When an AI product causes harm, responsibility usually falls on the companies and people who built, sold or deployed it, not on the AI itself. Depending on the facts, an AI startup can face claims for negligence, product liability, breach of contract or warranty, consumer protection violations, discrimination, privacy violations and intellectual property infringement. Who ultimately pays is shaped by the law, by the contracts between the developer, its vendors and its customers, and by insurance.
For founders, the practical question is not whether liability exists but where it lands in the AI supply chain and how to manage it before a problem occurs. Here is how liability for AI systems generally works today, with a focus on California startups.
Who Is in the AI Liability Chain?
Most AI products involve several parties, and each can carry some share of the risk:
- Model developers that train foundation models or task-specific models.
- Application builders that fine-tune or wrap a model in a product, often through an API.
- Data providers that supply training or reference data.
- Deployers and business customers that use the AI tool to make decisions about their own customers, patients or employees.
- End users who rely on the output or misuse the tool.
A startup is frequently in the middle of this chain: it depends on an upstream model provider and sells to downstream customers. That position means it needs to review the terms it accepts upstream and the terms it offers downstream, so it does not end up promising more than its own vendors stand behind.
The Main Legal Theories
Negligence
A plaintiff may argue the company failed to use reasonable care in designing, training, testing, monitoring or warning about its system. Evidence of testing, documented risk assessments, human review for high-stakes uses and prompt responses to known problems can matter a great deal in a negligence case.
Product Liability
Strict product liability traditionally applies to tangible products with manufacturing defects, design defects or inadequate warnings. Whether software and AI outputs count as “products” is unsettled. Many courts have treated software and information as services, but some recent decisions have allowed product liability claims against AI and app developers to proceed. AI embedded in physical goods, such as vehicles, medical devices or robotics, is more likely to be treated as part of a product.
Contract and Warranty
Customers can sue for breach of contract or breach of express or implied warranties if the product does not perform as promised. Marketing materials, sales decks and service level commitments can become part of the bargain, so claims about accuracy or capability should be ones the company can support.
Consumer Protection and Deceptive Claims
The Federal Trade Commission has brought enforcement actions over exaggerated or unsupported AI claims, and California’s Unfair Competition Law and False Advertising Law reach similar conduct. Overstating what an AI product can do, or failing to disclose material limitations, creates risk even if no one is physically harmed.
Discrimination
AI used in hiring, lending, housing, insurance or similar decisions can produce discriminatory outcomes. California’s civil rights regulations now address automated-decision systems used in employment, and federal anti-discrimination laws apply regardless of whether a human or an algorithm made the decision. Both the vendor and the employer or lender using the tool may face scrutiny.
Privacy and Data Security
Training and operating AI often involves personal information. The California Consumer Privacy Act (CCPA) and its regulations, including rules on automated decisionmaking technology and risk assessments, along with data breach laws, can create obligations and private claims. See our post on cybersecurity laws for AI startups.
Intellectual Property
Startups face claims that training data or outputs infringe copyrights, and trade secret claims if confidential information is used improperly. These disputes are being actively litigated, and the law remains in flux.
California-Specific Developments
California has been active in regulating AI. Among other developments, the state has enacted a law providing that a defendant who developed, modified or used an AI system generally cannot defend a claim by arguing that the AI acted autonomously. It has also adopted transparency requirements for certain generative AI developers, including disclosures about training data, and a framework for the largest frontier model developers. Many of these laws apply only to companies above certain size or capability thresholds, and some have phased effective dates. Startups should check which rules apply to them; our post on regulatory compliance for AI-based products provides an overview.
If you sell outside California, other regimes may apply, such as Colorado’s AI law for high-risk systems and the EU AI Act, which reaches companies that place AI systems on the EU market.
How Startups Can Manage AI Liability
- Know your use case. Liability risk is much higher for AI that affects health, safety, money, employment or legal rights than for low-stakes productivity tools.
- Test and document. Keep records of training data sources, evaluation results, bias testing, red-teaming and fixes. Documentation is often the strongest evidence of reasonable care.
- Keep humans in the loop for high-impact decisions, and design clear escalation paths.
- Warn and disclose. Explain limitations, intended uses and the need for human review in plain terms, not buried in fine print.
- Allocate risk by contract. Use warranty disclaimers, limitation of liability caps, indemnities, acceptable use policies and customer responsibilities for how outputs are used. Review upstream model terms so your downstream promises match. Our post on contract review covers what to look for.
- Get appropriate insurance. Technology errors and omissions, cyber and general liability policies may respond differently to AI-related claims, and some insurers are adding AI exclusions. Review policy language with a broker.
- Use the corporate form properly. Operating through a properly maintained corporation or LLC generally keeps business liabilities with the company rather than the founders.
Contracts Have Limits
Contract terms allocate risk only between the parties who sign them. A limitation of liability clause will not stop a third party who was harmed and never agreed to your terms. Consumer-facing disclaimers are scrutinized more closely than business-to-business terms, and California law restricts contractual exemptions for fraud, willful injury and certain violations of law. Indemnities are also only as good as the financial strength of the party giving them. Treat contracts as one layer of protection, not the whole plan.
The Takeaway
There is no single AI liability statute that answers “who is responsible.” Instead, existing theories such as negligence, product liability, contract, consumer protection, discrimination, privacy and IP law are being applied to AI, while California and other jurisdictions add AI-specific rules. Startups that understand their place in the AI supply chain, document responsible development, write clear contracts and carry suitable insurance are in a much better position if something goes wrong.
Frequently Asked Questions
Can an AI startup avoid liability by saying the AI made the decision?
Generally, no. Courts look at the people and companies that designed, trained, sold and deployed the system, and California has enacted a statute limiting a defense based on the AI acting autonomously. The better approach is to manage risk through design, testing, contracts and insurance.
Is AI software a product for product liability purposes?
The law is unsettled. Traditionally, strict product liability applied to tangible goods, and many courts treated software and information as services. Some recent decisions have allowed product liability claims against AI and app developers to proceed, so startups should not assume strict liability can never apply.
Does a terms of service limitation of liability protect my company?
It helps, but it has limits. Limitation of liability clauses and warranty disclaimers are often enforced between businesses, but they are less reliable against consumers, generally do not bar claims by third parties who never agreed to them, and usually cannot shield fraud, gross negligence or statutory violations.
Are founders personally liable for harm caused by their AI product?
Usually the company, not the founders, bears liability if the business is properly formed and maintained as a corporation or LLC. Founders can still face personal exposure for their own wrongful acts, certain statutory violations, or if they ignore corporate formalities and commingle funds.
How Sutter Law Can Help
We advise AI companies on product terms, customer and vendor contracts, privacy compliance and risk allocation. Learn more about our AI startup legal services, or contact us for a free consultation.
This article is general information, not legal advice. Reading it does not create an attorney-client relationship.
