Artificial Intelligence and Cybercrime: Examining Legal Responsibility Under Modern Cyber Law

Introduction

Can artificial intelligence be used to commit cybercrime? Undoubtedly. The more pressing legal question, however, is whether AI should bear responsibility when it facilitates cybercrime or whether liability should instead rest with the developers, deployers, or users who design, control, and operate these systems. As AI continues to transform cyberspace, this issue has become one of the most significant challenges confronting modern cyber law.[1]

Artificial intelligence has become an indispensable feature of the digital landscape, enhancing cybersecurity through automated threat detection, vulnerability assessment, and real-time incident response. At the same time, it has equipped cybercriminals with sophisticated tools capable of generating convincing phishing emails, creating deepfakes, cloning voices, developing malicious software, and automating cyberattacks. Consequently, AI serves as both a powerful defensive technology and a potential instrument of cybercrime.[2]

The increasing use of AI has blurred the traditional distinction between human conduct and machine autonomy. Existing cyber laws were largely developed on the assumption that cyber offences are committed by identifiable human actors acting with criminal intent. As AI systems become increasingly autonomous, questions arise as to whether these legal frameworks remain adequate to determine responsibility and ensure accountability.

This article examines the legal challenges posed by artificial intelligence in the commission of cybercrime under modern cyber law. It explores whether existing legal principles can adequately allocate responsibility among developers, deployers, and users, while assessing whether the growing autonomy of AI exposes accountability gaps that require a rethinking of traditional approaches to legal responsibility.

1.  Artificial Intelligence and the Evolution of Cybercrime

Artificial intelligence (AI) has transformed cyberspace by enhancing both cybersecurity and cybercrime.[3] In the context of cyber law, AI refers to systems capable of learning, reasoning, and making decisions that traditionally require human intelligence. While AI improves threat detection and incident response, it also enables increasingly sophisticated cyberattacks.[4]

Unlike traditional cybercrime, which depends largely on human effort, AI enables the automation of phishing, malware, deepfake fraud, voice cloning, and other malicious activities.[5] These capabilities have increased the speed, scale, and complexity of cybercrime, making attacks more difficult to detect and prevent.

A distinction must be drawn between AI-assisted cybercrime, where humans direct AI as a criminal tool, and autonomous AI, where systems operate with minimal human intervention. Although AI-assisted cybercrime fits more readily within existing legal frameworks, autonomous AI raises complex questions concerning legal responsibility and accountability.

As AI assumes greater decision-making functions, traditional cyber law—built on assumptions of human intention and control—faces increasing pressure to adapt.[6] Determining responsibility for cybercrime involving AI has therefore become a central challenge for modern legal systems.

2. Legal Responsibility under Modern Cyber Law

Determining legal responsibility for cybercrime has become increasingly complex with the emergence of artificial intelligence. Legal responsibility refers to the obligation to answer for conduct that gives rise to legal consequences and may arise in either criminal or civil law. While civil liability seeks to compensate victims, this article focuses on criminal responsibility because cybercrime primarily concerns offences against the state and society.[7]

Under traditional criminal law, liability requires both actus reus (the prohibited act) and mens rea (the guilty mind). These principles presuppose a legal person capable of understanding the nature of their conduct and being subject to punishment. As AI lacks legal personality, consciousness, and criminal intent, it cannot presently satisfy these requirements or bear criminal liability.[8]

Consequently, responsibility for AI-assisted cybercrime continues to rest on the conduct and culpability of the human actors involved, including developers, deployers, and users. However, as AI systems become increasingly autonomous, applying these traditional principles becomes more challenging, raising questions as to whether existing legal doctrines remain adequate to allocate responsibility under modern cyber law.[9]

3. Examining Responsibility for AI-Assisted Cybercrime

The increasing use of artificial intelligence in cyberspace has significantly complicated the allocation of legal responsibility for cybercrime. Although AI may facilitate or automate criminal activities, existing legal systems continue to attribute liability primarily to human actors. Determining responsibility therefore requires an examination of the roles, duties, and culpability of those involved in the design, deployment, and use of AI systems.[10]

3.1 Developers

Developers are responsible for designing, training, and maintaining AI systems. However, creating an AI system does not, by itself, give rise to criminal liability. Responsibility depends on whether the developer acted intentionally, recklessly, or negligently in a manner that contributed to the commission of cybercrime.[11]

Where developers deliberately create AI tools to facilitate offences such as ransomware, phishing, malware, or unauthorised access, they may be held criminally liable because the AI merely serves as the instrument through which their criminal intention is carried out. Likewise, liability may arise where developers fail to implement reasonable safeguards against foreseeable misuse or knowingly release systems with serious security vulnerabilities.[12]

Conversely, where AI is developed for legitimate purposes, accompanied by appropriate safeguards, and its criminal misuse could not reasonably have been foreseen, imposing criminal liability solely because the technology was later abused would conflict with established principles of criminal law. Liability should therefore depend on the developer’s conduct rather than the mere creation of AI.

3.2 Deployers

Deployers are responsible for implementing and supervising AI systems after they have been developed. Their legal responsibility arises from the manner in which the technology is used, monitored, and maintained.

A deployer may incur liability where AI is intentionally employed for unlawful purposes or where reasonable supervision is neglected. For example, ignoring known vulnerabilities, disabling safety measures, or failing to monitor high-risk AI systems may constitute negligence if such omissions contribute to cybercrime.

However, where deployers comply with legal obligations, maintain appropriate oversight, and exercise reasonable care, they should not automatically be held responsible for every harmful outcome produced by an AI system. Liability should continue to depend on fault, foreseeability, and the specific circumstances of each case.[13]

3.3 Users

Users are the actors most directly responsible where AI is intentionally employed to commit cybercrime. Criminal liability ordinarily arises where AI is used to generate phishing campaigns, create malicious code, conduct automated hacking, produce fraudulent deepfakes, or facilitate identity theft and financial fraud. In such cases, AI functions as a sophisticated tool, while the criminal intent remains that of the user.[14]

Greater difficulty arises where highly autonomous AI produces harmful consequences beyond the user’s instructions or reasonable expectations. In these situations, determining responsibility requires careful consideration of the level of human control exercised over the system and whether the resulting harm was reasonably foreseeable. These challenges demonstrate why allocating responsibility for AI-assisted cybercrime has become increasingly complex under modern cyber law.[15]

4. Autonomous AI and the Accountability Gap

The increasing autonomy of artificial intelligence presents one of the greatest challenges to modern cyber law. While traditional legal principles attribute responsibility to developers, deployers, or users, these principles become more difficult to apply where AI systems operate with minimal human intervention. Although autonomous AI lacks legal personality, its ability to make decisions and produce unforeseen outcomes raises important questions about accountability.

Unlike AI-assisted cybercrime, where human control remains evident, autonomous AI systems can analyse information, adapt to changing circumstances, and make decisions within the scope of their programming. As a result, harmful consequences may occur without being specifically intended or reasonably foreseen by any human actor. This creates what scholars describe as the “accountability gap”—a situation in which significant harm occurs, yet existing legal principles struggle to identify a clearly responsible individual.[16]

Consider an AI-powered cybersecurity system designed to detect and neutralise cyber threats. The developer incorporates appropriate safeguards, the organisation deploys the system responsibly, and the user operates it for legitimate purposes. During continuous self-learning, however, the AI mistakenly identifies a lawful network as malicious and autonomously launches a countermeasure that unlawfully disrupts critical digital infrastructure. In such circumstances, neither the developer, the deployer, nor the user may have intended or reasonably foreseen the resulting harm.

This scenario exposes the limitations of traditional criminal law, which generally requires a voluntary human act accompanied by the requisite criminal intent. Where autonomous AI acts beyond the reasonable expectations of those responsible for its creation or operation, existing legal frameworks may struggle to establish fault while simultaneously refusing to recognise AI itself as a bearer of criminal liability.[17]

These challenges have generated considerable academic debate. Some scholars argue that responsibility should remain exclusively with human actors through broader standards of negligence, foreseeability, and risk management. Others contend that increasingly autonomous AI requires new regulatory frameworks capable of addressing situations where conventional doctrines no longer provide satisfactory answers. Regardless of the approach adopted, the rapid development of AI demonstrates the need for modern cyber law to evolve in order to preserve accountability in an increasingly autonomous digital environment.[18]

4.1 Competing Academic Perspectives on Autonomous AI and the Accountability Gap

The emergence of highly autonomous AI systems has generated significant academic debate regarding the allocation of legal responsibility for cybercrime. Although there is broad consensus that AI is not presently recognised as a legal person capable of bearing criminal liability, scholars disagree on how the law should respond when autonomous AI causes harm without direct human intention or control.

One school of thought argues that legal responsibility should remain exclusively with human actors. Proponents of this view contend that AI is merely a technological tool created, deployed, and supervised by humans, and therefore cannot possess the legal attributes necessary for criminal liability. Gabriel Hallevy maintains that AI lacks legal personhood, consciousness, and the capacity to form mens rea, making it incapable of satisfying the fundamental requirements of criminal responsibility. Consequently, any criminal liability should continue to be attributed to developers, deployers, or users based on established principles such as intention, negligence, recklessness, and foreseeability rather than being transferred to the AI system itself.

A second perspective acknowledges the continued importance of human accountability but argues that existing legal principles are becoming increasingly inadequate as AI systems acquire greater autonomy. Ryan Abbott observes that autonomous AI is capable of producing outcomes that may not have been specifically intended or reasonably foreseen by any human actor. In such circumstances, attributing liability solely to developers or users may be both legally and morally problematic, particularly where those individuals exercised reasonable care throughout the AI’s design, deployment, and operation. According to this view, the growing autonomy of AI exposes an accountability gap that existing criminal law was not designed to address.

A more progressive academic position proposes that legal systems should develop new frameworks capable of addressing the unique challenges posed by autonomous AI. While relatively few scholars advocate granting AI full criminal legal personality, some argue that existing doctrines should be adapted to recognise varying degrees of autonomous decision-making when allocating responsibility. Others have suggested introducing specialised regulatory liability regimes, compulsory insurance schemes, or enhanced governance obligations that ensure victims are not left without legal remedies simply because responsibility cannot easily be attributed under traditional criminal law.

Although these perspectives differ regarding the appropriate legal response, they share a common recognition that advances in AI technology are challenging long-established assumptions underlying criminal responsibility. The debate therefore reflects not whether accountability should exist, but rather how modern cyber law should evolve to preserve accountability while accommodating increasingly autonomous forms of artificial intelligence.

5. Are Existing Cyber Laws Adequate to Address AI-Enabled Cybercrime?

The integration of artificial intelligence into cyberspace has transformed cybercrime by enabling automated phishing, sophisticated malware, deepfakes, password cracking, and other cyberattacks with minimal human intervention. Although existing cyber laws criminalize many of these activities, they were largely enacted before the emergence of advanced AI and were designed primarily to address offences committed by human actors. This raises the question of whether current legal frameworks remain adequate to regulate AI-enabled cybercrime.[19]

5.1 Strengths of Existing Cyber Laws

Existing cyber laws continue to provide a strong legal foundation. The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended in 2024) criminalizes offences such as unlawful access, system interference, identity theft, electronic fraud, cyberstalking, and computer-related forgery. Because these provisions are technology-neutral, they remain applicable where AI is used as a tool to commit cyber offences.

The Act also grants investigative powers relating to electronic evidence, lawful interception, search and seizure of digital devices, and cooperation with service providers. At the international level, both the Budapest Convention and the Malabo Convention promote international cooperation and provide frameworks that remain relevant to AI-enabled cybercrime despite predating modern AI. In addition, traditional criminal law doctrines such as aiding and abetting, conspiracy, and corporate liability may extend responsibility to those who intentionally employ AI for criminal purposes.[20]

5.2 Weaknesses and Legal Gaps

Despite these strengths, significant shortcomings remain. Existing legislation generally assumes that cyber offences are committed by identifiable human actors, making it difficult to attribute liability where autonomous AI performs harmful acts with limited human control. Likewise, because criminal liability depends on mens rea, AI cannot presently satisfy the mental element required for criminal responsibility.

Current laws also provide limited guidance on algorithmic transparency, AI forensics, and the allocation of responsibility among developers, deployers, operators, vendors, and users. Furthermore, they do not specifically address emerging forms of AI-enabled cybercrime, including autonomous malware, AI-generated phishing campaigns, synthetic identity fraud, or deepfake-enabled extortion. Cross-border investigations present additional challenges, as AI-enabled cybercrime often involves infrastructure spanning multiple jurisdictions.[21]

5.3 Were Existing Cyber Laws Designed for Human Offenders?

The answer is largely yes. The Cybercrimes Act 2015 and the Budapest Convention were drafted on the assumption that cyber offences are committed by human actors possessing criminal intent. Traditional criminal law is therefore built upon voluntary human conduct, culpability, and personal responsibility rather than autonomous decision-making by AI systems.

Judicial decisions support this approach. In R v Gold & Schifreen [1988] AC 1063, technological developments exposed deficiencies in existing legislation, leading to the enactment of the Computer Misuse Act 1990.[22] Similarly, in United States v Morris, 928 F.2d 504 (2d Cir. 1991), liability was attributed to the human programmer rather than the software itself, reflecting the continued emphasis on human responsibility.[23]

Recommendations for Reform

Although existing cyber laws remain effective in criminalizing the underlying conduct, legislative reform is necessary to address the challenges posed by AI-enabled cybercrime. First, cybercrime legislation should expressly recognise AI-assisted criminal conduct and establish clear rules for allocating responsibility among developers, deployers, operators, vendors, and users based on their level of control, negligence, and foreseeability.[24]

Secondly, developers and deployers of high-risk AI systems should be required to implement cybersecurity-by-design, conduct regular risk assessments, maintain audit logs, ensure meaningful human oversight, and comply with transparency obligations. These measures would reduce the likelihood of AI systems being exploited for criminal purposes while improving accountability.

Thirdly, evidentiary and procedural laws should be modernised to accommodate AI-generated evidence, algorithmic explainability, and AI forensic investigations. Strengthening international cooperation and digital forensic capabilities will also enhance the investigation and prosecution of cross-border AI-enabled cybercrime.

Comparative developments support these reforms. The EU AI Act 2024 and the Council of Europe Framework Convention on Artificial Intelligence (2024) demonstrate an emerging international commitment to responsible AI governance and provide useful models for future legal reform. Similar measures should be adopted to ensure that modern cyber law remains effective in addressing increasingly autonomous AI systems.[25]

Comparative Perspectives

Developments in other jurisdictions demonstrate an increasing recognition that traditional legal frameworks require adaptation to address AI-enabled cybercrime. The European Union Artificial Intelligence Act 2024 adopts a risk-based regulatory approach by imposing obligations on providers and deployers of high-risk AI systems, including requirements relating to transparency, risk management, human oversight, and accountability. Although the Act is primarily regulatory rather than criminal legislation, it reflects a proactive approach to preventing AI-related harms before they occur.[26]

Similarly, the Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law (2024) establishes international principles for the responsible development and deployment of AI while promoting accountability and respect for fundamental rights. These developments complement the Budapest Convention on Cybercrime, which continues to facilitate international cooperation in investigating and prosecuting cyber offences despite predating modern AI technologies.

Compared with these developments, Nigeria’s legal framework remains focused primarily on traditional cybercrime and contains limited provisions addressing the unique challenges posed by autonomous or AI-assisted cyber offences. Drawing upon emerging international standards would strengthen Nigeria’s capacity to allocate legal responsibility, improve regulatory oversight, and respond more effectively to the evolving risks associated with artificial intelligence.[27]

Conclusion

Artificial intelligence has significantly transformed the cybercrime landscape, creating complex legal questions regarding the allocation of responsibility under modern cyber law. This article has demonstrated that although AI can facilitate sophisticated cyber offences, it cannot presently bear criminal liability because it lacks legal personality, consciousness, and the capacity to form the requisite criminal intent. Consequently, responsibility continues to rest primarily with human actors, including developers, deployers, operators, and users, depending on their level of control, fault, and foreseeability.

The analysis further establishes that existing cyber laws, including Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended) and international instruments such as the Budapest Convention, remain effective in criminalising many forms of AI-enabled cybercrime. However, these frameworks were largely drafted for human offenders and provide limited guidance on autonomous AI systems, algorithmic transparency, and the attribution of responsibility where AI operates with minimal human intervention. As AI technologies continue to evolve, these legal gaps will become increasingly difficult to ignore.

Accordingly, legislative reform is necessary to ensure that cyber law remains responsive to technological advancement. Clear statutory rules governing AI accountability, enhanced transparency obligations, stronger digital forensic capabilities, and greater international cooperation will better equip legal systems to address emerging cyber threats. Ultimately, modern cyber law must evolve alongside artificial intelligence to ensure that innovation is accompanied by accountability, public trust, and the effective administration of justice.

REFERENCE(S):

Cases

R v Gold and Schifreen [1988] AC 1063 (HL).

United States v Morris 928 F 2d 504 (2d Cir 1991).

Legislation

Nigeria

Cybercrimes (Prohibition, Prevention, etc.) Act 2015.

Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.

International Instruments

African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) (adopted 27 June 2014).

Council of Europe, Convention on Cybercrime (ETS No 185, Budapest, 23 November 2001).

Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law (opened for signature 5 September 2024).

European Parliament, Resolution of 20 October 2020 with Recommendations to the Commission on a Civil Liability Regime for Artificial Intelligence [2020] P9_TA(2020)0276.

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L.

Secondary Sources

Abbott R, The Reasonable Robot: Artificial Intelligence and the Law (Cambridge University Press 2020).

Ashworth A and Horder J, Principles of Criminal Law (10th edn, Oxford University Press 2022).

Hallevy G, Liability for Crimes Involving Artificial Intelligence Systems (Springer 2015).

Organisation for Economic Co-operation and Development (OECD), Recommendation of the Council on Artificial Intelligence (OECD Legal Instrument, adopted 22 May 2019).

United Nations Office on Drugs and Crime (UNODC), Comprehensive Study on Cybercrime (UNODC 2013).

[1] Organisation for Economic Co-operation and Development (OECD), Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449, adopted 22 May 2019).

[2] Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022).

[3] Stuart Russell and Peter Norvig, Artificial Intelligence: A Modern Approach (4th edn, Pearson 2021).

[4] National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF 1.0) (US Department of Commerce 2023).

[5] Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022).

[6] Council of Europe, Convention on Cybercrime (ETS No 185, Budapest, 23 November 2001).

[7] Andrew Ashworth and Jeremy Horder, Principles of Criminal Law (10th edn, Oxford University Press 2022).

[8] Gabriel Hallevy, Liability for Crimes Involving Artificial Intelligence Systems (Springer 2015).

[9] Council of Europe, Convention on Cybercrime (n 6); Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria), as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.

[10] Gabriel Hallevy, Liability for Crimes Involving Artificial Intelligence Systems (Springer 2015).

[11] Andrew Ashworth and Jeremy Horder, Principles of Criminal Law (10th edn, Oxford University Press 2022).

[12] Hallevy (n 10) 101–118.

[13] European Union, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L, arts 9–15.

[14] Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria), as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.

[15] Council of Europe, Convention on Cybercrime (n 6); Gabriel Hallevy, Liability for Crimes Involving Artificial Intelligence Systems (n 10).

[16] Gabriel Hallevy, Liability for Crimes Involving Artificial Intelligence Systems (Springer 2015); Ryan Abbott, The Reasonable Robot: Artificial Intelligence and the Law (Cambridge University Press 2020).

[17] Andrew Ashworth and Jeremy Horder, Principles of Criminal Law (10th edn, Oxford University Press 2022); Glanville Williams, Textbook of Criminal Law (2nd edn, Stevens & Sons 1983).

[18] European Parliament, Resolution of 20 October 2020 with Recommendations to the Commission on a Civil Liability Regime for Artificial Intelligence [2020] P9_TA(2020)0276; Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L.

[19] Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria), as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024; Council of Europe, Convention on Cybercrime (ETS No 185, Budapest, 23 November 2001).

[20] Council of Europe, Convention on Cybercrime (ETS No 185, Budapest, 23 November 2001); African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) (adopted 27 June 2014).

[21] United Nations Office on Drugs and Crime (UNODC), *Comprehensive Study on Cybercrime* (UNODC 2013).

[22] R v Gold and Schifreen [1988] AC 1063 (HL).

[23] United States v Morris, 928 F 2d 504 (2d Cir 1991).

[24] European Parliament, Resolution of 20 October 2020 with Recommendations to the Commission on a Civil Liability Regime for Artificial Intelligence [2020] P9_TA(2020)0276.

[25] Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L; Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law (opened for signature 5 September 2024).

[26] Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L.

[27] Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law (opened for signature 5 September 2024); Council of Europe, Convention on Cybercrime (ETS No 185, Budapest, 23 November 2001).