Liability in the Age of Automation: Who Bears the Risk When AI Causes Harm?

Autonomous systems and AI-enabled products are moving from experimental tools into operational decision-making. They may influence credit assessments, logistics, workplace processes, medical support, security systems, investment activity and consumer services. When these systems cause financial loss or physical injury, the central legal question is rarely whether the technology acted independently. It is whether a legally responsible party failed in the design, production, deployment, supervision or use of that technology.

For businesses and investors operating across borders, liability cannot be treated as an afterthought. The allocation of risk should be considered before an automated system reaches customers, employees, counterparties or the public.

Autonomy Does Not Eliminate Human or Corporate Responsibility

AI systems may generate outputs without a person approving each individual decision. That operational autonomy does not necessarily create a legal vacuum. In most liability analyses, attention remains focused on the people and organisations surrounding the system: the developer, manufacturer, distributor, deployer, owner, operator and user.

The relevant question will often be fact-sensitive: who had meaningful control over the risk, what safeguards were reasonably available, and what role did each party play in the harmful outcome? The answer may differ substantially between a defective industrial robot, a vehicle with automated driving functions, an algorithm that rejects a legitimate transaction, and a generative AI tool that produces unreliable advice.

Potential Exposure Across the Technology Chain

Responsibility may arise at several points in the life cycle of an automated product. More than one party may face exposure where harm results from a combination of product design, inadequate instructions, unsafe integration and inappropriate use.

Developers and Software Providers

Software developers may face scrutiny where the alleged harm is connected to system architecture, training and testing practices, known limitations, cybersecurity weaknesses, unreliable outputs or insufficient warnings. The legal assessment may also consider whether the provider made claims about performance or safety that were not supported by the product's actual capabilities.

For providers of adaptable or continuously updated systems, governance becomes especially important. Changes to a model, data source, interface or decision threshold can alter the risk profile after initial deployment. Clear version control, testing records, incident procedures and customer communications can therefore be as significant as the original development process.

Manufacturers, Integrators and Distributors

Where software is embedded in a physical product, manufacturers and integrators may have distinct responsibilities. A safe software component can still create risk if it is installed in an unsuitable environment, connected to unreliable sensors, configured incorrectly or marketed without adequate operating conditions.

Distributors and commercial intermediaries should also understand the product they place in the market. Contractual allocation of risk may offer recourse between commercial parties, but it may not always prevent claims by an injured person or regulator. The practical question is whether the relevant party carried out sufficient technical, legal and commercial review for the role it assumed.

Deployers, Owners and End-Users

Businesses that purchase or deploy AI systems are not simply passive recipients of a vendor's technology. They may bear responsibility for selecting an appropriate use case, maintaining human oversight, training personnel, protecting data, monitoring outcomes and responding to warning signs.

An end-user may be exposed where harm follows a clear departure from instructions, an unauthorised modification, reckless reliance on an output or a failure to intervene when the system operates outside its intended conditions. Conversely, a user should not be expected to compensate for defects or risks that were concealed, poorly documented or impossible to identify through ordinary use.

How Liability May Be Assessed

Claims involving automation are likely to draw on established legal concepts while testing their application in new technical settings. Depending on the facts, a dispute may involve product-related responsibility, contractual obligations, professional duties, negligence-based claims, misrepresentation, data protection concerns or regulatory non-compliance.

Evidence will be decisive. Parties may need to establish how the system was designed, what data or inputs it received, which version was operating, whether it was used as intended, what warnings were issued, and whether the harmful outcome was reasonably foreseeable. This can be difficult where systems are complex, proprietary or capable of changing over time.

The most defensible AI strategy is not to promise perfect autonomy, but to establish clear accountability before a failure occurs.

Contracts Should Allocate Risk, Not Conceal It

Well-drafted agreements are central to managing technology risk between commercial parties. A contract should address the scope of permitted use, performance expectations, allocation of technical responsibilities, testing and acceptance processes, support arrangements, data handling, cybersecurity, audit rights, incident reporting and cooperation during investigations.

Indemnities, liability caps, exclusions and insurance requirements should be assessed against the system's actual risk profile rather than copied from a standard software agreement. A customer using AI in a low-risk administrative function may require a different allocation from an operator deploying automated systems in safety-sensitive or financially consequential settings.

Contractual protections must also be designed with the limits of contract law in mind. Agreements can allocate commercial exposure between parties, but they may not fully eliminate duties owed to third parties or obligations arising under applicable mandatory rules.

Practical Governance for Companies Using AI

Companies can reduce uncertainty by creating governance that matches the scale and sensitivity of the technology they use. This is not only a compliance exercise; it is a practical method of preserving evidence, identifying responsibility and improving decision-making if an incident occurs.

• Map each AI system, its owner, its purpose and the decisions it can influence.
• Classify use cases according to potential financial, safety, operational and reputational impact.
• Document vendor diligence, technical testing, limitations and approval decisions.
• Define human oversight, escalation routes and circumstances in which automated outputs must not be followed.
• Maintain change-management records for updates, retraining, integrations and configuration changes.
• Prepare an incident response process that preserves relevant logs, communicates with affected stakeholders and enables prompt legal assessment.

A Forward-Looking Approach to AI Risk

Legal responsibility for harm caused by AI will rarely rest on a single label such as “developer” or “user.” Liability is more likely to follow the chain of decisions that created, introduced, controlled or ignored the relevant risk. For organisations operating in Türkiye or across multiple jurisdictions, that chain should be examined alongside the applicable contractual framework, product environment, sector-specific expectations and cross-border exposure.

Before launching, acquiring or scaling an autonomous system, decision-makers should obtain tailored legal and technical advice on the intended use, risk allocation and governance model. Early assessment can help businesses deploy innovation with greater confidence while preserving a clear route to accountability when technology does not perform as intended.