Authored By: Casey Khosa
Vaal University of Technology
Introduction
Artificial intelligence has moved from experimental technology to infrastructure. Automated systems now screen job applicants, approve or deny loans, flag welfare fraud, and inform medical diagnoses. Each of these functions was once performed by a human decision-maker who could be named, questioned, and, where necessary, held liable. The shift to algorithmic decision-making has not eliminated the possibility of harm; it has merely obscured the path back to whoever is responsible for it. This article argues that the central legal challenge of AI governance is not the absence of regulation but the presence of an accountability gap: a structural mismatch between the preventive, ex-ante rules that dominate current AI law and the ex-post liability mechanisms victims actually need when something goes wrong.
The argument proceeds in four parts. Part II surveys the regulatory approaches taken by the European Union, the United States, and the United Kingdom, focusing on Colorado as an instructive state-level case study. Part III isolates the specific legal problem of accountability and explains why AI’s technical characteristics strain it. Part IV tests conventional liability doctrines — negligence, product liability, and vicarious liability — against AI-generated harm and finds each incomplete. Part V offers a critical, comparative assessment and proposes a hybrid liability model better suited to closing the gap than any of the three jurisdictions currently offer.
The Regulatory Landscape: Three Models, One Missing Piece
The European Union: Comprehensive Prevention, Incomplete Redress
The EU AI Act remains the most ambitious attempt to regulate artificial intelligence comprehensively. It sorts AI systems into four risk tiers — unacceptable, high, limited, and minimal — and imposes escalating obligations accordingly, with the heaviest compliance burden on “high-risk” systems used in areas such as employment, credit, and law enforcement.[1] Providers of high-risk systems faced a major compliance deadline of 2 August 2026, with penalties for non-compliance reaching up to €30 million or six per cent of global annual turnover, whichever is greater.[2]
What the AI Act conspicuously does not do is create an individual right of action for a person harmed by an AI system. That task was left to a separate proposal, the AI Liability Directive, introduced by the European Commission in September 2022 to ease the claimant’s burden of proving fault and causation in cases involving opaque, “black box” systems.[3] Nearly four years later, that directive still has not been finalised. As of mid-2026, commentators describe the enforcement environment as a hybrid model that relies on the AI Act’s preventive guardrails rather than on judicial liability after the fact, leaving claimants without a clear statutory route to compensation for AI-caused harm.[4]
This is a striking outcome. The jurisdiction most associated with rigorous, rights-protective technology regulation has built an elaborate system of prevention while its mechanism for redress remains stalled in the legislative process. The EU experience therefore already illustrates the article’s central claim: regulation and accountability are not the same thing, and a jurisdiction can excel at the former while lagging badly at the latter.
The United States: Accountability as a Moving Target
The United States has no federal AI statute comparable to the AI Act, leaving states to experiment. Colorado’s trajectory is instructive precisely because of its instability. In May 2024, Colorado enacted the first comprehensive state AI accountability law in the country, modelled in part on the EU AI Act, imposing a duty of care on developers and deployers to prevent algorithmic discrimination, mandatory impact assessments, and a duty to report identified harms.[5] That law faced sustained industry opposition and litigation — including a suit by X.AI seeking to enjoin its enforcement, in which the federal government intervened — and was repealed before its effective date ever arrived.[6]
In its place, Governor Jared Polis signed Senate Bill 26-189 in May 2026, replacing the discrimination-focused duty-of-care model with a narrower framework governing “automated decision-making technology.” The new law does allocate liability between developers and deployers, but strictly on a fault basis: a developer is liable only where a deployer used the technology as it was “intended, documented, marketed, advertised, configured or contracted” to be used, and a deployer is liable where it deviated from that intended use.[7] Notably, the revised law creates no private right of action at all — it is enforceable solely by the Colorado Attorney General, and it does not impose joint and several liability between the parties.[8]
The Colorado episode is a case study in the fragility of state-level accountability regimes. Within roughly two years, the same legislature moved from imposing an affirmative duty of care and mandatory bias audits to removing both, replacing them with disclosure obligations and a public-enforcement-only fault regime. For a private citizen harmed by a discriminatory algorithm, the practical avenue for redress narrowed considerably in that period — not because the underlying technology became safer, but because the political and industry pressure against comprehensive liability proved stronger than the case for it.
The United Kingdom: Flexibility Without a Floor
The United Kingdom has deliberately avoided a single AI statute, instead adopting a principles-based, sector-led approach built around five cross-sector principles — safety, transparency, fairness, accountability, and contestability — first set out in its 2023 White Paper and applied by existing regulators such as the ICO, the FCA, and Ofcom rather than by a dedicated AI regulator.[9] As of 2026, these principles remain largely non-statutory, though the Department for Science, Innovation and Technology has signalled the possibility of binding requirements for the most capable systems and has replaced the previously mooted “AI Bill” with a Blueprint for AI regulation centred on regulatory sandboxes.[10]
This model offers real advantages in flexibility: sector regulators with domain expertise can adapt general principles to specific contexts rather than applying a one-size-fits-all statute. But its accountability function is only ever as strong as the underlying sectoral law it borrows from. A claimant harmed by an AI-driven credit decision must still locate their remedy in ordinary consumer protection or data protection law, none of which was drafted with AI’s particular evidentiary problems in mind. The UK’s principle of “accountability and governance” is aspirational rather than a cause of action; it guides regulators, but it does not, by itself, give an injured person anywhere to go.
III. The Core Legal Problem: Locating Accountability in an Opaque System
Across all three jurisdictions, the accountability problem has a common technical root: the difficulty of establishing causation and fault when the decision-making process is not fully transparent even to its own developers. Modern machine-learning systems, particularly those built on large neural networks, do not apply rules a lawyer can inspect line by line. Their outputs emerge from statistical weightings learned from training data, making it genuinely difficult — sometimes practically impossible — for a claimant to show why a specific decision was made, let alone that it was made negligently.
This is the “black box” problem that the EU’s stalled Liability Directive was designed to address through a presumption of causality, easing the claimant’s evidentiary burden once certain preconditions are met. Its absence leaves claimants in EU member states in much the same position as claimants everywhere else: required to prove, without meaningful access to the system’s internal logic, that a particular defect or failure caused their harm. The result is a system in which the entity with the information advantage — the developer or deployer — bears none of the burden of explaining its own system, while the party least equipped to investigate a black box bears all of it.
A second, related problem is the multiplicity of actors in the AI supply chain. An AI system used to deny someone a mortgage may involve a foundation-model developer, a company that fine-tuned the model for financial use cases, a bank that deployed it, and a data vendor that supplied the training data. Colorado’s fault-based apportionment between “developers” and “deployers” is a rare attempt to grapple with this directly, but even that framework collapses into a binary that does not map cleanly onto more complex supply chains involving multiple intermediaries, each of whom can plausibly point to another link in the chain as the true cause of the harm.
Existing Doctrines Strained by AI
Negligence
Negligence requires a duty of care, breach, causation, and damage. AI complicates each element. Duty is complicated because it is often unclear whether the developer, the deployer, or both owe a duty to the ultimate affected individual, who is frequently not the developer’s direct customer at all. Breach is complicated because the “reasonable person” standard has no obvious analogue for a statistical model; courts have little settled guidance on what constitutes reasonable care in training, testing, or deploying a machine-learning system. Causation is complicated by the black-box problem described above. Colorado’s now-repealed duty of care for algorithmic discrimination was a direct legislative attempt to answer the first two questions by statute; its repeal shows how contested that attempt still is.
Product Liability
Product liability regimes, built around physical goods with fixed designs, sit uneasily with software that updates continuously and behaves differently depending on the data it encounters after deployment. The EU’s proposed revision of its Product Liability Directive extends coverage to software and AI systems specifically, but scholars have criticised the overall package — the AI Liability Directive alongside the revised Product Liability Directive — as a “half-hearted approach” that relies mainly on disclosure obligations and narrowly defined presumptions rather than a coherent, harmonised liability standard.[11]
Vicarious and Enterprise Liability
A third possibility is to treat AI deployment the way courts have long treated other high-risk enterprise activities: impose liability on the party best positioned to insure against and internalise the risk, regardless of individual fault. This enterprise-liability logic underlies strict product liability generally, and it is the theoretical foundation for treating AI deployers as bearing the cost of the risks their systems create in the course of business. None of the three jurisdictions surveyed has adopted this model in full; Colorado’s SB 26-189 moves in the opposite direction, replacing a duty-of-care standard with a narrower fault-based allocation and removing joint and several liability.
Critical Analysis: Toward a Hybrid Model
None of the three regulatory models reviewed here solves the accountability problem on its own terms. The EU has built the most sophisticated preventive architecture but has left the liability half of its own two-part strategy unfinished for nearly four years, meaning claimants currently rely on national tort law that was never designed for AI. The United States, through Colorado, shows how quickly even a leading accountability statute can be dismantled once industry and federal pressure intensify — accountability in that model is less a settled legal floor than a contested political outcome, subject to reversal within a single legislative session. The United Kingdom’s principles-based approach offers valuable adaptability but explicitly defers the hard question of individual redress to existing sectoral law, none of which was built with AI’s evidentiary peculiarities in mind.
A more coherent approach would combine elements of all three without their respective weaknesses. First, jurisdictions should adopt a rebuttable presumption of causation once a claimant demonstrates plausible harm and the defendant’s inability or refusal to provide adequate documentation of the system’s decision logic — following the logic of the EU’s stalled proposal, but enacted rather than perpetually pending. Second, liability should attach to the enterprise best positioned to bear and insure against the risk — generally the deployer in consumer-facing contexts — with a statutory right of indemnification against upstream developers, rather than leaving apportionment to be litigated fault-by-fault as under the Colorado model. Third, any such liability floor should be a binding statutory minimum, not solely a voluntary principle that sectoral regulators may or may not operationalise, addressing the UK’s central weakness. Such a model would preserve the flexibility that makes the UK’s sectoral approach attractive while providing the fault-based clarity Colorado has sought, and it would finally complete the accountability half of the bargain the EU proposed in 2022 but has yet to deliver.
Conclusion
The debate over AI regulation is too often framed as a question of how much prevention is enough. That framing obscures a separate and equally urgent question: what happens to the person harmed after prevention fails? The EU, the United States, and the United Kingdom each offer a partial answer, and each leaves a claimant in a materially worse position than they would occupy had a human, rather than an algorithm, caused the same harm. Closing that gap will require lawmakers to stop treating liability reform as a lower priority than regulatory prevention, and to recognise that a right without a remedy is, in practical terms, no right at all.
Bibliography
Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (AI Act) [2024] OJ L.
HM Government, A Pro-Innovation Approach to AI Regulation (White Paper, Cm 815, March 2023).
Colorado Senate Bill 26-189 (2026).
Colorado Senate Bill 24-205, Consumer Protections for Artificial Intelligence (2024, repealed 2026).
Hacker, Philipp, ‘The European AI Liability Directives — Critique of a Half-Hearted Approach and Lessons for the Future’ (Working Paper, 28 July 2023) arXiv:2211.13960.
Greenberg Traurig LLP, ‘Colorado Repeals and Replaces the Colorado AI Act’ (28 May 2026).
Littler Mendelson PC, ‘Colorado Amends its Artificial Intelligence Law, Substantially Reducing Obligations on Employers’ (15 May 2026).
Skadden, Arps, Slate, Meagher & Flom LLP, ‘Colorado Repeals and Replaces Its AI Act’ (9 June 2026).
TechTimes, ‘Colorado AI Law Reset: Discrimination Duty Dropped, Disclosure Takes Its Place’ (1 July 2026).
Technosports, ‘EU AI Liability Framework: 2026 Status and Global Impact’ (3 June 2026).
Legalnodes, ‘EU AI Act 2026 Updates: Compliance Requirements and Business Risks’ (April 2026).
Glacis, ‘UK AI Regulation Guide, April 2026: The Pro-Innovation Approach’ (24 April 2026).
[1]See European Commission, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act) (2024), establishing a four-tier risk classification for AI systems.
[2]Legalnodes, ‘EU AI Act 2026 Updates: Compliance Requirements and Business Risks’ (April 2026).
[3]Philipp Hacker, ‘The European AI Liability Directives — Critique of a Half-Hearted Approach and Lessons for the Future’ (Working Paper, 28 July 2023) (arXiv:2211.13960).
[4]Technosports, ‘EU AI Liability Framework: 2026 Status and Global Impact’ (3 June 2026).
[5]TechTimes, ‘Colorado AI Law Reset: Discrimination Duty Dropped, Disclosure Takes Its Place’ (1 July 2026).
[6]Skadden, Arps, Slate, Meagher & Flom LLP, ‘Colorado Repeals and Replaces Its AI Act’ (9 June 2026).
[7]Greenberg Traurig LLP, ‘Colorado Repeals and Replaces the Colorado AI Act’ (28 May 2026).
[8]Littler Mendelson PC, ‘Colorado Amends its Artificial Intelligence Law, Substantially Reducing Obligations on Employers’ (15 May 2026).
[9]HM Government, A Pro-Innovation Approach to AI Regulation (White Paper, March 2023), setting out five cross-sector principles: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.
[10]Glacis, ‘UK AI Regulation Guide, April 2026: The Pro-Innovation Approach’ (24 April 2026).
[11]Hacker (n 4).
