I. When Software Fails: The Challenges of Proving Liability

A. Why strict product liability doesn’t compute for software

[see Part 1 here]

B. Negligence

[see Part 2 here]

C. Limitation of Liability Provisions Are More Enforceable for Software

[see Part 2 here]

II. GenAI: The Ultimate in Diffusion-of-Responsibility Technology

A. Differences between Software and AI

[see Part 3 here]

B. Theories of Third-Party Liability for AI

1. [Not-so-]Strict liability for AI?

[see Part 3 here]

2. Negligence by AI?

As strict liability is simply not in the cards—in particular for intangible harms caused by the implementation of AI—in the U.S.,^{1 2} the only main theories of liability against AI providers would be through enforcing existing or new laws or regulations or through the application of negligence principles. Let’s look at the latter here in Part IV of this series on Parsing the Blame: How AI slips through the cracks of third-party liability law.

a. Are AI providers subject to liability for algorithms that recommend harmful content subject?

When an AI algorithm recommends harmful content, the lines of liability blur between the platform hosting the AI, the provider of the AI model, and the end user who may act on that recommendation. Historically, courts have treated platforms as intermediaries protected under Section 230 of the Communications Decency Act in the U.S., which shields them from liability for user-generated content. However, generative AI introduces a twist: the AI itself is often the author of the harmful output.

Take, for example, a generative AI system that creates a personalized health plan for a user but inadvertently recommends an unsafe combination of medications due to flawed training data. Courts would likely scrutinize whether the harm was foreseeable and whether the provider exercised due care in training and deploying the model. The foreseeability standard could become a contentious issue, given the expansive and unpredictable use cases of large language models (LLMs).

For example, several pending cases that have been brought against social media platform providers for their algorithms, primarily now built on AI and machine learning technologies, recommending harmful content subject matter to their users. To bypass social media company’s defenses based on Section 230,³ plaintiffs have been framing their cases under product liability—both strict liability and “negligent design” liability.⁴

Providers will argue that their algorithms operate as tools, and ultimate responsibility rests with the user or intermediary integrating the AI. But as AI systems grow more autonomous and influential, this argument becomes less tenable. The judiciary may be forced to reexamine longstanding doctrines to address harms stemming directly from AI’s recommendations, potentially diluting the protections afforded by intermediary liability frameworks.

[cont’d ↗]

b. Liability for AI output inaccuracies or “hallucinations” that cause harm?

AI systems are far from infallible. They generate responses based on probabilistic models trained on datasets that may contain inaccuracies, biases, or outdated information. When an LLM confidently provides false information—a phenomenon sometimes referred to as “hallucination”—and that causes harm, the question arises: who bears the blame?

Consider a scenario where an AI tool advises a financial planner, leading to significant client losses. The planner relied on the AI’s analysis without independently verifying its accuracy. Under negligence principles, establishing liability would depend on proving that the AI provider failed to exercise reasonable care in training or maintaining the system. Yet, the standard of “reasonable care” remains nebulous in the context of AI, where the sheer complexity of models may obscure flaws until after deployment.

Take the pending case of Walters v. OpenAI, in which plaintiff filed a defamation lawsuit against AI provider OpenAI after its LLM implementation ChatGPT generated a false legal summary accusing him of embezzlement and fraud.⁵ What steps taken by ChatGPT might constitute “reasonable care” absolving it of liability despite the inaccuracy of its output here?⁶

A further complicating factor is whether stock disclaimers absolve AI providers of liability. All providers include terms of service disclaiming responsibility for inaccuracies or misuse, and OpenAI has asserted this as a defense in Walters.⁷ While courts often uphold such clauses, they may not apply if the inaccuracies lead to substantial financial, reputational, or physical harm.

c. Can AI providers reasonably be made their user’s keepers?

AI’s unique position as both tool and actor raises the question: should AI providers bear responsibility for their users’ actions? For instance, if an AI system generates code that enables a cyberattack, is the provider liable?

Under existing negligence law, the answer depends on foreseeability and duty of care. Courts may ask whether the AI provider reasonably anticipated such misuse and took adequate steps to prevent it. Preventative measures might include restricting the scope of outputs, implementing safeguards, or training the model to avoid producing harmful content. However, over-restriction could stifle legitimate uses and innovation, creating a challenging balancing act.

The scale and autonomy of AI systems exacerbate this issue. While traditional software is deterministic, AI can evolve dynamically, producing unforeseen results. Expecting providers to preemptively address every potential misuse is arguably unrealistic. A reckless prompt fed into a generative AI model can produce everything from copyright infringements to defamatory statements, potentially harming quite literally every individual or group in the world, the vast majority of which have no contractual relationship whatsoever with the AIaaS provider or any of its other associated third parties.

Yet the alternative—leaving third parties unprotected—is equally unsatisfactory.

b.