Vicarious Liability and AI: Who Is Responsible When Technology Causes Loss?

Artificial intelligence (AI) is increasingly influencing how modern businesses operate. From AI-driven analytics in financial services to autonomous systems in logistics and healthcare, organisations are embracing automation to boost efficiency and reduce costs. Yet, alongside the opportunities, AI raises profound legal and ethical questions chief among them: who bears responsibility when AI causes loss? This article examines whether, and how, the doctrine of vicarious liability can be applied in the age of artificial intelligence, and considers how the law is adapting to meet the risks of emerging technologies.

What is Vicarious Liability?

Vicarious liability is a well-established doctrine in English law whereby one party is held liable for the tortious acts or omissions of another. Most commonly, this arises in the employment context, where an employer may be held responsible for the wrongful acts of an employee if those acts are committed in the course of their employment. The key case that outlines the general principles of vicarious liability is Lister v Hesley Hall Ltd [2001] 2 AC 215, where the House of Lords confirmed that an employer could be held vicariously liable for the acts of an employee if those acts were closely connected with the employee’s role, even if they were wrongful acts.

The rationale is rooted in public policy: employers are generally better positioned to absorb or insure against losses, and they exercise control over their employees’ conduct. The doctrine ensures that injured parties are not left without remedy and that risk is allocated to the party that benefits from the activity giving rise to the loss.

The Legal Challenge: AI as a Non-Human Actor

AI systems introduce complexity to the traditional liability framework. Unlike employees, AI tools are not legal persons, they do not owe duties of care, and they cannot be said to act “in the course of employment.” Many AI applications are capable of autonomous learning and decision-making that is not directly foreseeable by the human designers or operators.

This creates uncertainty in attributing fault. If a machine makes a harmful decision such as approving a discriminatory loan, executing a flawed financial transaction, or issuing incorrect legal advice who is responsible? Is it the employer who uses the AI system, the software developer, or the organisation that trained it?

The case of Barclays Bank plc v. Various Claimants [2020] UKSC 13 is a key example where vicarious liability was assessed in a non-typical context (i.e., non-employee relationships). The Supreme Court ruled that vicarious liability would not extend to independent contractors unless there was a sufficiently close connection between their work and the business activities. This raises a pertinent point for AI: the question of whether businesses that deploy AI systems, yet have limited oversight over the machine’s actions, can be held liable.

Can AI Fit into the Vicarious Liability Framework?

To date, English courts have not recognised AI systems as agents or employees capable of generating vicarious liability. The legal tests for employment involve key characteristics such as mutuality of obligation, control, and personal service none of which AI can satisfy.

Accordingly, courts are unlikely to apply traditional vicarious liability principles to AI systems directly. However, liability may still arise indirectly through the actions of human agents involved in deploying or managing the AI. For example, if an employee negligently uses an AI tool inputting incorrect data, failing to monitor its performance, or overriding safeguards, The employer may be held vicariously liable for the employee’s conduct. In Dubai Aluminium Co Ltd v. Salaam [2002] 1 WLR 283, the House of Lords clarified the scope of vicarious liability, stating that employers could be liable for the actions of employees committed in the course of employment, even if those actions were “unauthorised” but still within the scope of their employment.

Where Vicarious Liability Ends: The Limits of Human Oversight

The more complex issue arises where the AI system causes loss in a manner not reasonably foreseeable or directly linked to human input. This is common in machine learning systems that evolve and adapt independently based on new data. In these situations, the damage may not be attributable to any single act of negligence or mismanagement.

The employer may argue that, having taken reasonable steps to assess and implement the technology, it should not be liable for unpredictable outcomes. On the other hand, injured parties may assert that deploying powerful, opaque, and potentially harmful systems without sufficient safeguards constitutes a failure of responsibility.

Alternative Legal Routes: Negligence and Product Liability

Where vicarious liability does not apply, claimants may pursue actions in negligence. Organisations deploying AI systems owe a duty of care to those affected by their use. If a company fails to properly test, audit, or supervise an AI tool particularly in a safety-critical environment, it may be found liable for failing to meet the standard of reasonable care. The case of Caparo Industries plc v. Dickman [1990] 2 AC 605 established the modern test for negligence, requiring that harm must be foreseeable, there must be a relationship of proximity, and it must be fair, just, and reasonable to impose a duty of care.

Similarly, manufacturers and developers may be held liable under product liability regimes if the software or hardware is defective. Donoghue v Stevenson [1932] AC 562, the foundational case of modern product liability, established the principle that manufacturers owe a duty of care to the ultimate consumers of their products. In the context of AI, if a system’s design or code causes harm, the developer may be responsible.

However, both negligence and product liability claims require establishing causation, a challenging hurdle when the mechanism of harm lies within a black-box algorithm that even its creators cannot fully explain.

Regulatory Developments in the UK and Beyond

In response to these challenges, regulators in the UK and internationally are beginning to consider targeted reforms. In the UK, the government’s approach to AI regulation has so far been guided by its pro-innovation strategy, focusing on principles rather than prescriptive rules. The 2023 white paper, A Pro-Innovation Approach to AI Regulation, sets out five guiding principles; safety, transparency, fairness, accountability, and contestability, but stops short of creating new legal duties or liabilities. Regulation is expected to be implemented through existing sector-specific regulators such as the Financial Conduct Authority (FCA), the Competition and Markets Authority (CMA), and the Information Commissioner’s Office (ICO).

Practical Considerations for Businesses

In the current legal landscape, organisations cannot rely on AI immunity. They remain responsible for how their technologies are used, and where harm occurs, courts will examine governance procedures, oversight, and the foreseeability of risks.

Businesses should implement robust governance policies around AI deployment, including risk assessments, audit trails, employee training, and third-party vendor checks. Contracts should allocate liability clearly, especially where critical functions are outsourced. Insurance policies should also be reviewed to ensure they cover technology-driven risks.

Ultimately, deploying AI without understanding its implications or limitations is unlikely to absolve an organisation of responsibility.

Key Takeaways on Vicarious Liability and AI

Vicarious liability, as it stands today, offers only partial answers to the legal questions raised by artificial intelligence. While employers may be held liable for the actions of employees misusing AI, the doctrine does not accommodate the growing reality of autonomous systems making impactful decisions without direct human control.

In the absence of dedicated legislation, courts are likely to expand the scope of negligence, product liability, and enterprise risk principles to allocate responsibility for AI-caused harm. Organisations must act with foresight, ensuring they understand and manage the risks of the technologies they deploy.

Until the law catches up, the responsibility for AI’s actions rests not with the machine, but with those who choose to use it.

Need Legal Advice on Professional Negligence Claims?

Our solicitors and barristers are experienced in advising clients on the legal and regulatory risks associated with artificial intelligence, automation, and advanced technology deployment. Whether you are a business developing AI or a party affected by its misuse, contact us today for clear, commercial legal advice.