If AI Developers Create the Risk, They Should Bear the Responsibility

The American people are crying out for sensible regulation of the rapid pace of artificial intelligence development. Partisanship has made it difficult for Congress to act. That leaves the states to advance common-sense policies that address what has the potential to become a catastrophic threat.

We, a law professor and a state legislator, believe holding AI developers liable for misconduct committed by the technology they create is a critical first step.

The hack of Hugging Face by AI agents associated with OpenAI in July was a warning shot. Seemingly autonomous AI systems, communicating with one another to pursue a common objective, broke free from their “sandbox” and hacked another company.

In September, a researcher at Anthropic resigned because of concerns that, in the race to build this technology, AI companies were “gambling with our lives.” It does not take much imagination to envision increasingly serious harms as the technology evolves in the months and years ahead.

That is, unless AI companies are given reason to proceed more carefully. The leaders of these companies say they want to slow down but feel competitive pressure to move faster. Whether we believe them or not, market forces alone are not always enough to keep the public safe.

Nor are traditional regulatory approaches likely to be effective. Banning specific products or behaviors is difficult given the lack of consensus about where AI is headed. Requiring government approval before new products are launched would require a regulatory body with sufficient expertise, and building that capacity will take time.

Several AI leaders have suggested voluntarily allowing third parties to work within their companies to provide oversight. While that represents a step in the right direction, overseers selected by frontier AI developers face an inevitable conflict of interest and lack the authority to impose meaningful consequences for reckless behavior.

Liability for AI developers is a more practical and actionable solution. AI companies will respond to financial incentives that match the risks they impose on society.

If they face the real possibility of civil liability that threatens their bottom line, developers will take stronger measures to ensure their products do not hack other companies or otherwise harm the public.

Developers possess the technical expertise needed to address these risks, and they will do so if given the proper incentives. Imposing liability on AI developers is a form of self-regulation because companies would be forced to internalize the risks they create. Just as importantly, those incentives would apply across the industry rather than relying on the goodwill of individual companies.

One of us, New Jersey Assemblyman Andrew Macurdy, has introduced A5090, a bill that would allow the state attorney general to seek significant penalties, as well as compensatory and punitive damages, whenever an AI developer’s system, product or agent engages in criminal conduct.

The principle is simple: If you create it, you should be accountable for the harmful consequences. The other of us, Professor Gabriel Weil, has helped design legislation introduced in New York and Rhode Island that would ensure someone can be held liable whenever an AI system engages in conduct that would be criminal or tortious if committed by a human.

If neither the user nor any intermediary that modified, fine-tuned or deployed the model intended the conduct or acted negligently, then the developer should bear responsibility regardless of the degree of care it exercised.

Most people want to protect the future for coming generations. Artificial intelligence carries enormous promise, and we should work to ensure humanity benefits from it. But we must also act now to reduce its risks.

Whether we respond appropriately, or allow the dysfunction that characterizes so much of modern government to prevail, will help determine the world our children and grandchildren inherit. State governments have an important role to play in protecting the public from these emerging risks.

Let’s put reasonable guardrails in place and harness technological innovation for good. AI companies stand to gain enormously from these technologies and should bear responsibility for the gravest risks they create. The time to act is now.