Legal liability for AI: who is responsible when the algorithm gets it wrong?

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

When a machine decides and nobody takes responsibility: what is the law?

When an artificial intelligence system makes a mistake, whether it is a wrong credit decision, a wrong classification of a medical image or an unjustified insurance decision, a legal question arises that the law has not yet fully answered: who is liable? The developer who wrote the code? The organization that ran the system? The user who clicked “Approve”?

The dilemma is especially hard because AI systems learn and change while they run, which sometimes makes their behavior unpredictable even for their developers. Unlike a physical engineering component that behaves as expected, a machine learning model that has gone through fine-tuning can develop behaviors that nobody planned.

Which three liability frameworks will apply, and which suits which case?

Israeli law has not added an “AI chapter” to the Torts Ordinance, and there is no need for one. The court applies three existing frameworks, and each of them may expose an organization that has not prepared for it:

Tort law: sections 35 and 36 of the Torts Ordinance [New Version]: if an AI system causes damage, the injured party will file a tort claim against whoever is responsible for the system’s operation. The basis: a duty of care, its breach, and damage caused by the breach. This is the broadest framework, and it suits most cases.

Product liability: the Defective Products (Liability) Law, 5740-1980 (חוק האחריות למוצרים פגומים, התש״ם-1980) imposes no-fault liability on a manufacturer when a defect in the product (a flaw that may cause bodily injury, or the absence of adequate warnings and safety instructions) has caused bodily injury (sections 2–3). The Law does not apply to purely financial damage, and it has not yet been decided whether software or an AI model is a “product” for its purposes; it can be argued that a known algorithmic bias that was not disclosed is a “defect”.

Professional negligence: section 35 of the Torts Ordinance judges a professional by the skill and care that a reasonable, prudent person qualified to work in the same profession would have used. An AI developer or operator who did not take such care, in development, testing or supervision, may be held liable.

Who will pay in the end: the developer, the user or the operator?

When an AI system causes damage, the claim may be directed against one or more of the following parties:

The developer: whoever created the algorithm is liable if they did not test the system properly, did not document its limitations, or did not identify known risks. For example, if a developer puts an AI system on the market with a known bias against a certain group, and this causes damage, the developer may be liable.

The operator: the body that uses the AI system is liable if it did not choose properly, did not supervise properly, or did not put adequate control mechanisms in place. For example, a bank that uses an AI system for loan decisions is liable if it did not check the system’s decisions or did not create control mechanisms.

The end user: a private person who uses AI is liable if they knew that the system was not suitable for a specific use and chose to use it anyway. A doctor who makes a diagnosis relying on AI that was not approved for clinical use cannot hide behind “the algorithm’s recommendation”.

In practice, more than one party may be liable. Under section 11 of the Torts Ordinance, joint tortfeasors are jointly and severally liable, and each of them can be sued; the burden is divided between them under section 84, according to justice and equity, taking into account each one’s degree of responsibility for the damage.

What does the European AI law (EU AI Act) require of Israeli companies?

The European AI Act (Regulation (EU) 2024/1689) entered into force in 2024 and also applies to companies outside the EU, including Israeli ones, that develop, sell or operate AI for European customers. This is not theoretical: an Israeli startup that markets SaaS with AI to German companies is subject to the law.

The Act classifies AI systems by risk level. “High-risk” systems, including AI in recruitment, credit, health and the justice system, require comprehensive documentation, a risk assessment and human oversight. “Unacceptable-risk” systems, such as social scoring or covert manipulation, are prohibited outright. The sanctions: for breaching the prohibitions, up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher; for breaching most other obligations, up to EUR 15 million or 3% (Article 99). Anyone who waits for an Israeli law before starting to comply may miss the deadline.

What is the law in Israel on liability for damage caused by an artificial intelligence (AI) system?

In Israel, the law in force relies on tort law and negligence. There is no specific legislation on AI, and the courts will base their rulings on the existing frameworks until the legislature steps in. In December 2023 the Ministry of Innovation, Science and Technology and the Ministry of Justice published a policy paper under which there is, at this stage, no place for cross-sector framework legislation on artificial intelligence, and each regulator will examine regulation in its own field; in April 2025 the Privacy Protection Authority published a draft guideline on the application of the Protection of Privacy Law, 5741-1981 to AI systems.

Meanwhile, the message to organizations is clear: whoever runs AI without supervision, without documentation and without bias testing may be found negligent. It is not enough to say “we relied on the vendor”. The court will examine what the organization itself did to protect the people the system affected.

Whoever operates an AI system that harms the public, without having prepared for it, is exposed to a claim and to liability.