- The regulatory framework is evolving from the principle of fault towards strict liability for high-risk AI systems.
- The European AI Regulation establishes ex-ante risk management to ensure safety and ethics in technological deployment.
- Damage repair faces complex challenges due to algorithmic opacity and machine autonomy.
These days, it seems like not a minute goes by without us hearing about ChatGPT, Perplexity, or robots operating in operating rooms. This technological revolution has landed in our lives suddenly, and while we're amazed at how easily these tools make our lives easier, they've also opened a Pandora's box in the legal arena. The problem is that the law often lags behind technology , and when an algorithm makes an autonomous decision that ends in disaster, it's not as simple as saying, "It's the machine's fault."
We're entering a murky area where classic concepts of civil law fall short. We're not just dealing with a software problem, but with systems capable of learning and evolving on their own, making tracing the origin of damage a real headache. That's why it's crucial to analyze how the legislative landscape is shifting, especially in the European Union, so that neither companies nor users end up in a legal limbo where no one takes responsibility.
What do we really understand by AI from a legal perspective?
To avoid taking a leap of faith, we must first define what we're talking about. The European Commission and the recent Regulation (EU) 2024/1689 describe AI as machine-based systems that operate with varying levels of autonomy . They are not simply programs that follow a fixed recipe, but rather processes input data to generate outputs—such as predictions or decisions—that can alter the physical or virtual world. The key point here is that, although they simulate intelligent behavior, they lack consciousness and free will , which, for now, rules out granting them independent legal personhood.
The risks that jeopardize our rights
The deployment of AI is not harmless. There are three main areas of risk that concern regulators. First are the risks to fundamental rights , where privacy and non-discrimination are at risk. The use of biometric data for mass surveillance or algorithmic bias can lead to a person being rejected in a selection process or for bank credit without real justification, based on prejudices unintentionally programmed by the developer.
On the other hand, there are security flaws and inefficient operation. A cyberattack on an AI-powered financial system or a malfunction in a surgical robot can cause extremely serious material and personal damage . Finally, there are systemic risks, ranging from mass disinformation (fake news) to job displacement, creating a sense of helplessness in consumers who often don't even know they are interacting with AI.
The Labyrinth of Civil Liability
This is where things get serious. Traditionally, in Spain we follow Article 1902 of the Civil Code, which basically states that if you cause damage through fault or negligence, you have to repair it. But of course, how do you prove a programmer's negligence if the system learned an unforeseen behavior through machine learning? This algorithmic opacity renders the classic model of subjective liability insufficient.
The battle between guilt and risk
There is intense debate about whether we should move to a strict liability model , especially for high-risk AI. Under this system, the victim wouldn't have to struggle to prove someone was negligent; it would suffice to demonstrate that the system caused the harm and that a causal link exists. It would be similar to what happens with traffic accidents: the risk is created by whoever puts the machine into operation, so they should be liable for compensation regardless of whether there was "bad faith" or not.
The critical case of autonomous vehicles
Self-driving cars are the perfect example of this dilemma. Currently, there's a "red line": as long as humans have ultimate control, the driver is responsible. But when we reach full autonomy, the legal framework will have to change radically. We can no longer claim that a software failure is "force majeure" to exonerate the owner. We will likely see mandatory specific liability insurance and the creation of guarantee funds to ensure that those affected are not left without compensation.
The AI Act and the European Union's strategy
The EU has taken the first step with the Artificial Intelligence Regulation (AI Act), the world's first comprehensive regulation on the subject. This regulation does not directly address civil liability (that is left to specific directives), but it establishes a system of ex-ante governance . It classifies AI according to its risk: from unacceptable risk (prohibited) to high risk, which includes sectors such as health, education, and the management of critical infrastructure.
- High-risk systems: They must meet strict requirements for transparency, cybersecurity, and human oversight.
- Presumption of causality: It is proposed to facilitate proof for victims, allowing certain breaches of the AI Act to be considered alleged negligence.
- Right to be forgotten and GDPR: The processing of personal data remains under the GDPR, ensuring that any misuse of personal information through AI results in effective compensation.
Obligations to avoid disaster
To avoid paying astronomical compensation, a company must implement legal compliance measures and ethics committees . It's not enough for the system to simply work; it must be auditable and transparent. Prevention involves eliminating bias in training data and ensuring that a human is always available to deactivate the functionality in case of emergency. Failure to comply with these due diligence requirements will be key in future lawsuits to determine who should pay damages.
The evolution towards a single digital market requires that the rules be the same for everyone in Europe, preventing some companies from taking refuge in legal havens with less stringent requirements. The trend is clear: less burden of proof for citizens and more responsibility for operators and manufacturers, who are the ones who truly profit from the exploitation of these technologies.
The legal landscape is moving towards harmonization where safety and ethics are not optional, but rather requirements for entering the market. The combination of strict liability for the most dangerous systems, along with mandatory insurance and rigorous human oversight, aims to ensure that innovation continues while preventing the cost of progress from falling on the shoulders of the most vulnerable users.
