English Law Already Decides Who Pays When AI Goes Wrong

AI liability under English law illustrated through an AI supply chain, legal contract and risk-monitoring system.

AI liability in England and Wales is already decided by existing law: contract first, then negligence, professional standards and, where AI sits inside a physical product, product liability. That is the conclusion of the UK Jurisdiction Taskforce's Legal Statement on Liability for AI Harms, published on 7 July 2026, and it is more useful, and in places more uncomfortable, than the absence of an AI Act might lead you to expect.

A great deal of commentary treats the lack of a UK AI Act as a legal vacuum: nobody knows who is responsible, so nothing can be decided until Parliament acts. The UK Jurisdiction Taskforce (UKJT) has now produced the most authoritative answer available, and its central finding is that the vacuum does not exist.

The Legal Statement on Liability for AI Harms was published on 7 July 2026, following a public consultation on a draft released in January, and has been working its way through legal commentary since. Prepared by a UKJT drafting team chaired by Matthew Lavy KC, it sets out how the private law of England and Wales applies to non-deliberate AI harms: cases where nobody set out to cause damage but damage occurred anyway.

It treats AI as a technology that is autonomous, and identifies three features that create legal uncertainty: the relationship between input and output can be unpredictable, the way a system reaches its output can be opaque, and users have limited control over what it does.

What the Statement covers

  • Contract
  • Negligence and causation
  • Professional liability
  • Vicarious liability
  • Product liability
  • False statements: negligent misrepresentation, defamation and deceit

What it leaves out

  • Data protection
  • Intellectual property
  • Competition claims and economic torts
  • Use of AI by public authorities
  • Contract formation

Its conclusion is that English law is flexible, has absorbed disruptive technologies before, and is generally well equipped for the questions AI raises, with the caveat, repeated throughout, that application will always be highly fact-dependent.

The Statement is not legally binding. It aims to provide early legal certainty in an area where few cases have yet reached the courts, and it is expected to carry persuasive weight when they do.

Is contract where your AI liability actually sits?

The UKJT expects contract to be the primary basis on which liability is allocated between participants in an AI supply chain. Not statute, not tort: the agreements the parties signed, through their warranties, indemnities and limits on liability. Where there is no contract between the parties, negligence will usually apply instead.

That is a plain statement with immediate consequences, because many AI supply agreements now in force were not drafted with this allocation in mind. Model provider terms, integrator contracts, reseller arrangements and client master services agreements were frequently written before anyone had thought carefully about what happens when a system produces a confidently wrong output that someone relies on. If contract is the primary allocator, then the position you negotiated, including the position you accepted by not negotiating, is your risk position.

Does professional liability run in both directions?

The most counter-intuitive finding, and the one most likely to surprise a board, is that professionals can be liable in negligence both for over-reliance on AI and for failure to use it.

The logic is unremarkable once stated. Negligence measures conduct against the standard of a reasonable practitioner, and that standard moves as practice moves. A professional who accepts an AI output uncritically may fall below it. So, in time, may a professional who declines to use a tool that competent practitioners in the field now use as a matter of course.

On the first side, the Statement points to choosing an unsuitable tool, carrying out poor due diligence, failing to test or validate outputs and supervising AI use inadequately. It also refers to lawyers who have put AI-generated, non-existent authorities before the courts.

The trap

The defensive instinct: avoid AI and avoid the liability. It does not hold up, because the standard of care is set by what reasonable practitioners do, and that is a moving target in both directions.

The fix

Use AI where competent practitioners in your field now do, and check its output the way a competent practitioner would.

Why could missing AI records count against you?

The most operationally significant part of the Statement concerns causation, and it deserves close attention from anyone building or deploying these systems.

The ordinary "but for" test will often remain workable. But the UKJT acknowledges real difficulty where the nature of an AI system makes a counterfactual hard or impossible to establish: where evidence was never gathered, was not retained, or cannot be reconstructed because the system behaved autonomously.

English law, the Statement says, is capable of responding to such evidential gaps. It may do so by drawing inferences, or by treating a claimant's evidence more benevolently where the defendant's own failure to record or retain relevant information contributed to the uncertainty.

Read that again in commercial terms. If your system does not log what it did and why, and a dispute arises about what it did and why, the court may resolve the resulting uncertainty against you.

Observability stops being an engineering virtue and becomes a legal position.

On this reading, these records are part of your defence, and their absence is part of the claimant's case:

  • Decision logs
  • Input and output retention
  • Model and prompt versioning
  • Evaluation records

Where does AI liability land in the supply chain?

The Statement also concludes that foundation model developers are, in most circumstances, less likely to be liable for harms arising from unforeseeable or insufficiently tested uses of their general-purpose models. Developers of narrowly targeted applications face greater exposure. And where an AI system causes harm by acting autonomously, the UKJT considers it highly likely that its developer or deployer would be liable, unless the harm was unforeseeable.

It is worth being direct about what that means. The party most likely to answer for a harmful outcome is not the organisation that trained the model. It is the organisation that selected it, integrated it, configured it and put it in front of users, which in most commercial arrangements means the integrator and the deploying client rather than the lab.

Anyone building AI systems for clients should be reading that as a description of their own position. That includes us: we build task-specific AI applications for clients, and the Statement describes our position as clearly as anyone's.

What gaps could the UKJT not close?

The Statement is candid about its limits. Strict liability under the Consumer Protection Act 1987 is only likely to apply where AI is built into a physical product. That leaves a gap where software causes harm without being embodied in a physical product. The Law Commission is reviewing the product liability regime, including how it applies to software, and closing that gap may require legislation.

The Law Society welcomed the clarity the Statement brings, but its vice president, Brett Dixon, flagged two areas of continuing uncertainty: product liability, for both AI-embedded products and standalone AI software, and harm that occurs without negligence.

Several areas fall outside the Statement altogether, including data protection, intellectual property and competition claims. We look at the intellectual property side, and how AI training uses creative work, in our piece on AI licensing and copyright.

Highly autonomous systems, where decision-making is genuinely opaque, are where these principles will be tested hardest. The UKJT considers that existing rules can accommodate them. The first cases will show how.

So this is not a complete answer. It is a considerably better map than existed a year ago, with the remaining blank areas honestly marked.

What should organisations deploying AI do now?

"No AI Act" has never meant "no law". It means the law arrives through contract, negligence and professional standards rather than through a single statute, and that it will be applied to specific facts by courts rather than announced in advance by regulators. For where UK regulation itself is heading, see our analysis of UK AI regulation and the new AI minister.

For organisations deploying AI, three practical conclusions follow:

  1. Review the contracts, because that is where liability is being allocated whether or not anyone negotiated it deliberately.
  2. Keep records, because their absence may be held against you.
  3. Stop treating non-adoption as the safe option, because the standard of care does not stand still.

How should AI systems be built with liability in mind?

For teams building or commissioning AI systems, the Statement turns several engineering choices into legal ones. Legal commentary on the Statement points to record-keeping, due diligence, transparency and human oversight as the practical safeguards. In practice, that means:

  • Log from day one. Record inputs, outputs, decisions, and the model and prompt versions in use. Agree with your legal advisers how long those records should be kept.
  • Document why you chose the model. The Statement treats an unsuitable tool and poor due diligence as possible negligence, so record the selection, the testing and the reasons behind them.
  • Validate outputs before anyone relies on them. In a pharmaceutical compliance tool we built, a dedicated agent's only job is to check that the main model's findings are backed by evidence. Our CTO describes it in moving AI from proof of concept to production.
  • Keep a person on consequential actions. In the AI-powered CRM we built for ourselves, every action that changes data is approved by a person first.
  • Limit what the system can do. Scoped permissions and testing against hostile inputs reduce the chance of an autonomous action nobody intended. Our analysis of the SalesBleed vulnerabilities shows why those controls matter.

Building or buying an AI system?

We design and build LLM and generative AI applications with logging, output checks and human approval designed in from the start, so your system can account for what it did and why.

We are not lawyers, and your contract terms need legal advice. But if you need an AI system that keeps the records this Statement makes important, we can help you build it.

Talk to us about your AI project

Frequently asked questions

Does the UK have an AI Act like the EU?

No. The UK has no single AI statute equivalent to the EU AI Act, and the UKJT's central finding is that this does not leave a legal vacuum. English private law, through contract, negligence, professional liability and product liability, already applies to AI harms. It arrives through existing legal principles rather than a single dedicated statute.

Who is liable when an AI system causes harm under English law?

It depends heavily on the facts. The UKJT's Statement points to contract as the primary way liability is allocated between participants in an AI supply chain, and to the organisation that selected, integrated and deployed a system, rather than the developer of a general-purpose model, as the party most likely to answer for downstream harm.

Can a professional be negligent for using AI, or for not using it?

Both, according to the UKJT. Relying on an AI output without proper scrutiny can fall below the standard of a reasonable practitioner, but so can refusing to use a tool that competent practitioners in the field now use as standard practice.

Why does record-keeping matter for AI liability?

Because where causation is hard to establish, English law may resolve the resulting uncertainty against whoever failed to record or retain relevant information. Decision logs, input and output retention, and model and prompt versioning work as part of a legal defence, not just good engineering practice.

Are foundation model developers liable for how their models are used?

The UKJT concludes that, in most circumstances, they are less likely to be liable for harms from unforeseeable or insufficiently tested uses of general-purpose models. That risk tends to sit further down the supply chain, with the organisation that selected, configured and deployed the model in front of users.

Is a business liable for what its AI chatbot says?

It can be. The UKJT says liability for negligent misrepresentation can arise where a business presents a chatbot as speaking for it, or holds out its answers as correct. For defamation, liability depends on being a publisher in law, and context, such as a clear warning that content is AI-generated, can affect whether a statement is defamatory.

Is the UKJT Legal Statement legally binding?

No. It is a statement of the law by an expert panel, not legislation or a court judgment. It aims to give early legal certainty while few AI cases have reached the courts, and it is expected to carry persuasive weight.

What has the UKJT Legal Statement not resolved?

Strict product liability is only likely to apply where AI is built into a physical product, leaving a gap for harm caused by standalone software. The Law Commission is reviewing product liability, and closing the gap may require legislation. Data protection, intellectual property and competition claims are outside the Statement's scope.

Sources

This article summarises the Legal Statement for general information. It is not legal advice.

Have a project in mind? Let’s get to work.

Let’s chat about how we can help you. Fill in the details and we’ll get back to you as soon we can.