Artificial Intelligence and Legal Liability: Who Bears the Risk When AI Fails?

Introduction

Artificial intelligence has expanded beyond technological experimentation and into the architecture of modern commercial activity. Businesses now deploy AI systems for customer engagement, fraud detection, credit assessment, recruitment, healthcare, content generation, cybersecurity and other functions previously performed exclusively by human operators.

The commercial benefits of these systems are accompanied by a distinct legal challenge. AI systems can produce inaccurate, discriminatory or otherwise harmful outputs, while the consequences of those outputs can extend beyond the technology itself. An AI-generated decision could infringe an individual's rights, compromise confidential or proprietary information, or result in the unlawful processing of personal data. The legal issue following such an event is therefore not simply whether the AI system failed, but where responsibility lies among the parties involved.

This issue is particularly relevant in Nigeria, where AI governance is developing alongside existing legal frameworks governing data protection, intellectual property, consumer protection, cybersecurity, contracts and sector-specific activities.

Liability Does Not Attach to the AI System Alone

An AI system operates through a chain of technological, contractual and commercial relationships. The entity that develops an underlying model is not necessarily the entity that supplies the data, integrates the technology into a commercial product or determines how its output will be used. An adverse outcome generated by an AI system therefore does not establish liability on the part of the model developer.

Liability depends on the role assumed by each participant, the obligations governing that role and the connection between the relevant conduct and the resulting harm. A developer's exposure could arise from defects in the design or functionality of a system. A data provider or an integrator could also bear responsibility where the technology is improperly incorporated. The deploying organisation remains responsible for the manner in which it uses the technology and the decisions it makes from its outputs.

Section 37 of the Nigeria Data Protection Act 2023 addresses decisions based solely on automated processing of personal data where those decisions produce legal or similarly significant effects. Subject to the statutory exceptions, the framework provides safeguards including human intervention, an opportunity for the data subject to express their views and the right to contest the decision.

Data, Intellectual Property and Contractual Risk

The legal risks associated with AI frequently originate before the system produces an output. An AI system is dependent on data, software, models and other technological components, each of which can carry separate ownership, licensing and compliance implications.

Data that is inaccurate, unlawfully obtained, improperly licensed or unsuitable for the intended purpose can introduce legal exposure into the AI lifecycle. The same applies where personal data is processed without an appropriate legal basis. Deploying AI, establishing the source, permitted use and provenance of relevant datasets is therefore part of the legal architecture of the technology.

Intellectual property presents a similar issue. An AI solution can incorporate proprietary software, third-party models, licensed content and other protected materials. Ownership of the underlying technology and the right to use each component therefore require separate consideration. This is particularly relevant in transactions involving the development, acquisition, licensing or commercialisation of AI technology. Nigeria's current AI policy framework expressly identifies IP management, licensing and technology commercialisation as areas relevant to the development of the AI ecosystem.

AI agreements therefore require careful treatment of representations and warranties relating to system performance, data provenance, intellectual property ownership, security, regulatory compliance and permitted use. Indemnities, liability limitations, insurance obligations, audit rights and provisions addressing third-party claims can also determine the parties' respective exposure when an AI system causes loss.

Regulatory Exposure and Establishing Responsibility

The deployment of an AI system can engage different legal and regulatory obligations depending on the nature of the business, the data processed and the consequences of the technology's use. Data protection obligations arise where personal data is processed. Intellectual property rights become relevant where protected software, datasets or content are incorporated into an AI system. Consumer protection considerations arise where AI-generated information influences representations or services provided to customers. Financial services, healthcare and other regulated sectors introduce additional regulatory considerations because the underlying activity remains subject to sector-specific requirements notwithstanding the use of AI.

The National AI Strategy recognises this broader regulatory dimension by identifying the need for comprehensive AI governance, ethical standards and risk-management mechanisms for AI development and deployment.

A further difficulty arises in establishing causation. An adverse outcome does not necessarily establish that an AI system was defective. The result could have originated from inaccurate input data, an inappropriate configuration, an integration failure, misuse of the technology or a human decision taken after receiving the AI-generated output. Determining responsibility therefore requires an examination of the entire AI lifecycle. Relevant considerations include who designed or supplied the system, who provided the data, who determined the parameters for its use, who controlled deployment, who made the consequential decision and what contractual obligations governed each stage.

This also creates an evidentiary dimension to AI governance. Records concerning system configuration, data sources, instructions, outputs, human review and consequential decisions can become critical where a dispute arises. A business that cannot demonstrate how an AI system was deployed or how its output informed a decision will face greater difficulty establishing the basis on which responsibility was allocated.

Conclusion

Artificial intelligence does not create a separate category of legal responsibility detached from existing principles of liability. When an AI system fails, the legal analysis remains concerned with familiar questions of contractual responsibility, statutory obligations, causation, intellectual property, data protection and regulatory compliance, although the technological architecture can make those questions more complex.

For businesses adopting AI, the critical legal consideration is therefore not simply whether the technology performs as intended. It is whether responsibility has been properly allocated across the AI lifecycle, whether the underlying data and intellectual property are legally controlled, whether contractual protections reflect the distribution of risk and whether appropriate governance mechanisms exist for consequential uses of the technology.