegation is plausible or when the consumer is hipossuficiente (at a structural disadvantage).

Expert examination also plays a central role in these disputes. Evaluating how an AI system works requires highly specialized knowledge, which makes it indispensable to bring in experts trained in computer science and artificial intelligence. Brazilian courts will need to adapt to this reality by investing in training for court-appointed assistants and by creating specific protocols for the evidence phase of cases involving AI technologies.

Finally, we stress that thorough documentation of an AI system’s life cycle (including training data, configuration parameters, operating logs, and update history) is a first-order piece of evidence. Companies and institutions that use AI should keep detailed records that make it possible, in the event of a lawsuit, to reconstruct the algorithmic decision-making process and identify any failures.

This subject is closely related to artificial intelligence and regulation, a topic we cover in a dedicated article.

This subject is closely related to how artificial intelligence is transforming the INSS (Brazil’s National Social Security Institute), a topic we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.