MEPs want rules holding AI firms liable for damages

Full text

BRUSSELS — European lawmakers are pushing to expand the EU’s flagship AI regulations to hold American tech companies liable for the risks their most advanced models pose to humanity, according to correspondence seen by POLITICO.

The proposal by four senior lawmakers in the European Parliament would add new rules to the EU’s landmark 2024 AI Act to ensure that companies such as OpenAI and Anthropic could be held liable when their technology is deployed in unforeseen ways.

The move shows Brussels is waking up to a reality in which AI-powered harm is already happening, and risks are multiplying — and marks the first concrete effort within the EU to respond to fears over AI safety that are dominating the global political agenda.

The group is calling on the Commission to introduce an AI Liability Act “to fill the legislative gaps currently existing for these kinds of incidents, so no people or European businesses are left empty-handed against these big providers when they cause harm,” according to a Sept. 16 note to the Commission seen by POLITICO.

Kim van Sparrentak, a Dutch Green Party member and part of the Parliament’s group monitoring the rollout of the bloc’s AI rules, said the fast-moving technology is forcing the EU to rapidly update what was two years ago the world’s first major binding legislation to regulate advanced artificial intelligence models.

“Europe needs to get ahead of the curve again,” said van Sparrentak, one of the four lawmakers leading the effort alongside German conservative Axel Voss, Italian Social Democrat Brando Benifei and Irish independent Michael McNamara.

The call received support from lawmakers from the center-right European People’s Party, the Socialists and Democrats group, and the liberal Renew group, indicating broad political backing.

Extinction risks

This week marks another major moment for global AI safety efforts, following a summer filled with AI hacking incidents and extinction-risk warnings. The topic will be top of mind at the U.N.’s General Assembly in New York, during a Tuesday meeting of G7 digital affairs ministers, and at a summit this week between Chinese leader Xi Jinping and U.S. President Donald Trump.

The EU lawmakers’ call draws attention to shortcomings in the AI Act that was agreed at a time when AI agents hacking other firms felt more like a sci-fi scenario.

AI liability rules could make it easier and less costly for victims of AI-powered harm to claim compensation, for example, by shifting the burden of proof onto companies.

A newfound focus on product liability in Europe would also jibe with some sentiment in the U.S. That included backing from former Trump AI czar David Sacks at the POLITICO Decoded Summit in D.C. last week.

The EU legislators’ suggestion to add new liability rules shows a drastic reversal of the bloc’s public stance in recent months.

For weeks, Brussels had offered a single standard response to the flurry of AI-powered incidents, warnings by AI researchers and calls from tech executives to slow down AI development: the EU’s Artificial Intelligence Act is already there to avoid companies losing control of their models or agents.

The new focus on liability is a tacit admission that the AI Act alone won’t cut it.

But the push for new rules is also legislatively awkward. The EU just revised its entire regime governing how products comply with safety standards, in an update to the EU’s general product liability rules that is set to take effect on Dec. 9.

Brussels is also on a quest to slash more tech regulation in an effort to “simplify” rules to help businesses grow. AI-specific liability rules were suggested by the European Commission in September 2022, but the Commission withdrew them last year.

Legal protections

The bloc’s existing regulation already includes a view of AI through the lens of product safety. It pushes companies to assess their AI models or applications and determine the risk they pose to the audience: unacceptable, high, limited, or minimal.

But the law does little to address the damage done.

The law also doesn’t cover AI models before they’re deployed, during training or testing, even though most hacks last summer were conducted by agents powered by internal-only research models.

“The way it works right now basically grants no rights to people who are harmed by artificial intelligence,” said Mario Mariniello, senior fellow on digital and competition issues at think tank Bruegel. “It reduces the incentives for developers to factor in that risk and therefore invest into safety.”

Cybersecurity experts point to this summer’s incidents, such as the incident in which OpenAI-powered agents hacked into Hugging Face, as evidence of the need for a liability scheme.

“I don’t think that it’s a good path to go on to say that because there was no criminal intent and the AI agent did it, there is no legal liability,” said Marcus Hutchins, a U.K. cyber expert who is best known for stopping a global outbreak of WannaCry software in 2017.

Some experts, like associate professor Irene Kamara at Tilburg University, pointed to the fact that AI agents are often anthropomorphized, as if these are human-like protagonists launching an attack by their own: It “shifts the focus away from looking for the actual responsible individual(s) or persons behind the incident,” she said.