Who Is Liable for AI-Generated Code? What Changes in 2026

For errors in AI-generated code, liability does not fall on the AI but on whoever places the software on the market. This basic rule has not changed: what has become stricter is the framework around it. Under Directive (EU) 2024/2853, software and AI systems will explicitly count as products under product liability law from December 2026, complete with easier evidentiary rules for injured parties.

Who Is Liable When AI-Generated Code Causes Damage?

Whoever supplies or operates the software, and usually not the tool provider. AI providers' terms of use typically assign responsibility for the generated code to the user; the resulting code is treated as your own work, with all the consequences that entails.

In practice, this means: the fact that a model wrote the code does not exempt anyone from liability. On the contrary, it raises an additional question that needs answering as soon as the issue of how carefully it was reviewed comes up.

What Changes with the New EU Product Liability Directive?

Three things, and all three point in the same direction. Directive (EU) 2024/2853 entered into force on December 9, 2024; member states had to transpose it by December 9, 2026, and the German legislature passed the reform in 2026.

• Software is a product. Digital products including AI systems are explicitly covered. This settles the earlier debate over whether pure software falls under product liability.
• Easier evidentiary rules and disclosure obligations. Injured parties need to prove less in full; manufacturers can be required to disclose documentation. Anyone who cannot show how something was developed and tested is in a worse position than before.
• Cybersecurity as a defect criterion. A security flaw can constitute a product defect. This directly links code quality to the question of liability.

What Does the Cyber Resilience Act Mean for Development?

It brings deadlines that apply before product liability kicks in. Regulation (EU) 2024/2847 targets manufacturers, importers, and distributors of products with digital elements, hardware as well as software.

• From September 11, 2026: reporting obligations. Actively exploited vulnerabilities must be reported as an early warning to the responsible CSIRT and ENISA within 24 hours, followed by a full report within 72 hours and a final report within 14 days.
• From December 11, 2027: the full set of manufacturer obligations, including CE marking for cybersecurity.

The 24-hour deadline is the point with the greatest practical impact. It assumes that you actually know what is inside your product, dependencies included, and that you are able to act. Both are a matter of development discipline, not the legal department.

How Do I Document Due Diligence in AI-Assisted Development?

With evidence that already accumulates in the development process anyway, not with a separate "Compliance" folder. Five things that are worth something in a dispute:

• A traceable history. Who changed what, when, and for what reason. Version control provides this if commit messages contain more than "fix."
• A review step before release. Evidenced by the pipeline log, not by a policy that merely provides for one.
• An inventory of components. Which third-party packages are included, in which version. This is also a prerequisite for meeting the 24-hour deadline.
• Documented decisions. Why was this approach chosen? For generated code, this information is otherwise completely missing; see Vibe Coding or Agentic Coding.
• Responsiveness. A proven way to ship a fix quickly.

The common denominator: all of this is simply good development practice that happens to also hold up legally. Anyone who only builds it once a lawyer asks is building it too late.

How Do I Regulate Liability with Clients and Service Providers?

Through three points that belong in the contract, and that are often missing as things currently stand.

• Whether AI tools may be used. A ban without any way to verify it is toothless; permission tied to review obligations is enforceable.
• Which reviews are guaranteed. Not "in line with the state of the art," but named review steps whose completion can be demonstrated.
• Who holds the rights to the result. The copyright status of purely machine-generated output is not conclusively settled; a contractual arrangement covering usage rights and exploitation provides the clarity that the law does not currently offer.

Frequently Asked Questions About Liability for AI Code

Is OpenAI or Anthropic Liable for Faulty Code?

Not under the usual terms of use. Responsibility for using the generated code lies with the user. If in doubt, check the terms of the specific service you use, in the version that applies at the time you use it.

Is AI-Generated Code Protected by Copyright?

The question is not conclusively settled. Under the prevailing view in Germany, copyright protection requires a personal intellectual creation, which is problematic for purely machine-generated output. In practice, this means: do not rely on automatic protection, but regulate usage rights by contract.

Do I Have to Tell Clients That AI Was Used?

As things currently stand, there is no general statutory duty to disclose the use of AI in creating software. Something different may be agreed by contract, and the transparency obligations of the EU AI Act concern AI systems that you provide to your own users, not the tool you use to develop with. For building AI competence under Art. 4 of the EU AI Act, see AI certificate.

Does All of This Also Apply to Internal Software?

Product liability is tied to placing a product on the market; purely internal tools must be assessed differently from distributed products. The duty-of-care requirements arising from employment law, data protection, and IT security still apply regardless.

What counts in a dispute is proof that a review took place, not the intention to carry one out. Code Guardian generates this proof as a byproduct: a plan with a decision log before the change, a documented audit afterward.

Sources

• Directive (EU) 2024/2853 on liability for defective products, in force since December 9, 2024, transposition deadline December 9, 2026.
• Regulation (EU) 2024/2847 (Cyber Resilience Act).
• Regulation (EU) 2024/1689 (EU AI Act), Art. 4 and Art. 50.

As of: July 27, 2026. This article is general information and not legal advice. For an assessment of your specific case, for drafting contracts, and for classifying your product under the CRA and product liability rules, you should seek legal counsel.