This isn't legal advice, just the operator's perspective I use to run AI in my own business in Germany. The AI itself is never liable; it isn't a person. When it makes a mistake at work, the business that uses it is usually liable to its customers, in Germany mostly through the contract under section 280 of the Civil Code (BGB). The new EU product liability rules cover software placed on the market from December 9, 2026 and let people claim against the maker of the AI software, but only for harm to body, health, property not used exclusively for work and private data, not for your business's own losses. There are no separate EU rules on AI liability: the European Commission withdrew its proposed AI Liability Directive in October 2025. So the practical answer is a rule: whatever leaves the house gets signed off by a human.
I'm a developer, not a lawyer. Sources are as of October 31, 2026; the law cited is German and EU law, and other countries have their own rules. Which tasks an AI role may handle on its own is in What Can an AI Lead Role Decide?. More basics are collected on my AI Basics page.
AI liability for businesses: who is liable to whom
Your business is liable to your customers
Most AI mistakes hit customers: a wrong quote, wrong information, a misdirected email. Section 280(1) BGB applies (English translation on gesetze-im-internet.de):
"If the obligor breaches a duty arising from the obligation, then the obligee may demand compensation of the damage caused thereby. This does not apply if the obligor is not responsible for the breach of duty."
The second sentence matters: your customer doesn't have to prove your fault; you have to show you weren't responsible. Section 619a BGB, a separate burden-of-proof rule for employees "in derogation from section 280 (1)", confirms that reading. Under section 276 you are responsible for intent and negligence, and "anyone acts negligently who fails to exercise the care required in business dealings".
Then there's section 278: you are responsible for the fault of "persons of whose services they avail themselves in order to perform their obligation" as if it were your own. If your employee sends an unchecked AI answer to a customer, that's your mistake. An AI is not a person in that wording, and the law doesn't say whether the section applies anyway. In my reading that changes little: the question becomes your own care, meaning which tool, for what, and whether anyone checks the output first.
An example: say an AI assistant promises a customer a delivery date your business can't meet, and the customer suffers a loss. "The AI wrote that" is no defence; the answer came from your business.
Without a contract, tort law remains. Section 823(1) protects "the life, limb, health, freedom, property or some other right of another person". Pure financial loss is not on that list, so in my reading the contract is usually the route.
Is the AI vendor liable? Software under the new product liability rules
Under Article 4(1) of Directive (EU) 2024/2853, "product" includes software. Recital 13 names "AI systems" and treats "AI system providers within the meaning of Regulation (EU) 2024/1689" as manufacturers, even for software "supplied through a software-as-a-service model". Member States had to transpose it "by 9 December 2026" (Article 22).
Germany did so with an act of October 22, 2026 (Federal Law Gazette 2026 I No. 321): a new Product Liability Act in force from December 9, 2026, when the 1989 act expires. Products placed on the market or put into service up to and including December 8, 2026 stay under the old law.
What this means for AI:
- Software is a product, except free and open-source software "developed or supplied outside the course of a commercial activity" (Article 2(2) of the directive).
- Learning systems count. Judging a defect includes a product's ability to keep learning or acquire new features after it is placed on the market.
- Proof gets easier. Courts can order the defendant to disclose evidence. Where proof is excessively difficult because of technical or scientific complexity, showing that a defect is likely can be enough.
The limit is in Article 6 of the directive and section 1 of the German act: compensation only covers harm to a natural person, namely death or personal injury, damage to property except property "used exclusively for professional purposes", and "destruction or corruption of data that are not used for professional purposes". So product liability won't get you back the revenue a wrong AI answer costs your business. That leaves your contract with the vendor; read it before relying on it.
The AI Liability Directive was withdrawn
On September 28, 2022 the Commission also proposed a directive "on adapting non-contractual civil liability rules to artificial intelligence", COM(2022) 496. It never came. The Official Journal of October 6, 2025 (C/2025/5423) lists it among the withdrawn Commission proposals. Since then the Official Journal's document catalogue shows no new Commission proposal with "liability" in the title on this topic (query of October 31, 2026).
Where the EU AI Act fits in
In my reading, the AI Act (Regulation (EU) 2024/1689) has no claim for damages of its own but describes what care means, most clearly in Article 26, the obligations of deployers of high-risk AI systems, as amended by Regulation (EU) 2026/1744. Paragraph 2 reads:
"Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support."
Add use according to the instructions, monitoring and keeping logs for at least six months (paragraphs 1, 5 and 6). Under the amended Article 113(c), Article 26 applies only from December 2, 2027 for high-risk systems under Annex III and from August 2, 2028 for those under Annex I. Annex III covers, for example, systems that screen or filter job applications and systems for credit scoring of natural persons. A chat assistant for quotes and emails usually isn't one.
Article 4, AI literacy, already applies to almost every business; what it requires since the amendment is in AI Literacy Under the AI Act: Training Staff.
The overview of the whole regulation is in my article on the EU AI Act.
And the employee who used the AI?
Recovering the loss from your employee is a separate question. Under section 619a BGB, the employee only owes compensation "if they are responsible for the breach of duty". German labour courts limit this further: the Federal Labour Court summarised its Grand Senate's principles in a judgment of May 21, 2015 (8 AZR 116/14) to the effect that employees are fully liable only for damage caused intentionally and not liable at all for the slightest negligence. In between, it depends on the case. Clear rules for AI use mainly protect you.
Whether your insurance covers losses from AI use is in your policy terms; ask your broker in writing.
The practical answer: sign-off rules, a human decides
In my business I work with three levels, and every personnel file states which actions are free, which need approval and which are never allowed. Level 3 is "Only with approval": "Money, anything that leaves the house, contracts, promises and judgements with no rule. Here it only prepares."
The sign-off is a wording, not a feeling: "Get it done" is not a sign-off; only a clear "send it" or "put it online" counts, logged with the exact wording and time. Sonja writes emails in my voice, I read them and hit send. And author and reviewer are never the same instance.
Mistakes still happen, but a human who has seen the result always stands between the AI and the customer, provably. To set it up:
- List where AI produces output that reaches customers or third parties: emails, quotes, answers, website copy.
- Decide what only goes out with approval: anything involving money, deadlines, promises or legal effect.
- Make the approval traceable: who, when, with what wording.
- Have someone check who didn't create it. How a second AI can do a first pass is in LLM as a Judge.
- Read the liability clauses in your contract with the AI vendor and in your customer contracts. Changes belong with a lawyer.
Which tasks belong on which level is in What Can an AI Lead Role Decide?; catching AI errors before they go out is in AI Hallucinations: Why AI Makes Things Up.
Frequently asked questions
Is the AI itself liable?
No. An AI is not a person and can be neither obligor nor defendant. People and companies are liable: your business, the software's maker and your vendor.
Do the new product liability rules apply yet?
No. Germany's new act applies from December 9, 2026. Products placed on the market up to and including December 8, 2026 stay under the old law.
Can I exclude liability towards customers by contract?
Partly, never for intent: under section 276(3) BGB "the obligor may not be released in advance from liability for intent". German standard terms add further limits, for example section 309 no. 7 BGB on injury to life, body and health and on gross negligence. Draft such clauses with a lawyer. What AI can do with contracts is in AI Contract Review: What Works.
Does a human have to check every AI answer?
Neither the BGB nor the AI Act sets a general duty. For high-risk systems, Article 26 of the AI Act requires human oversight from December 2027 or August 2028. Otherwise, checking before sending is the simplest way to show the care section 280 BGB asks about.
What to do next
Run the five steps above for the AI tools you already use and put everything that reaches customers on approval. We work through sign-off rules for your own AI employees in the weekly live Q&A call of my community AI Employee Framework; bring your real case.
