Rise of AI spotlights need for digital-age liability regimes in Spain and European Union

The development and growth that artificial intelligence (AI) has experienced in recent years highlights the enormous potential of this technology and its numerous advantages for society in general. However, this technological transformation leads to new scenarios for which European Union law does not yet have an answer. 

This creates legal uncertainty, especially in the cross-border market and encourages regulatory divergences in the different Member States. The European legislator faces the challenge of achieving a regulation on the liability of AI products and services that makes it possible to exploit their full potential while guaranteeing the respect for consumer rights and, in particular, the right of remedy for damages caused by this technology. 

The Spanish courts

Currently, Spain does not have a specific regulation governing the liability regime for AI products and services, leading to situations in which the Spanish courts are forced to modulate the general rules of civil liability for defective products. 

In the field of consumer rights protection, the civil liability regime for defective products is regulated in articles 135 and following of the Spanish General Law for the Defence of Consumers and Users, establishing that the producer or manufacturer of the products is liable for the repair of the damages caused by them and applying, for contractual relations between professionals, the rules of contractual civil liability (regulated in articles 1.101 and following of the Spanish Civil Code) and non-contractual civil liability (regulated in articles 1.902 and following of the Spanish Civil Code).

According to the provisions of these regulations, the injured party may request compensation for the personal or material damages caused as long as it can prove the defect, the damage and the causal relationship between these two. However, the autonomy, complexity and opacity of AI technology makes it practically impossible for the injured party to assume the burden of proof, thus producing a certain lack of defence and a reduction of the constitutional right to effective judicial protection. 

EU's twin AI response

In response to this evident need to define a common civil liability regime for products of the digital age (including AI systems) in the European Union, on 28 September the European Commission presented two legislative proposals whose objective is -in line with the provisions of the White Paper on AI, which outlines the opportunities that this technology offers, and the proposed 2021 AI Law to adapt civil liability rules to the existing digital context.

The proposed revision of the Product Liability Directive (Directive 85/374/EEC) introduces, among others, the following new aspects:

• The concept of "product" is broadened to include software, AI systems or digital services necessary for a product to function (for example, a navigation service in an autonomous vehicle) and digital manufacturing files, therefore suppliers of these systems or computer programs can be held liable.
• In cases of technical or scientific complexity, the burden of proof of the affected party may be lightened by requiring the producers to provide in court technical information on the products.
• Liability is established for those who make modifications to products already on the market and reintroduce them in the market, even if these changes are the result of software updates or machine learning.
• Other third parties such as importers, authorised representatives, distributors or remote order processing service providers may be held liable for products manufactured outside the EU.

The proposal for a directive on non-contractual civil liability in the area of AI focuses on covering damages resulting from unlawful behaviour, such as security breaches or damage caused by security problems, includes the following aspects:

• Disclosure of evidence. In cases in which the claimant so requests, the court may order the manufacturer to disclose evidence related to the damage caused by high-risk AI systems (such as, for example, software for the classification of resumes for recruitment procedures or for checking the authenticity of travel documents) provided that the claimant proves that proportionate efforts have been made to obtain the information, and the evidence is strictly necessary to prove the damage. The disclosure shall be made by adopting specific measures to ensure the confidentiality of trade secrets during and after the proceedings.
• Presumption of causality. In the event that the victim proves that the defendant is guilty and it is reasonably likely that there is a causal link between the damage caused and the breach of the AI system, the court may presume "iuris tantum" that this breach is what caused the damage. This presumption is subject to a number of conditions set out in the rule. This measure simplifies the legal process for victims to prove the causal link between the damage caused and the breach of the AI system.

Osborne Clarke comment

In an economic and social context in which technology and legislation do not evolve at the same pace, imbalances arise that discourage investment in new and innovative products that incorporate AI. This highlights the lack of legal harmonisation in terms of civil liability as one of the main stumbling blocks for manufacturers and sellers of AI systems in the EU.

While awaiting the response that these two ambitious proposals for directives will have on the Single Market, for the time being, the Spanish justice system will have to adapt the traditional rules of civil liability to these new technologies in order to achieve a balance between the interests of entrepreneurs and users.