Artificial intelligence writes texts, sorts job applications, makes predictions, and helps people make decisions. But when an AI makes a mistake and that mistake results in real harm, a fairly simple question arises: Who is actually responsible?
As of August 30, 2026 · This post is for general informational purposes only and does not constitute legal advice.
Artificial intelligence has long been more than just a chat window where we type in a question and get an answer a few seconds later.
AI systems can prescreen job applications, categorize people and content, generate recommendations, manage workflows, or be part of complex products. The EU AI Act therefore explicitly classifies certain applications as high-risk—including, for example, AI systems used for hiring or selecting individuals, analyzing job applications, or evaluating candidates. AI Act Service Desk
As long as everything works, this sounds like progress at first. Processes become faster. Large amounts of data can be processed. People receive support with tasks that are time-consuming. But let’s imagine a different situation. A company receives 1,000 applications for a single position. An AI system helps analyze them and creates a ranking. A qualified female applicant ends up near the bottom of the list and is therefore not invited for an interview. It later turns out that the system systematically rated certain characteristics unfavorably.
So what now?
Was it the AI?
The system's manufacturer?
The company that deployed the AI?
The person who relied on the rankings?
Or perhaps several parties at the same time?
Welcome to one of the most interesting questions about our digital future:
Who is responsible when AI is involved in decision-making?
WHAT HAPPENED?
We have begun to use AI for more than just generating beautiful images or text. We are increasingly applying it in areas where its results can have an impact on people. The European AI Regulation also recognizes this. Its approach is specifically not to treat all AI systems the same. Among other factors, the purpose and risk of an application are decisive. This is particularly evident in the workplace.
The AI Act explicitly lists AI systems used for the hiring and selection of individuals, as well as certain human resources management systems, in its catalog of potential high-risk systems. These include, for example, systems that filter job applications or evaluate candidates. AI Act Service Desk
The reason for this is understandable: An incorrect restaurant recommendation from a chatbot is annoying. An incorrect AI assessment, however, that might prevent a person from getting a job, can affect the course of that person’s life. The recitals of the AI Act address precisely this problem. AI systems in the context of employment can significantly influence career prospects and livelihoods and, for example, perpetuate historical patterns of discrimination. AI Act Service Desk
This also changes the nature of the discussion.
We no longer have to just ask:
- What can AI do?
We must also ask:
- Who is allowed to use them, and for what purposes—and who is responsible for the consequences?
WHY IS ACCOUNTABILITY SO COMPLICATED WHEN IT COMES TO AI?
With a traditional tool, the division of roles seems relatively straightforward at first glance.
Someone manufactures the tool.
Someone buys it.
Someone uses it.
With modern AI systems, however, numerous actors may be involved.
For example, one company develops an AI model. Another company integrates it into software. A vendor brings a finished product based on it to market. An employer purchases this product. A human resources department implements it. An employee works with the results—and ultimately, a job applicant is affected by a decision.
Which one of them is responsible?
The somewhat unsatisfying but important answer is:
It depends.
And that is precisely why it is problematic to talk about “AI’s responsibility.” An AI is not a new coworker whom you can give a written warning to after a mistake. Behind the system are people and organizations that develop, provide, configure, deploy, and monitor it.
The AI Act therefore distinguishes between different roles and assigns different obligations to them. For high-risk systems, for example, there are obligations for providers and operators —that is, those who use a system under their responsibility. AI Act Service Desk
So responsibility doesn't disappear because of AI.
It spreads out.
WHAT IS THE PROVIDER'S LIABILITY?
For high-risk AI, the AI Act requires providers to implement a whole range of measures.
These include, among other things, requirements for the system itself, quality management, documentation and record-keeping obligations, as well as the prescribed conformity assessment procedure before a system of this kind is placed on the market or put into service. In addition, the regulation provides for corrective action and information obligations under certain conditions. AI Act Service Desk
This illustrates an important fundamental principle:
A provider shouldn't be able to simply say:
- We built the technology. What others do with it is no longer our concern.
But that doesn't mean:
- The provider is responsible for everything that happens to the system at any time.
After all, even the organization that actually deploys high-risk AI will have certain obligations.
AND WHAT ABOUT THE COMPANY THAT USES AI?
Let's go back to our example application.
An employer may not develop the AI system it uses on its own at all. Instead, it purchases a ready-made solution.
Does that mean he's off the hook?
No.
The AI Act establishes specific obligations for operators of high-risk AI. Among other things, they must use such systems in accordance with the instructions for use, implement appropriate technical and organizational measures, and monitor how the systems function. Human oversight must be entrusted to individuals who possess the necessary expertise, training, and authority. AI Act Service Desk
That's a pretty important point. After all, a company can't automatically hide behind the statement:
"The software decided that."
When a company uses AI in a sensitive area, the question of how it does so remains relevant.
Who controls the system?
Who understands its limitations?
What happens when anomalies are detected?
Who is authorized to intervene?
And who makes the final decision?
Technical capabilities and organizational responsibility therefore go hand in hand.
BUT THERE WAS A PERSON THERE AFTER ALL …
This brings us to a problem that is much bigger than AI.
Imagine a system evaluating 500 job applications.
It creates rankings.
Person A: 94 points.
Person B: 88 points.
Person C: 41 points.
Next to it sits a person.
Formally speaking, this person makes the decision.
But what happens in reality?
How likely is it that this person will fundamentally question every single AI result among hundreds of evaluations?
This is exactly where the concept of human oversight becomes interesting.
Article 14 of the AI Act requires that high-risk AI systems be designed in such a way that they can be effectively supervised by natural persons. Among other things, the responsible persons should understand the system’s capabilities and limitations, monitor how it operates, and be able to ignore, override, or reverse its results as necessary. AI Act Service Desk
It is particularly interesting that the text of the law even explicitly addresses a psychological issue:
Automation Bias.
Put simply, this refers to the tendency to place too much trust in automated results.
After all, the machine calculated it.
The algorithm must be right.
That’s exactly what can be dangerous.
A person sitting in front of a screen is therefore by no means an effective form of human oversight.
Human Oversight is more than just Human Presence.
SO WHAT DOES “HUMAN SUPERVISION” ACTUALLY MEAN?
Essentially, this means that people must not be reduced to a mere decorative final link in an automated decision-making chain.
Anyone who oversees a high-risk system should be able to understand its relevant capabilities and limitations. That person must be able to recognize when something is wrong, interpret the output correctly, and—where appropriate—decide not to use the result or to shut down the system. AI Act Service Desk
And for that, people need one crucial thing:
Expertise and genuine authority.
If an employee realizes that the AI system is producing nonsense but has absolutely no organizational authority to deviate from it, even the best human oversight is of little help.
This is one of the reasons why the discussion about AI literacy goes far beyond the question of how to write a good prompt.
AI literacy also means:
to understand when not to trust a machine.
AND WHO IS LIABLE IF SOMETHING ACTUALLY HAPPENS?
Here, we need to distinguish between two things that are often conflated in public discussions:
Regulatory responsibility and civil liability.
The AI Act establishes requirements and obligations for certain stakeholders and AI systems.
However, this does not automatically lead to a simple, general rule:
"If AI causes damage, X always pays."
Whether someone is liable for a specific type of damage may depend on the specific situation and other legal grounds.
This is important because “responsibility” in everyday life is much broader than “liability” in the legal sense.
A company may bear organizational responsibility.
A provider may have regulatory obligations.
A person may make a decision.
And the question of who is legally liable for a specific loss is a matter that requires a separate review.
That is precisely why we should be cautious about using simplistic headlines when it comes to AI.
"Who is liable for AI?" has no universal, one-sentence answer.
WHAT HAPPENS WHEN AI IS USED IN MEDICINE?
The problem becomes even clearer when we shift our perspective. Instead of a job application, let's consider a medical product. An AI system analyzes data and assists, for example, with a medical assessment.
Here, too, there is no simple “medical AI = high-risk” category. With regard to AI in regulated products, the AI Act takes into account, among other things, whether the system itself—or, as a safety component—falls under certain EU product regulations and requires a third-party conformity assessment. AI Act Service Desk
But the fundamental question remains:
What happens if the AI makes a mistake?
Should a doctor ignore every recommendation just because it comes from a machine?
Of course not.
Should he accept every recommendation just because a powerful system calculated it?
No, not that either.
One of the major challenges we will face in the coming years lies precisely between these two extremes.
We want to harness the benefits of AI without simply shifting human responsibility onto software.
WHAT ARE THE PROSPECTS?
This is where the debate gets interesting.
One side says:
We need clear rules.
The more AI becomes involved in sensitive areas of life, the more important transparency, oversight, and clearly defined responsibilities become. That makes sense.
No one wants to be weeded out by a flawed system and then hear:
We're sorry. That's just how the algorithm works.
Another way of looking at it is:
Too many obligations, or obligations that are too vague, can hinder innovation.
When companies are faced with complex regulatory requirements for every new AI application, costs can rise and development can slow down. Smaller companies, in particular, may be more severely affected than large corporations with their own legal and compliance departments.
And then there's a third perspective:
Perhaps it is not just the number of rules that matters.
Perhaps what matters most is whether we organize responsibilities in a way that makes practical sense.
After all, neither a complete lack of regulation nor a hundred-page compliance document automatically guarantees good decisions.
Ultimately, people need to understand what a system is capable of, where its limits lie, and when intervention is necessary.
WHAT DOES THIS MEAN FOR US?
We will have to get used to the fact that AI is increasingly involved in decision-making, even though it does not necessarily make decisions on its own—and that is precisely why we should be careful with our language.
"The AI has decided" sounds convenient.
Perhaps too convenient.
Because this statement quickly obscures the decisions that people have already made.
Someone decided to implement an AI system.
Someone decided which system to use.
Someone determined what data would be fed into it.
Someone built processes around it.
Someone determines how heavily the result is weighted, and someone decides whether and when a human can intervene.
So perhaps the more interesting question isn't:
Can AI take responsibility?
Rather:
How do we ensure that people and organizations don't lose their sense of responsibility just because an algorithm suddenly stands between them and a decision?
AI IS NOT THE END OF RESPONSIBILITY
Artificial intelligence is becoming more powerful. It will take on more tasks, and we will likely encounter decisions where it becomes increasingly difficult to determine exactly what role humans, data, models, and organizations played in the outcome. That is precisely why we need more than just better AI. We need people who understand the systems they’re working with. Companies that take responsibility for how they’re used. Providers who take their obligations seriously. Rules that provide protection where risks are particularly high, and a society that’s willing to discuss these issues without viewing every new technology as either a salvation or a doom.
Because in the end, perhaps that is precisely the crucial question for the future of AI:
The question is not whether machines will eventually be able to take on responsibility—but whether we humans are willing to take responsibility for the machines we develop and use.
Please note once again: This post is intended to provide general information and context. It does not constitute legal advice. The applicable legal provisions and the circumstances of each specific case are decisive.