Who is liable when AI gets it wrong?

EU takes first step towards legal regulationArtificial intelligence has long ceased to be merely a promise of technological progress. It has already become embedded in the core of economic activity, influencing the way decisions are made in banks, businesses, insurance organisations, and professional services. From creditworthiness assessments to recruitment procedures and automated customer service, algorithms now operate as “invisible employees”, shaping serious financial decisions without direct human involvement. The essential question, however, is not technological. It is profoundly legal and institutional. Who bears responsibility when an artificial intelligence system produces erroneous outcomes or causes financial harm? The regulatory gap in the face of technological speed The rapid evolution of artificial intelligence has exposed a structural weakness in modern law, the inability of regulatory intervention to keep pace with technological innovation. The adoption of AI systems by the market is advancing far more quickly than the development of clear rules on accountability and oversight. The result is a complex field of uncertainty. When, for example, an AI system wrongly rejects a financing application or inaccurately evaluates a customer’s creditworthiness, assigning liability is far from straightforward. Questions inevitably arise, is responsibility borne by the system provider, the organisation using the system, or the design of the algorithm itself? The difficulty is compounded by the so-called “algorithmic opacity problem”. In many cases, even the creators of these systems cannot fully explain how a specific decision was reached, particularly in large-scale machine learning models. The first coherent framework for AI In response to this institutional lag, the European Union adopted Regulation (EU) 2024/1689 on artificial intelligence (the Artificial Intelligence Act), the first comprehensive regulatory framework of its kind worldwide. The regulation introduces a significant shift, from fragmented regulation of individual technologies to a risk-based approach. AI systems are classified according to their level of risk, with particular emphasis on “high-risk” applications, including those used in financial services, employment, education, healthcare and public administration. For these categories, strict compliance obligations are imposed, including human oversight, technical documentation and transparency requirements. At the same time, the regulation prohibits practices considered incompatible with the EU’s fundamental principles. This approach reflects the EU’s intention to establish a framework of trust, where technological development does not undermine legal certainty or the protection of fundamental rights. Artificial intelligence as a source of corporate risk For the business world, artificial intelligence is no longer a neutral productivity tool. It has become an integral part of risk management and corporate governance. The use of AI systems entails multiple layers of risk, regulatory compliance, personal data protection, intellectual property, cybersecurity and potential compensation claims. A flawed automated decision may lead not only to financial loss, but also to significant reputational damage and loss of trust. Particularly in the financial sector, where decisions are subject to strict regulatory standards, the integration of AI creates a pressing need for enhanced control mechanisms and documented accountability. The responsibility of management bodies no longer ends with the selection of technological solutions; it extends to ensuring the legality and transparency of their operation. The Cypriot dimension and the challenge of adaptation For the Cypriot economy, which has developed strong activity in the fields of financial and professional services, the new European framework carries particular importance. Compliance with the AI Act is not merely a legal obligation; it is a strategic matter of competitiveness. Businesses are now required to reassess their internal procedures and incorporate the legal dimension of artificial intelligence into their operational planning. Legal history has repeatedly shown that every technological revolution precedes the regulatory maturity needed to govern it. Artificial intelligence is no exception. Regulation (EU) 2024/1689 constitutes a necessary first step toward establishing a coherent framework of accountability and trust. It does not eliminate uncertainty, but it lays the foundations for managing it in an institutionally structured manner. The real challenge of the coming years is not whether artificial intelligence will penetrate deeper into the economy – that has already happened. The true test will be whether legal and institutional systems can ensure that the “invisible employee” operates with transparency, accountability and respect for the rule of law.