Who Is Liable When AI Causes Harm?

Most AI harm claims fit into three familiar legal routes. Negligence asks whether someone failed to take reasonable care, for example by deploying a system without adequate testing or monitoring. Misrepresentation covers false statements a business makes, including statements made through its chatbot. Product liability can hold manufacturers strictly liable for defective products, meaning the injured person does not have to prove fault, only the defect, the damage and the causal link. The Air Canada case shows the simplest principle. In February 2024, the Civil Resolution Tribunal found the airline liable for negligent misrepresentation after its chatbot wrongly said bereavement fares could be claimed retroactively. The award was small, roughly C$800 including interest and fees, but the reasoning is clear: a company is responsible for all the information on its website, whether it comes from a static page or a chatbot. In the EU, the revised Product Liability Directive (EU) 2024/2853 entered into force in December 2024 and applies to products placed on the market from December 2026. It explicitly treats software, including AI systems, as a product. Free and open-source software developed outside commercial activity is excluded. Covered damage now includes medically recognized psychological harm and the destruction or corruption of data not used for professional purposes. Courts can order the disclosure of evidence and presume defect or causation where technical complexity makes proof excessively difficult. The separate AI Liability Directive, proposed in 2022 to ease fault-based claims, was dropped after the Commission announced in February 2025 that it expected no agreement. A common misconception is that AI creates a legal vacuum. In practice, existing doctrines are applied, although proving causation for opaque systems remains hard.