AI liability is the legal responsibility that arises when an AI system causes harm — financial, reputational or physical. In the European Union, the AI Liability Directive together with the EU AI Act determines who is liable: the developer, the deployer (the business using the AI) or the end user. For SMBs in the Netherlands, this is not a theoretical concern: the moment you deploy AI in your business processes, you carry responsibility for its outcomes.
A chatbot that gives a customer wrong advice. An AI scoring model that denies a loan on discriminatory grounds. An automated system that sends invoices to the wrong party. The damage is real, and the question "who pays?" has legal consequences that every business using AI needs to understand.
What Risks Does AI Bring?
AI risks fall into five categories. Each type carries different legal and financial consequences.
1. Hallucination and Erroneous Output
Generative AI models — ChatGPT, Claude, Gemini — sometimes produce information that is factually incorrect but sounds convincing. This is called hallucination. An AI chatbot that tells a customer a product has a certain feature it doesn't have can lead to returns, complaints or claims.
Concrete risk: a legal consultancy that uses AI to generate contract clauses and overlooks a defective clause can be held liable for the resulting damage to its client.
2. Discrimination and Bias
AI models train on historical data. If that data is biased — and it almost always is — the model reproduces those biases. An AI recruitment tool that has learned that successful candidates were predominantly men aged 30-45 will systematically score women and younger candidates lower.
The EU AI Act classifies AI in recruitment as high-risk. Discrimination through AI can result in fines, damage claims and reputational harm. The Dutch Data Protection Authority and the Netherlands Institute for Human Rights actively enforce in this area.
3. Data Breaches and Privacy Violations
AI systems often process large volumes of data, including personal data. A poorly secured AI system can become a data breach entry point. Think of: customer data sent to an external AI API without adequate security, or training data that unintentionally contains personal information.
Read our detailed article on GDPR and AI rules for specific privacy obligations.
4. Operational Errors
An AI system that automates inventory decisions and makes a forecasting error can lead to EUR 50,000 in excess stock or missed sales. An automated email system that communicates the wrong price to customers creates legal obligations.
5. Reputational Risk
An AI chatbot that gives inappropriate responses or an automated system that acts in a discriminatory manner can lead to public outrage and lasting reputational damage — especially in the social media age where a single screenshot can go viral.
Who Is Liable When AI Goes Wrong?
The liability question is complex. Multiple parties can be responsible.
| Party | Liable for | Example |
|---|---|---|
| AI developer | Defects in the model, insufficient safety measures | OpenAI is liable if GPT-4 structurally generates dangerous instructions |
| Deployer (your business) | Improper use, insufficient oversight, missing human control | You are liable if you deploy a chatbot without reviewing its output |
| End user | Misuse of the system | An employee who deliberately enters incorrect data |
The AI Liability Directive (2024) introduces two key principles:
-
Reversal of burden of proof: If an AI system causes damage and the business has not complied with transparency obligations, the causal link is presumed. The business must then prove it was not responsible — rather than the victim having to prove the opposite.
-
Right of disclosure: Victims gain the right to demand information about the AI system that caused the damage.
In practice this means: if you deploy AI and something goes wrong, you must be able to demonstrate that you took adequate measures. Without documentation and audit trails, your legal position is weak.
Read our overview of AI legislation in the Netherlands and the EU AI Act for the full legal context.
Learn more about AI consulting?
View serviceHow to Protect Your Business Against AI Risks
1. Contractual Protection
Your agreement with your AI vendor is your first line of defense. Ensure it includes these clauses:
- Liability allocation: Who is responsible for which type of damage?
- Accuracy SLAs: What error margin is acceptable?
- Data breach indemnification: Who pays in the event of a data breach through the AI system?
- Data processing agreement (GDPR): Mandatory if the vendor processes personal data
- Audit rights: The right to have the AI system tested for bias and security
- Exit strategy: What happens to your data when you terminate the contract?
2. AI Liability Insurance
In the Netherlands, insurers like Hiscox, Allianz and AIG now offer policies that cover AI-related damage. Pay attention to coverage:
| Coverage | What It Covers | Indicative Premium |
|---|---|---|
| Professional liability (extended) | Erroneous AI advice, incorrect output | EUR 500-2,000/year |
| Cyber and data risk insurance | Data breaches through AI systems | EUR 1,000-5,000/year |
| Product liability (AI) | Damage from AI-driven products/services | EUR 800-3,000/year |
| Directors' liability | Claims against directors for inadequate AI governance | Depends on revenue |
Tip: check whether your existing professional liability insurance excludes AI-related damage. Many older policies have an exclusion for "automated decision-making."
3. Technical Measures
- Human-in-the-loop: Have a human review the output for decisions with financial or legal consequences
- Monitoring and logging: Record every AI decision with input, output and timestamp
- Bias testing: Periodically test the system for discrimination using diverse test data
- Fallback scenarios: Define what happens when the AI system fails or produces unreliable output
4. Organizational Measures
- AI governance policy: Document how your organization uses AI, who is responsible, and what controls are in place
- Training: Ensure employees know how to evaluate AI output
- Incident response plan: Define in advance how you act in the event of an AI-related incident
Find the full step-by-step approach in our AI compliance checklist for SMBs.
Save 8 hours per week on manual risk assessments and compliance documentation
Risk Classification Under the EU AI Act
The EU AI Act divides AI systems into four risk categories. Liability and obligations are directly linked to the risk level.
| Risk Level | Examples | Obligations |
|---|---|---|
| Unacceptable | Social scoring, manipulative AI | Prohibited |
| High risk | HR screening, credit scoring, medical AI | Conformity assessment, documentation, human oversight, bias monitoring |
| Limited risk | Chatbots, deepfake generators | Transparency obligation (user must know it's AI) |
| Minimal risk | Spam filters, AI in video games | No specific obligations |
Most SMB AI applications — chatbots, email automation, inventory optimization — fall in the limited or minimal risk category. But the moment you use AI for decisions about people (HR, credit, insurance), you enter the high-risk domain with heavier obligations. A concrete example: AI in healthcare almost always falls under high risk due to its impact on patient health. In the legal sector, AI risks and liability questions are particularly relevant given the high stakes of legal advice and decision-making.
Is your organization prepared for these requirements? Check with our article on whether your business is ready for AI.
Frequently Asked Questions
The Next Step
AI risks are manageable — but only if you take them seriously before something goes wrong. The businesses that organize their governance, contracts and insurance now will be in a stronger position than those who only act after an incident.
The key is prevention: document your AI use, ensure human oversight, test for bias and arrange the right contracts and insurance. That's not bureaucracy — it's business risk management.
Want to have your AI use reviewed for risks and compliance? An AI consulting session gives you a clear picture of where you stand and what you need to do. And for the technical side — custom software with built-in governance and audit trails — we can help you build a solution that is both legally and technically sound.
Learn more about AI consulting?
View service