AI Accountability: Laws, Enforcement, and Liability

AI accountability is the framework of laws, standards, and internal controls that determines who must answer — and who pays — when an artificial intelligence system causes harm or makes a consequential decision about someone. In practice, responsibility can fall on the company that built the model, the company that fine-tuned it, the business that deployed it, or the human operator who was supervising when something went wrong. No single law in the United States assigns that responsibility cleanly. The European Union has the most comprehensive regime in force; US federal agencies are enforcing existing consumer, employment, and civil rights laws against AI misuse; and states are filling gaps with their own rules while the federal government pushes back.

Researchers describe accountability as a relationship of answerability: an entity that builds, deploys, or operates an AI system owes an explanation to some authority — a regulator, a court, an affected person, or the public — and faces consequences if that explanation falls short.¹ The U.S. Government Accountability Office organizes the concept around four practical pillars: governance, data quality and security, performance monitoring, and ongoing oversight throughout a system’s lifecycle.² The OECD’s AI Principles put it more directly: “AI actors should be accountable for the proper functioning of AI systems and for the respect of the above principles, based on their roles, the context, and consistent with the state of the art.”³

Why Assigning Blame Is So Hard

A single AI product often passes through many hands before it touches a consumer. A hiring tool might rely on a foundation model trained by one company, fine-tuned by a second, integrated by a third, and deployed by a fourth. Each contributes decisions about data, design, and risk tolerance. Scholars call this the “many hands” problem: when responsibility is spread across that many actors, pinpointing who caused a specific harm becomes genuinely difficult.¹

Technical opacity compounds the problem. Many modern AI systems, particularly deep learning models, function as “black boxes” whose internal reasoning is opaque even to their creators. One AI ethics researcher described this as a “bulletproof accountability shield”: developers or deployers can deflect blame by pointing to an algorithmic process that no one can fully trace.⁴

The 2018 Uber autonomous vehicle crash in Tempe, Arizona illustrated how this plays out. The system’s neural network cycled between categorizing pedestrian Elaine Herzberg as a “motor vehicle” and an “other,” failing to stop in time.⁴⁵⁶

Researchers call this pattern the “moral crumple zone”: when an automated system fails, the last human in the loop absorbs the blame even when the failure was systemic or algorithmic, serving as the structural element that crumples on impact so more powerful institutional actors do not.⁷

People harmed by AI-mediated decisions also face steep informational barriers. They may not know an AI system was involved at all. They may lack access to the underlying data or code. And they may find the responsible entity claims existing laws simply do not apply to it. The NTIA’s 2024 report noted real uncertainty about how to assign legal responsibility across an AI value chain that can include “researchers, auditors, investors, creators, manufacturers, distributors, developers, and deployers.”⁸

Where Transparency and Explainability Fit

The three terms often appear together but describe different things. Transparency means disclosing that an AI system is in use, along with meaningful information about how it was developed, trained, and deployed. Explainability goes further: it requires that someone affected by an AI decision can understand the factors and logic behind that specific result. Accountability sits above both. It is the ability to challenge the outcome and hold the responsible parties to account.³

Without transparency, affected people may not even know AI played a role. Without explainability, they cannot meaningfully contest the result. Without accountability, neither one leads anywhere. Researchers at Harvard’s Berkman Klein Center have emphasized that “technical solutions alone aren’t enough” and that legal and institutional structures must support the ability to hold autonomous systems accountable for their decisions.⁹ A real tension exists between full explainability and system performance, since some highly effective models are inherently opaque. Governance frameworks generally address this by calibrating explainability requirements to the risk level of the application.

How the European Union Regulates AI

The EU AI Act (Regulation (EU) 2024/1689) is the most comprehensive AI accountability law enacted anywhere in the world. It entered into force on August 1, 2024, with obligations phasing in through 2027.¹⁰

The Act sorts AI systems by risk. Eight categories of AI practice are deemed to pose unacceptable risk and are flatly prohibited, including social scoring, exploiting vulnerabilities, untargeted scraping for facial recognition databases, and most uses of real-time biometric identification by law enforcement in public spaces. These prohibitions became effective on February 2, 2025.¹⁰

Systems classified as “high-risk” — used in critical infrastructure, education scoring, employment decisions, migration, and the administration of justice — must meet extensive requirements before market entry. Providers must implement risk management systems, ensure high-quality training data to reduce discriminatory outcomes, maintain detailed technical documentation, log system activity for traceability, provide clear information to deployers, build in human oversight, and meet standards for robustness, cybersecurity, and accuracy.¹⁰¹¹

General-purpose AI model providers face separate transparency and copyright-compliance duties, with heavier requirements for models posing systemic risk, defined as those exceeding 10²⁵ floating-point operations of training compute. Those providers must perform model evaluations, conduct adversarial testing, mitigate systemic risks, and report serious incidents to the EU’s AI Office.¹¹

Article 50, enforceable from August 2, 2026, adds public-facing disclosure duties. Chatbot providers must inform users they are interacting with AI. Generative AI providers must ensure synthetic content is marked in machine-readable format. Deployers of deepfakes must disclose that content has been artificially generated or manipulated.¹² Enforcement is shared between the European AI Office (for general-purpose AI) and national market surveillance authorities in each member state.

How the United States Regulates AI

The US has no comprehensive federal AI law. Instead, it relies on a patchwork of executive actions, existing agency enforcement authority, and proposed legislation.

The NTIA Accountability Framework

In March 2024, the National Telecommunications and Information Administration published its AI Accountability Policy Report, informed by more than 1,400 stakeholder comments. The report proposed an “accountability chain” linking three elements: information flow (documentation and disclosures), independent evaluations (audits and red-teaming), and consequences (liability and regulation).¹³ Its eight recommendations covered federal guidelines on AI audit design and auditor certification, standardized transparency requirements such as model cards and “AI nutrition labels,” clarified liability rules across the value chain, mandatory independent audits for high-risk models, and federal registries of high-risk deployments and adverse incidents.¹⁴

The 2025 Executive Order and the Preemption Fight

On December 11, 2025, President Trump signed an executive order titled “Ensuring a National Policy Framework for Artificial Intelligence,” establishing a federal policy of “minimally burdensome” AI regulation. The order directed the Attorney General to create an AI Litigation Task Force to challenge state AI laws on interstate commerce or preemption grounds, directed the Secretary of Commerce to publish an evaluation of “onerous” state AI laws within 90 days, and directed the FTC and FCC to issue policy statements and initiate proceedings that could establish federal standards preempting state requirements. The order specifically cited Colorado’s AI accountability law as an example of potentially excessive state regulation and proposed that states with “onerous” AI laws could be made ineligible for certain Broadband Equity Access and Deployment Program funds.¹⁵

The order is not self-executing. Congress has rejected at least two attempts to pass state AI preemption provisions, and legal analysts have noted that without an existing federal regulatory framework in place, the administration’s preemption strategy faces significant legal obstacles.¹⁶ State AI laws remain enforceable until courts rule otherwise.

Federal Legislation

Over 150 AI-related bills were introduced in the 118th Congress, and none produced a comprehensive federal accountability law.¹⁷ In the 119th Congress, Representatives Josh Harder and Robin Kelly introduced the AI Accountability Act (H.R. 1694) in February 2025, which would direct the Department of Commerce to study accountability measures and submit recommendations within 18 months. The bill was referred to the House Committee on Energy and Commerce and has not advanced.¹⁸

State Laws That Actually Bind Companies

With Congress gridlocked, states have become the primary source of binding AI rules. As of mid-2025, 47 states had introduced AI-related legislation, with 260 measures introduced in 2025 alone and 22 passed.¹⁹

Colorado

Colorado’s law has been rewritten mid-stream. In 2024, Governor Jared Polis signed SB24-205, which established a “high-risk” AI system regime with a duty of care against algorithmic discrimination, consumer rights to explanations of AI-driven decisions, and transparency and monitoring obligations for developers and deployers.¹⁹ Implementation was pushed from February 1, 2026 to June 30, 2026 amid concerns about compliance costs.²⁰

The original law was then effectively repealed and replaced by Senate Bill 26-189, signed on May 14, 2026. The revised law drops the “high-risk artificial intelligence system” terminology and the specific duty-of-care and algorithmic-discrimination framework, and instead regulates “automated decision-making technology” used in “consequential decisions.” It keeps notice, disclosure, and human review requirements but leaves detailed disclosure rules to be finalized by the Colorado Attorney General. The new law is scheduled to take effect on January 1, 2027. Enforcement rests solely with the Attorney General, and there is no private right of action.²¹

New York City Local Law 144

New York City’s Local Law 144 took effect in July 2023 and requires employers using automated employment decision tools to commission annual independent bias audits, publish the results, and notify candidates at least ten business days before the tool is used.²² Civil penalties reach up to $1,500 per violation per day.

A December 2025 audit by the New York State Comptroller found enforcement by the NYC Department of Consumer and Worker Protection “ineffective.” Over the two-year audit period from July 2023 through June 2025, DCWP received only two complaints and failed to verify whether its complaint-intake process was working. DCWP’s review of 32 companies identified one instance of non-compliance; the Comptroller’s office found at least 17 potential instances of non-compliance in the same group. DCWP had not used its formal enforcement tools or consulted the city’s Office of Technology and Innovation on technical questions.²³

Other States

Montana enacted a law requiring critical infrastructure controlled by AI to have a risk management policy incorporating standards such as the NIST AI Risk Management Framework, and separately signed a law limiting government use of AI and requiring disclosure and human review for certain decisions.¹⁹ New York state requires state agencies to publish details of automated decision-making tools in a public inventory.²⁴ California, after its governor vetoed a comprehensive AI governance framework, pivoted to sector-specific laws covering election deepfake disclosures, AI-generated content warnings, and protections for performers’ digital replicas. Georgia, Illinois, Iowa, and Maryland introduced legislation modeled on Colorado’s original act, though as of mid-2025 those bills had either died in committee or remained pending.

Federal Enforcement Actions Already Happening

Even without a comprehensive AI statute, federal agencies are using existing authorities. Agencies including the FTC, DOJ Civil Rights Division, EEOC, and CFPB have issued a joint statement asserting that existing legal authorities “apply to the use of automated systems and innovative new technologies just as they apply to other practices.”⁸

Federal Trade Commission

The FTC has been the most active federal enforcer on AI. In September 2024 it launched “Operation AI Comply,” a sweep against deceptive AI-related business practices. Actions included a $193,000 settlement with DoNotPay over claims its chatbot could substitute for human lawyers, multiple “AI-powered storefront” schemes the FTC alleged collectively defrauded consumers of tens of millions of dollars, and an action against Rytr for enabling mass generation of fake consumer reviews.²⁵

Separately, the FTC banned Rite Aid from using AI facial recognition for five years after the system wrongly accused individuals of shoplifting, finalized an order against Evolv Technologies for false claims about its AI-powered security screening, and took action against NGL Labs for marketing an AI-moderated anonymous messaging app to children. In September 2025 the agency issued formal orders to seven companies providing consumer-facing AI chatbots, seeking information about advertising, safety, and data handling.²⁶ On rulemaking, the FTC finalized a rule banning fake reviews and testimonials (including AI-generated ones), proposed a rule prohibiting impersonation of individuals via AI deepfakes, and strengthened children’s privacy protections to limit use of kids’ data for AI model training.²⁷

In December 2025 the FTC reopened and set aside its earlier consent order against Rytr, stating that the order “unduly burdened innovation in the nascent AI industry.”²⁸

Equal Employment Opportunity Commission

The EEOC has made AI-driven hiring discrimination a formal enforcement priority in its Strategic Enforcement Plan for Fiscal Years 2024–2028, targeting automated recruitment, selection, and screening tools that intentionally exclude or disproportionately affect protected groups.²⁹ Its landmark case involved iTutorGroup, whose application software was allegedly programmed to automatically reject female applicants over 55 and male applicants over 60. The company settled in August 2023 for $365,000, covering over 200 affected applicants, along with extensive compliance and monitoring requirements.³⁰

The EEOC has also intervened as amicus curiae in Mobley v. Workday, Inc., arguing that AI tool developers themselves can be held liable under federal anti-discrimination laws as employment agencies, indirect employers, or agents of the hiring company.³¹ That position, if it prevails, expands liability beyond the employer to the vendor.

State Attorneys General

The Texas Attorney General has opened investigations into Meta and Character.AI over allegations that their chatbots provided misleading mental health services to children. In August 2025, a bipartisan coalition of state attorneys general issued a joint warning to AI developers that they would be held accountable for harms to consumers, particularly children, stemming from data use.²⁸

Voluntary Standards Companies Are Using

NIST AI Risk Management Framework

The National Institute of Standards and Technology published its voluntary AI Risk Management Framework organized around four functions: Govern (accountability structures, roles, culture), Map (identifying purposes and risks), Measure (assessing and tracking risks with valid metrics), and Manage (prioritizing and acting on risks, including documentation of residual risks after treatment).³² NIST also released a specialized Generative AI Profile in July 2024.³³ The framework warns that if a system presents unacceptable risk levels, such as imminent severe harm, development and deployment should cease until those risks can be managed.

ISO/IEC 42001

Published in December 2023, ISO/IEC 42001 is the first internationally certifiable AI management system standard. It requires organizations to implement a continuous improvement cycle covering organizational context, leadership, risk and impact assessments, operations, performance evaluation, and improvement, along with 38 specific Annex A controls spanning bias mitigation, transparency, accountability, and data governance.³⁴ ISO 42001 has not been listed as a harmonized European standard, so it currently serves as helpful preparation for EU AI Act compliance rather than a direct legal substitute.³⁵

Algorithmic Impact Assessments

An algorithmic impact assessment is a structured evaluation of an automated decision system’s benefits, costs, risks, and limitations, typically done before deployment and updated periodically. Canada’s federal government operates one of the most developed AIA systems: a mandatory questionnaire of 65 risk questions and 41 mitigation questions that generates an impact score classifying the system into one of four levels, each with escalating oversight requirements. Departments must complete the assessment during design and again before production, and must publish the results on the government’s Open Government Portal.³⁶ In the US, no comparable federal mandate exists for the private sector, though California has pending legislation that would require deployers of covered automated decision systems to submit to third-party audits.²⁴ The EU AI Act’s conformity assessments serve a similar function for high-risk systems.³⁷

The International Layer

The OECD AI Principles, first adopted in 2019 and updated in 2024, remain the most widely referenced intergovernmental standard, with over 70 jurisdictions reporting more than 1,000 aligned policy initiatives.³⁸ In February 2025, the OECD launched a global framework for companies to report on safe, secure, and trustworthy AI practices, designed to monitor the G7’s Hiroshima Process International Code of Conduct. Thirteen major AI companies, including Amazon, Anthropic, Google, Microsoft, and OpenAI, pledged to complete the inaugural reporting framework.³⁹

On August 26, 2025, the UN General Assembly adopted Resolution A/RES/79/325 by consensus, establishing an Independent International Scientific Panel on AI (40 experts serving three-year terms) and a Global Dialogue on AI Governance. The first session of the Global Dialogue is scheduled for July 2026 in Geneva.⁴⁰ The resolution lists “transparency, accountability and robust human oversight” as a core thematic area but is non-binding.⁴¹

China has taken a sector-by-sector approach, issuing separate rules for algorithm recommendations (effective March 2022), deep synthesis or “deepfake” content (effective January 2023), and generative AI services (effective August 2023). Providers of generative AI services with “public opinion attributes or social mobilization capabilities” must complete security assessments and formal filing with the Cyberspace Administration of China before launch, and providers are held liable for AI-generated outputs that cause harm.⁴²

Corporate Governance and Insurance

Companies are building internal accountability structures ahead of the law in some cases and behind it in others. According to an IBM survey, 80% of C-suite executives report having a dedicated risk function for AI, and 47% of organizations have established generative AI ethics councils. Spending on AI ethics grew from 2.9% of total AI spending in 2022 to 4.6% in 2024. Only 29% of organizations, however, report having comprehensive AI governance plans in place.⁴³

Insurance is beginning to function as a parallel accountability mechanism. Specialized AI insurance products have emerged from Munich Re (whose aiSure program launched in 2018), Armilla AI (which sets premiums based on evaluation of training data, model creation, and testing performance), Vouch (covering AI errors and omissions, bias, IP infringement, and regulatory investigations), and Relm Insurance (which announced a suite of AI-specific policies in January 2025). Deloitte projects $4.7 billion in annual global AI insurance premiums by 2032.⁴⁴ Insurers are increasingly evaluating the existence of AI usage policies, data handling controls, employee training, and human-in-the-loop requirements when pricing risk.⁴⁵

The Open Liability Question

Whether existing law is sufficient to hold AI actors liable is still unresolved. AI systems are not legal persons and cannot be held directly liable. In negligence claims, plaintiffs must prove foreseeability and causation, and when the decision-making process is opaque, proprietary, and distributed across multiple corporate actors, meeting that burden is exceptionally hard.⁷

The European Commission had proposed an AI Liability Directive that would have introduced a rebuttable presumption of causality to ease that burden on plaintiffs. It withdrew the proposal in early 2025, leaving a gap in EU legislative guidance on liability.⁴⁶ Some stakeholders have proposed regulatory sandboxes, which are controlled environments where companies can test high-risk AI without immediate full regulatory exposure, and safe harbors for researchers conducting good-faith evaluations.⁸ Others have proposed no-fault insurance schemes or industry-financed compensation funds, though critics worry these could reduce incentives for safety. Whether liability should be strict or fault-based, and how to distribute responsibility across the value chain according to each actor’s ability to identify and mitigate risk, remains open.

Until those questions are settled, accountability for AI in the United States runs through the existing tools: consumer protection law used by the FTC, anti-discrimination law used by the EEOC and state agencies, state consumer statutes enforced by attorneys general, and contractual and insurance arrangements that shift risk between vendors and deployers. In the EU, the AI Act adds a direct regulatory layer with specific documentation, testing, and disclosure duties. For companies operating across both, meeting the stricter regime is typically the practical path.

1
Springer. Accountability in Artificial Intelligence
2
U.S. Government Accountability Office. Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities
3
OECD. OECD AI Principles – Transparency and Explainability
4
University of Texas Ethics Unwrapped. AI Accountability: Who’s at the Wheel
5
BBC. Uber’s Self-Driving Operator Charged Over Fatal Crash
6
Chief Healthcare Executive. Who Is Responsible When AI Fails
7
Centre for International Governance Innovation. AI and the Accountability Gap
8
NTIA. AI Accountability Policy Report – Liability Rules and Standards
9
Harvard Berkman Klein Center. AI: Transparency and Explainability
10
European Commission. Regulatory Framework for AI
11
Artificial Intelligence Act EU. High-Level Summary of the AI Act
12
Artificial Intelligence Act EU. Transparency Rules – Article 50
13
NTIA. NTIA Calls for Audits and Investments in Trustworthy AI Systems
14
NTIA. AI Accountability Policy Report
15
White House. Ensuring a National Policy Framework for Artificial Intelligence
16
Ropes & Gray. Examining the Landscape and Limitations of the Federal Push to Override State AI Regulation
17
Brennan Center for Justice. Artificial Intelligence Legislation Tracker
18
U.S. Congress. H.R.1694 – AI Accountability Act
19
Brookings Institution. How Different States Are Approaching AI
20
Akin Gump. Colorado Postpones Implementation of Colorado AI Act SB 24-205
21
Norton Rose Fulbright. Colorado Enacts Revised AI Law
22
Littler Mendelson. New York City Adopts Final Regulations on Use of AI in Hiring and Promotion
23
New York State Comptroller. Enforcement of Local Law 144 – Automated Employment Decision Tools
24
National Conference of State Legislatures. Artificial Intelligence 2025 Legislation
25
Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes
26
Federal Trade Commission. Artificial Intelligence
27
Federal Trade Commission. AI Accomplishments
28
WilmerHale. Year in Review: 2025 Artificial Intelligence Privacy Litigation Trends
29
EEOC. Strategic Enforcement Plan for Fiscal Years 2024-2028
30
Arnold & Porter. EEOC Brings First-of-Its-Kind Enforcement Action Against Employer Using Artificial Intelligence
31
Workforce Bulletin. AI Resume Screening Tool Developer Is Subject to Federal Anti-Discrimination Laws, Says EEOC
32
NIST. AI Risk Management Framework
33
NIST. AI Risk Management Framework
34
NSF International. ISO/IEC 42001 Artificial Intelligence Management System
35
ENZ.AI. ISO 42001 Practical Implementation Guide
36
Government of Canada. Algorithmic Impact Assessment
37
Bipartisan Policy Center. Impact Assessments for AI
38
OECD. OECD AI Principles
39
OECD. OECD Launches Global Framework to Monitor Application of G7 Hiroshima AI Code of Conduct
40
Tech Policy Press. UN Reaches Consensus on AI: Now Comes the Hard Part
41
United Nations. Global Dialogue on AI Governance
42
International Bar Association. China: Regulation of Artificial Intelligence – Progress and Challenges
43
IBM. AI Governance Report
44
American Bar Association. Evolving Landscape of AI Insurance: Empirical Insights, Risks, and Policy Gaps
45
IAPP. How AI Liability Risks are Challenging the Insurance Landscape
46
Eversheds Sutherland. Who’s Liable: Legal Accountability in the Age of AI