EUROPEAN COMMISSION Brussels, 28.9.2022 SWD(2022) 319 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a Directive of the European Parliament and of the Council on adapting non-contractual civil liability rules to artificial intelligence {COM(2022) 496 final} - {SEC(2022) 344 final} - {SWD(2022) 318 final} - {SWD(2022) 320 final}



Table of contents 1.Introduction: Political and legal context 2.Problem definition7 2.1.Introduction and overview7 2.2.Problem driver: the specific characteristics of AI make it difficult to meet the burden of proof 2.3.Problem 1: Legal uncertainty leading to internal market obstacles0 2.4.Problem 2: Legal fragmentation leading to internal market obstacles1 2.5.Problem 3: Lack of compensation for victims leading to a lack of societal trust and hampering uptake of AI-enabled products and services2 2.6.The consequences: internal market obstacles and affected stakeholders 2.7.Likely evolution of the problems without Union intervention 3.Why should the EU act?19 3.1.Legal basis19 3.2.Subsidiarity: Necessity and added value of EU action 4.Objectives: What is to be achieved? 4.1.General objectives 4.2.Specific objectives 5.What are the available policy options? 5.1.What is the baseline from which options are assessed? 5.2.Description of the policy options29

5.3.Measures discarded at an early stage 6.What are the impacts of the policy options? 6.1.PO1: Easing the burden of proof for AI-related claims2 6.2. PO2: PO1 + strict liability for AI use-cases with a specific risk-profile, possibly coupled with mandatory insurance ……………………………………………………………………….. 51 6.3.PO3: PO1 + targeted review regarding the strict liability and mandatory insurance elements of PO2 (staged approach)57 7.How do the options compare?59 8.Preferred option60 8.1.Rationale and main impacts of the preferred PO60 8.2.The interplay with the PLD review: consistency and complementarity of the package of measures for the compensation of damage caused by AI61 8.3. The interplay with the PLD review: consistency and complementarity of the package of measures for the compensation of damage caused by AI ………………………………….. 61 8.4. One-In-One-Out …………………………………………………………………………… 62 9.How will actual impacts be monitored and evaluated?62 Annex 1: Procedural information Annex 2: Stakeholder consultation Annex 3: Who is affected and how? 93 ΑΝΝΕΧ 4: Analytical methods and key findings of supporting studies / Explanations on how the European Parliament’s legislative own-initiative resolution on a civil liability regime for AI was taken into account 101 ΑΝΝΕΧ 5: DETAILED EXPLANATIONS ON HOW THE SPECIFIC CHARACTERISTICS OF AI ARE CHALLENGING EXISTING LIABILITY RULES ……………………………………….…..... 120 Annex 6: Detailed description of the legal context and interplay between existing / proposed legal rules and the AI liability initiative Annex 7: Interplay with the AI Act Annex 8: AI-specific fundamental rights concerns – Overall Commission policy approach and the role of the AI liability proposal

Annex 9: The types of compensable (in particular immaterial) harm and the admissibility of contractual exclusions/limitations of liability – Member States’ legal approaches/traditions and reasons for not harmonising these aspects specifically for AI Annex 10: Detailed explanations and results regarding the assessment and comparison of policy options (multi-criteria analysis) Annex 11: The economic impact of adapting civil liability rules to the specific challenges of AI – The example of the European market for vacuum cleaners Annex 12: Monitoring and evaluation Annex 13: Illustration of AI-specific difficulties in claiming compensation based on case scenarios

1.Introduction: Political and legal context 1.1. Introduction and political context AI is a set of enabling technologies with the potential to transform our economy and society to such a profound extent that it is often compared to electricity. As a key driver for future economic development, AI has strategic importance. While AI can bring about economic and societal progress, it can also put at risk European values. In particular, when AI systems cause harm, the victims’ legal interests of life, health and property are at stake. In addition, the right to an effective access to justice can be in doubt because the specific characteristics of certain types of AI can make it prohibitively difficult to prove their claim under existing liability rules. For these reasons, Commission President Ursula von der Leyen announced in her political Guidelines a coordinated European approach on AI. In its White Paper on AI, the Commission undertook to promote the uptake of AI and to address the risks associated with certain of its uses by building an ecosystem of excellence and trust. One of the White Paper political objectives for liability and this impact assessment is that persons having suffered harm caused by AI systems enjoy the same level of protection as persons having suffered harm caused by other technologies. In the Report on AI Liability accompanying the White Paper, the Commission identified the specific challenges posed by AI to existing liability rules. The Commission Work Programme 2020 envisaged a follow-up to the White Paper in the form of new legislative initiatives, including on liability. In its conclusions on shaping Europe’s digital future of 9 June 2020, the Council welcomed the consultation on the policy proposals in the White Paper on AI and called upon the Commission to put forward concrete proposals. On 20 October 2020, the European Parliament (EP) adopted a legislative own-initiative resolution requesting the Commission to adopt a proposal for a civil liability regime for artificial intelligence based on Article 114 TFEU. The Coordinated Plan on AI in the Annex to the Communication ‘Fostering a European approach to Artificial Intelligence’ of 21 April 2021 specifies that the Commission will propose in 2022 measures adapting the liability framework to the challenges of AI. AI systems could also contribute to the accomplishment of a several targets across the Sustainable Development Goals included in the 2030 UN Agenda for Sustainable Development. The use of AI could support environmentally beneficial outcomes for instance by improving prediction as well as optimising operations and resource allocation. Liability-related issues linked to AI are the subject of debate in various EU trading partners. As a consensual regulatory solution has not yet emerged, the EU has the opportunity to influence the global discussion with a practical and constructive approach which has a chance to become a global model. In terms of strategic foresight, the AI liability initiative takes into account the megatrend of Accelerating technological change and hyper-connectivity. This initiative is a crucial part of the EU’s efforts to shape the AI-driven transformation in a human-centric, yet innovation-friendly way. The potential of AI underlines the importance of creating the right conditions for its rollout through legal certainty and consistent rules across the internal market. The ubiquitous and fast evolving nature of AI also means that the risks linked to the deployment of AI systems can potentially affect a very broad range of stakeholders and legal interests. By adapting the traditional liability rules to the challenges of AI, the initiative anticipates the novel difficulties of proof faced by victims of harm, and aims to ensure that societal trust in AI is not diminished due to a lack of compensation in the future. Due to this forward-looking perspective of the AI liability initiative, a strategic foresight approach underlies the problem definition, policy objectives and policy options. 1.2.Scope of the impact assessment: AI systems and their characteristics In order to ensure consistency, it is appropriate to use the same general concept of AI as in the AI Act also as the basis for the present initiative which is complementary to the AI Act. AI-specific issues regarding liability are linked to certain characteristics of AI systems (opacity/lack of transparency and explainability, autonomous behaviour, complexity, continuous adaptation and lack of predictability) which make the application of existing liability rules uncertain or more difficult (see the following section on legal context). AI systems not having such characteristics can be dealt with under the existing liability rules, similarly to other types of software. For example, rule-based algorithms are designed to automatically execute rules encoded by their programmers, following the classical ‘if → then logic’ as other types of software. Such algorithms do not put victims of harm in a fundamentally more difficult situation than other types of software. For example, robotic process automation in a factory setting may rely on such rule-based systems. In contrast, the highly autonomous operation of e.g. mobile robots in more unpredictable environments (such as delivery robots) – often involving interaction with humans – will typically require more complex AI systems, in particular developed through machine learning. Such AI systems are expected to challenge existing liability rules and are therefore concerned by the present initiative. Their operation can potentially affect legally protected interests (for example AI used for recruitment, in autonomous vehicles, delivery robots, or drones). Certain AI-enabled products and services with the potential to cause harm are already in an advanced development stage or even starting to be deployed, such as e.g. certain mobile robots or AI-systems used in the context of recruitment. However, AI systems with the specific characteristics challenging liability rules are mostly not yet on the market, among others because they are not yet approved. Therefore, there are no available judicial cases yet where the problems to be addressed by this initiative have materialised. The objective of this proposal is to create the legal certainty conditions and to promote the societal trust needed for such AI systems to be brought to market in the EU. 1.3.Legal context

Liability rules determine how damage, caused by human activities and goods for which humans are considered liable by law, can be compensated. This initiative concerns ‘extra-contractual’ civil liability rules, i.e. rules providing a compensation claim irrespective of a contractual link between the victim and the liable person. Those rules will be referred to as ‘liability’ in the following. Criminal liability is not concerned. A victim currently relies on national liability rules and in certain cases on the Product Liability Directive (PLD) to claim compensation for damage arising from AI-enabled products and services. Depending on each case, a victim has several avenues available for claiming compensation. Various persons could be held liable in parallel under different conditions and for different reasons. Neither of these rules contains specific provisions for AI. Example: A traffic accident victim may have in parallel a fault-based liability claim against the driver whose fault caused the accident, a ‘PLD’ claim against the producer if the vehicle had a defect, and a strict liability claim against the vehicle’s owner. Firstly, the victim could have a fault-based liability claim based on another person’s wrongful behaviour, i.e. fault. A fault-based claim usually requires proving the existence of: -a damage, -a fault of the liable person, and -causality between that fault and the damage. As a matter of principle, it is the victim that needs to prove these three elements. Such claims apply irrespective of the technology/activity involved in causing harm and can be addressed against any type of wrongdoer (e.g. businesses, including service providers, or private persons) by any type of victim (e.g. business, private individual, public entity). They can compensate any type of harm protected by national law, e.g. physical injury, property damage, damage to or loss of data, economic loss like lost profit, non-economic loss like pain/ suffering or harm caused by discrimination. Secondly, in addition to fault-based claims, victims could rely on liability independent of fault - so-called strict liability, with different scopes and conditions set by national laws. Strict liability rules assign liability for the relevant risk to a person, irrespective of fault. This is usually justified by the fact that this person draws a benefit from exposing the public to that risk. Normally, for that person to be found liable, the victim has only to prove that the risk stemming from the sphere of the liable person materialised. Thirdly, victims may have, under the PLD, a claim against the producer of a defective product for a defect present when the product was put on the market. The victim must prove that the product was defective and the causal link between that defect and the damage. Under the PLD, the victim can claim compensation for personal injury or damage to consumer property. The PLD does not cover damage caused to property intended for professional use, damage caused during the provision of a service, damage to victims other than natural persons or claims based on the wrongful use of a product. In all these cases, victims can only get compensation according to national liability rules. Types of civil liability National fault-based liability National strict liability regimes PLD Scope Any human actions or omissions, including manufacturing, providing services and using products Operating specific technologies (e.g. operation of motor vehicles, aircrafts, nuclear power plants), the production/use of ‘dangerous products/activities’ or more general the use of objects. Producing defective products Liable person Any wrongdoer: e.g. producer, service provider, user (both businesses and private persons), owner, cyber attackers, etc. Owner or operator of technologies within scope Producer (manufacturer, importer) and, in some cases, supplier/seller Type of victim protected Any victim: e.g. private persons, businesses, public entities Any victim: e.g. private persons, businesses, public entities Natural persons Type of damage Any damage, e.g. death, personal injury, damage to property (for private or professional use), pure economic loss, discrimination, non-economic loss like pain and suffering, depending on national law. Varies, e.g. harm to life, health and property. Death, personal injury, damage to consumer property worth more than EUR 500 What victim needs to prove Fault of a person + causal link between fault and damage The risk subject to strict liability materialises (e.g. a motor vehicle is involved in accident) Defect in product (irrespective of fault) Period of liability Varies Varies 10 years after putting product into circulation A holistic approach to liability: Looking at all liability pillars The liability follow-up to the AI White Paper looks holistically at the three avenues to compensation currently available to victims. The purpose is to ensure that the specific challenges of AI do not lead for victims harmed by AI-systems to a lower level of protection, compared to victims harmed by traditional technologies, under all three avenues.

For the purposes of presenting the problems and solutions in the form of impact assessments, a distinction is drawn between, on the one hand, the route to compensation provided by the PLD, and on the other hand, the routes to compensation provided by non-harmonised national fault-based and strict liability rules. It is necessary to cover these complementary pillars of liability in separate, but closely coordinated impact assessments, because: -The PLD and national liability rules provide liability claims based on different grounds, against different liable persons and for different types of victims and damages. This means that different markets and different possible addressees of liability claims have to be considered as regards the PLD and national liability rules. The PLD covers only part of the harm which can be caused by AI-systems. It covers damage done by defective products, while other liability rules compensate also the harm caused for instance by services or any use of products. It covers the producer as liable person, while other liability rules cover the harm done by other actors like operators/users of AI-systems. It covers certain damages, while other liability rules compensate also other harm suffered by victims like economic and non-economic loss. -The PLD evaluation found that it was difficult to apply its rules to digital technologies in general, including AI-enabled products. It found also that the rules made it difficult to prove liability in the case of complex products, including AI-enabled products, but also others such as pharmaceuticals. These problems call for technology-neutral measures. They will provide victims of damage, including that caused by AI-enabled products, a more effective compensation claim against the producer, to ensure the same level of protection as for damage caused by other technologies or types of products. -Digital technologies in general have not been identified as making it difficult to apply national liability rules. It is the specific features of certain types of AI, especially its autonomy and opacity, which challenge the application of national liability rules. This needs to be addressed through targeted, AI-specific measures. -Due to this difference between the problems, different objectives and policy options had to be developed respectively. In light of the AI White Paper objective to ensure that the specific challenges of AI do not lead for victims harmed by AI-systems to a lower level of protection compared to victims harmed by traditional technologies, this is an expression of the holistic Commission approach to examine all three pillars of liability. The PLD review is about adapting it to the digital age, preserving its technology-neutral nature and coverage. It also helps victims of damage caused by AI-enabled products to have a more effective compensation claim against the producer. The AI liability proposal tackles the AI-specific problems regarding other liability rules. Together, they will contribute to guaranteeing the effective functioning of the internal market in AI-enabled products/services and ensure that victims of harm caused by AI have the same level of protection as victims of harm caused by other technologies. 1.4.Related policy initiatives The Commission is aiming to support the roll-out of AI in Europe by developing an ecosystem of trust. In accordance with the White Paper, the Commission proposes a forward-looking comprehensive package of measures to address problems caused by the introduction and use of AI, comprising of three complementary work streams: -a horizontal framework addressing fundamental rights and safety risks specific to AI systems (AI Act); -a revision of sectoral and horizontal product safety rules; -EU rules to address liability issues related to AI systems. Interaction with already adopted proposals: The Commission has already proposed rules in the AI Act reducing risks for safety and fundamental rights. While they will reduce risks, they are not intended to prohibit the placing on the market of AI-systems posing a residual risk to safety and fundamental rights. Harm will therefore still occur. When this happens, the liability rules subject to this impact assessment determine which party is liable for harm and under which conditions a victim can be compensated. The AI Act also provides for definitions and specific documentation/logging requirements for high-risk AI systems. The information from these documents and logs could be useful in liability claims but the AI Act does not foresee a right of victims to access that information. The Commission has also put forward updates of general and sectoral product safety rules applicable to AI-enabled machinery products and radio equipment. These initiatives do not contain provisions on liability or access to information for the purposes of damages claims. Their requirements (e.g. general safety requirement, risk assessment or regarding human oversight, testing, data quality) can be relevant for determining what constitutes fault of producers or what is a defective product in relation to AI – points which the AI liability proposal will not regulate. Safety and fundamental rights requirements are meant to prevent, monitor and address risks and thus address societal concerns. While they employ tools that address a potential wrongdoer, such as authorisations, controls, monitoring, administrative sanctions, they do not compensate the victim for the harm suffered. Therefore, safety and liability are two sides of the same coin: they apply at different moments and reinforce each other. Safety rules intend to reduce the risk of harm. Liability rules come in to ensure compensation of the victim when harm has nevertheless occurred. Effective liability rules also provide an economic incentive to comply with safety rules and contribute therefore to preventing the occurrence of harm. As AI is only gradually being rolled-out, there are not yet many documented cases of harm as the relevant products/services are not yet on the market. However, as part of the Commission’s forward-looking and enabling approach for the uptake of this technology, action is needed to adapt the applicable liability rules in advance in order to increase trust and create the conditions for the roll-out of these products and services. Interaction with the pending revision of the PLD: The Commission takes a holistic approach in its AI policy to liability by considering adaptations to the producer’s liability for defective products under the PLD as well as a targeted harmonisation of specific aspects of the other liability rules. These two policy initiatives are closely linked and form a package, as the claims within their scope deal with different types of liability. They complement one another to form an overall effective civil liability system. For AI, they achieve the AI White Paper objective that persons having suffered harm caused by AI systems enjoy the same level of protection as persons having suffered harm caused by other technologies. Example: The victim may decide to pursue a liability claim against the one who caused the damage by operating the product (e.g. a service provider), based on strict or fault-based liability.

The victim may also rely on product liability to claim compensation for losses as a result of material harm from the producer of the AI-product. In order to get compensation from the producer for damage not linked to material harm (such as pure economic loss or damage caused by discrimination), the same victim would need to invoke national liability rules outside the scope of the PLD, in particular fault-based liability. Together they will deliver the ex-post trust element in AI (and other digital technologies), by ensuring that victims have an effective chance of compensation if damage occurs despite the preventive requirements of AI Act and the other safety rules. 2.Problem definition 2.1. Introduction and overview Liability ranks amongst the top three barriers to the use of AI by European companies in a representative survey of 2020. It is the most relevant external obstacle (43%) for companies that are planning to, but have not yet adopted AI. In the White Paper, the Commission counted liability-related issues amongst the main risks related to the use of AI, because victims may not have effective access to the evidence necessary to build a case in court and economic operators face uncertainty as regards the allocation of responsibilities. The accompanying Report identified those AI-specific characteristics that challenge liability rules, (see section 2.2.). Economic, behavioural and legal studies commissioned for this impact assessment, as well as comprehensive stakeholder consultations, have shown three AI-specific problems: legal uncertainty (see 2.3.), increased legal fragmentation (see 2.4.) and a lack of compensation for victims contributing to the lack of societal trust in AI use (see 2.5.), which in their combination cause internal market obstacles (see 2.6.). Delineation from the problems covered by the parallel impact assessment on the PLD review: Under the PLD, the burden of proof is less onerous on victims than under national fault-based liability rules, because the victim does not have to prove fault. Nevertheless, proving that a product is defective (i.e. that it does not provide the level of safety a person is entitled to expect) is challenging for complex products, of which AI-enabled products are an example, even if the victim does not have to prove how the product became unsafe. As the PLD regulates producer liability for various different types of defective complex products, of which AI-enabled products are only a part, this problem is covered in the parallel impact assessment on the PLD review. It will be addressed by amendments of the PLD regulating in a horizontal manner all those products. 2.2. Problem driver: the specific characteristics of AI make it difficult to meet the burden of proof The three problems (uncertainty, fragmentation and lack of compensation) are driven by the fact that, under existing liability rules, victims normally have to prove the necessary conditions for a successful claim. Under current rules, victims generally have to identify the possibly liable person(s), the action/omission of that person which could be characterised as fault, and the causal link between that action/omission and the damage. There are neither targeted provisions for AI to ease the victim’s burden of proof under fault-based claims, nor AI-specific strict liability regimes that would exempt the victim from making this proof. However, certain AI-systems have characteristics that make it prohibitively difficult or even impossible for victims to provide that proof. The specific characteristics that challenge current liability rules are: increasingly autonomous behaviour, opacity/lack of transparency and explainability, complexity, continuous adaptation and lack of predictability. These characteristics make it very difficult to attribute directly the damaging output of the AI to an action/omission of a liable person, i.e. to identify: -the person who could possibly have done something wrong, -the action or omission of that person which might not comply with the relevant standard of care, and -the causal link between that action or omission and the victim’s damage. This is linked to two situations that can occur due to the use of AI systems: -between the human actor(s) related to the AI system and the damage caused by this AI system to a victim, the AI-system takes an autonomous action which is not pre-determined by a human and/or -the way the AI action is performed cannot be understood (mainly due to the opacity and complexity of certain forms of AI). Example: A company deploys a fleet of autonomous cleaning robots to provide cleaning services throughout a city. It tasks one of its employees with the remote supervision of the fleet. One of the cleaning robots fails to recognise a colourful baby stroller, which is parked in front of a similarly patterned advertising banner. Because of the collision, the baby is injured and the stroller is damaged. The father witnessing the accident suffers psychological trauma. The accident could be due to a variety of possible causes, e.g. an image segmentation error of the robot’s AI-based perception system, a failure by the provider of the AI vision component to provide an available software update or a failure by the user (the cleaning company) to install it, a failure by the human remote operator to appropriately monitor the operation of the fleet (possibly due to a malfunction of the human-robot interface) or also a deliberate attack on the robot’s sensors by a third party (jamming, spoofing, sabotage through adversarial machine learning etc.). Fault: Given the cleaning robot’s highly autonomous mode of operation, as well as the opacity and complexity of the different AI components, it is highly uncertain that the victim could ascertain relevant actions or omissions of, for instance, the employee charged with providing the cleaning instructions or monitoring the fleet of robots remotely. This would however be necessary to make a successful claim against the company.

Causality: Assuming a wrongdoer’s fault can be established, it is uncertain whether and how the victim can prove the causal link between such faulty behaviour and the damage. If an expert has access to logged information on inputs, outputs and internal states of the AI subsystems, she may be able to discard certain causes of the accident (e.g. jamming or spoofing of sensors) and to suppose certain correlations between, for instance, a detection failure and a control decision to move forward until colliding with the stroller. But due to the high degree of autonomy, complexity and the lack of explainability of the AI systems involved (not only the perception module but also e.g. the trajectory planning system and low-level controllers), it will likely be impossible to infer a clear causal link between any specific input and the harmful output. In view of AI specificities, to prove the necessary degree of likelihood is highly uncertain. PLD: When claiming compensation under the PLD, the victim does not have to prove the producer’s fault, but that the cleaning robot was defective (i.e. it failed to provide the level of safety the public at large is entitled to expect) and the causal link between the defect and the harm. The victim would not have to prove how the cleaning robot became defective; whether it was a mechanical or software flaw is irrelevant. However, the PLD has shortcomings when it comes to digital products: producers are not liable for defects that emerge after the product was put into circulation (e.g. if the defect was due to a subsequently downloaded software module) and software producers themselves, including AI-system providers, cannot be pursued. These issues are dealt with in the PLD impact assessment, as they concern not only AI technologies. The PLD does not help the victim for any claims against other parties than the producer (e.g. the cleaning company), claims based on other grounds than defect (e.g. a failure to appropriately supervise the robot fleet), and claims for the compensation of damage not covered by the PLD (e.g. the psychological harm suffered by the baby’s father). The results of the public consultation confirmed the existence of this problem driver. Two out of three overall respondents agreed (67% or 153 out of 227, of which 46 % or 105 strongly) that it could be difficult to link damage caused by highly autonomous AI to a liable person (only 20% or 47 out of 227 disagreed). The agreement among citizens was even larger (84% or 78 out of 93) and almost unanimous among consumer organisations, national ministries and academic/research associations (94% or 31 out of 33, with only one disagreeing). Among business stakeholders a relative majority did not agree with the difficulties to link the damage to a liable person (45% or 38 out of 85) while a strong minority (36% or 30 out of 85) agreed. Three out of four overall respondents agreed (74 % or 167 out of 227, of which 76% or 127 strongly) that it could be difficult for victims to prove that the conditions of liability (fault, defect or causation) are fulfilled in the case of opaque and complex AI , while only 12% disagreed (26 out of 227). The agreement among responding EU citizens was overwhelming (91% or 85 out of 93) and unanimous among responding consumer organisations, national ministries and research institutions. Even a relative majority among business stakeholders agreed with the difficulties of proof (41 %, or 35 out of 85, while 28% or 24 out of 85 disagreed). 61% (or 139 out of 228) of overall respondents agreed (41,8 % or 95 out of 228 strongly) that this means less victim protection. The majorities among consumer organisations, national ministries, NGOs and research institutions (84% or 32 out of 38 with only one disagreeing) and EU citizens (79% or 74 out of 94) were even larger. Even a majority of business stakeholders agreed that victims are less protected (53,6 % while 26,2 % disagreed). However, in situations where the liable person acted on advice or recommendations given by an AI system, this AI-specific problem driver does not apply. In such cases, the human acting on the advice or recommendation will be responsible as there is a human action/omission, which can be a) identified, b) characterised as not complying with the relevant standard of care, and which would c) be the cause for a specific damage. This is for example the case with AI systems providing medical analysis or even suggestions for diagnosis and treatment, which are feeding into a decision on diagnosis and treatment, but that decision is ultimately taken by a human physician. As AI-enabled products and services with the specific characteristics challenging liability rules are for the most part not yet on the market, it is not possible to quantify the scale of the problem or of its relevance for different market segments. The economic study did however provide some indications. The market share affected by legal uncertainty and legal fragmentation regarding AI liability will likely differ substantially per sector and is potentially larger where AI technologies directly interact with humans and where – in the case of a failure or damage – large-scale negative effects can be expected. Potential bodily and psychological harm, property damage, economic loss and damage caused by discrimination present recurring risks linked to the use of AI across various sectors. The economic study found that the share of AI-enabled products and services potentially affected by legal uncertainty and legal fragmentation of civil liability rules ranges between ca. 20% in sectors such as real estate or oil and gas and around 40% in sectors such as human health and transport. 2.3. Problem 1: Legal uncertainty As there are currently no rules addressing the AI-specific difficulties of proof, the general burden of proof conditions apply. This has several consequences, creating legal uncertainty. The victim and the possible liable person wanting to check liability risks, as well as the judges having to decide a liability claim, will be confronted with cases where they would need to interpret general rules which were not designed with AI in mind. They would have to apply them to AI-technologies that are qualitatively different from previous technologies, because of their specific characteristics (see 2.2.). It is quite uncertain how existing liability rules would be interpreted in light of the AI-specific difficulties of meeting the burden of proving fault and causation. Such difficulties would lead in all likelihood to the result that the victim would not be able to meet this burden of proof. Victims may therefore decide to not even claim compensation. As an economic consequence, they would have to bear the burden of the damage. If the case goes to court nevertheless, national courts may decide - on an ad-hoc basis - to stick to the traditional allocation of the burden of proof on the victim. This would lead in all likelihood to the result that the victim would lose the case, not obtain compensation and bear the economic burden of the damage. If such a result is not considered as equitable, national courts may decide - again on an ad-hoc basis - to adapt to the specificities of AI and alleviate the burden of proof of the victim, in order to achieve a fair outcome in each single case. These uncertainties surrounding AI liability are especially relevant in a cross-border context, because MS’ existing burden of proof rules are already very diverse. The economic impact of this legal uncertainty is demonstrated by legal experts. When asked to estimate the costs of claiming compensation based on national liability rules for damage caused by AI, they submitted wide ranges to account for the prevailing uncertainty. The public consultation confirmed this problem: a very large majority of responding consumer organisations, NGOs academic/research associations (84% or 27 out of 32, with none disagreeing) and EU citizens (85% or 80 out of 94, with only one citizen disagreeing) agreed that it is uncertain how national liability rules will apply. The same respondents agreed equally broadly with the uncertainty how national courts will address the challenges of AI (91% or 84 out of 92 of EU citizens agreed, with none disagreeing; 81% or 25 out of 31 agreement amongst the aforementioned organisations, with only one disagreeing). A slight majority of business stakeholders disagreed (52% or 44 out of 85) with the uncertainty as to how national liability rules will apply, while still almost a third confirmed it (32% or 27 out of 85). Again a third of business respondents agreed with the uncertainty as to how national courts will react to the challenges of AI (34% or 29 out of 85) while a stronger share (43%, or 36 out of 85) disagreed. In the PLD context, unclear rules, including for AI-enabled products, have equally been identified as a problem driver. This mainly concerns the problem that the PLD is ill-adapted to products in the digital age in general. It imposes neither liability on software providers, including AI-system providers, nor liability for defects emerging after a product is placed on the market, such as through software updates, or ancillary digital services. Legal uncertainty applies horizontally to defective intangibles like software, digital content and ancillary services. For producers’ liability for defective products, including with respect to AI-enabled products, this problem and the measures needed to address it are discussed in the parallel impact assessment on the PLD revision. 2.4. Problem 2: Legal fragmentation In a cross-border context, the law applicable to a liability claim is by default the law of the country in which the damage occurs. This means that different liability regimes and burden of proof rules could be applied to the same kind of AI-enabled product/service deployed in several MS which causes the same kind of damage. Consequently, a company disseminating/operating the same AI-enabled product/service in various MS could face different liability exposures if that product or service causes, for the same reason, the same type of damage in several MS. Aside from the general burden of proof rules, there are also different rules about information disclosures in liability claims. This means that victims face greater information asymmetries in some MS. In addition, national AI strategies show that several MS are considering, or even concretely planning, legislative action on civil liability for AI. The fact that in the public consultation on the AI White Paper, more than 63 % of respondents were in favour of adapting national liability rules for all or for specific AI applications suggests that MS are likely to face pressure to address the issue of liability for damage caused by AI.

While the fragmentation of MS’ existing liability and burden of proof rules is as such not limited to cases involving AI, the likely adoption of AI-specific liability rules by at least some MS exacerbates the problem of fragmentation with respect to AI-enabled products and services in particular. Outside the scope of the PLD, tort law is currently not harmonised and MS’ rules diverge substantially. This may create internal market obstacles also for traditional products and services. Nevertheless, it is crucial to address this issue specifically for AI, for the following reasons: -The Commission aims to create the right conditions specifically for the roll-out of AI-equipped products and services. According to the Commission’s ‘staged approach’, this involves two complementary and synergetic initiatives: in a first step, the AI Act proposal to ensure the effectiveness of safety and fundamental rights protection, and in a second step, the AI liability proposal to ensure effective protection when AI nevertheless causes harm. -Stakeholders active in the field of AI will be especially affected by the market barriers associated with legal fragmentation (see 2.6.). -As a key enabling technology, the importance of which can be compared with the introduction of electricity, AI bears a significant potential for economic growth and societal usefulness. It is therefore essential to address the obstacles entailed by legal fragmentation in order to reap the full potential of AI within the internal market and for the digital transition. -Given the entrenched and longstanding differences between national legal traditions, any attempt to address the problem of legal fragmentation by way of a broad stroke harmonisation of tort law would not be promising. Focussing on AI specific problems and addressing them with targeted adaptations to specific aspects of national laws provides an opportunity to approach the problem of fragmented civil liability rules in an effective and future-oriented manner. The existence of diverging approaches to easing the burden of proof in cases involving complex products also forms part of the problems affecting the PLD, as it leads to differing levels of consumer protection (section 2.2.2. in the PLD impact assessment). Since the PLD problems concern not only AI-enabled products but also other complex products, they are dealt with in the impact assessment on the PLD revision. 2.5. Problem 3: Lack of compensation for victims leading to a lack of societal trust and hampering uptake of AI-enabled products and services As already explained (see 2.2.), some characteristics of certain AI systems challenge the application of liability rules and may make it prohibitively difficult or even impossible for victims to get compensation. Victims are likely to incur significantly higher up-front costs and face significantly longer legal proceedings, when claiming compensation for damage caused by AI-enabled products or services, compared to cases not involving AI applications. Substantial burdens on victims are anticipated, due to the specific challenges of AI, for almost all national legal systems covered by the analysis commissioned for this impact assessment, often going beyond a 100 % increase of fees paid for legal and technical expertise. This could deter victims from claiming compensation. Ultimately victims may be left under- or even uncompensated. AI-specific barriers are therefore likely to impinge on the right to an effective judicial remedy. As a consequence, the compensation function of liability law would fail. This would undermine the fundamental concept of justice as fairness (‘distributive justice’) that underpins our legal order and citizens’ trust in the justice system. If victims are left without compensation when AI is involved, they would find themselves at a disadvantage compared to a situation where traditional technology would have caused the damage. Such an AI-induced lack of compensation would be particularly problematic if future autonomous technologies would create a significant risk of harm to life, health and significant property values, due to the important legal interests at stake. The need to ensure effective compensation is all the more pressing where unwitting third parties are exposed to such risks, as such victims cannot choose to accept or avoid the risk of damage. A behavioural study commissioned for this impact assessment has shown that the expected lower likelihood of receiving compensation if AI applications cause damage is amongst the reasons for low levels of consumer trust in such applications. Conversely, the availability of effective remedies and compensation is one of the factors increasing the level of societal acceptance of, and consumer trust in, AI-enabled products and services. Another recent survey confirmed that consumers have clear concerns regarding the allocation of responsibility and liability if something goes wrong. It concluded that these concerns must be properly addressed to ensure strong protection for consumers and for them to trust this technology. A statistically representative Eurobarometer of 2019 points in the same direction: EU citizens’ most widespread concern about the use of AI was that it could cause situations where it is unclear who is responsible. The aforementioned behavioural research demonstrated that a lower level of trust in AI applications and the perception that persons suffering damage caused by AI-enabled products and services are less likely to obtain compensation correlate with a lower willingness to take up such products and services. Businesses also consider that the lack of citizens’ trust is one of the most relevant obstacles to the take-up of AI-technologies in Europe. Other factors, such as the perceived risk of accidents, were also shown to have a significant effect on the level of societal trust and consumer uptake. These findings are consistent with the complementary role of the AI Act / safety legislation and liability rules in creating an ecosystem of trust for AI. In the public consultation, a clear majority of overall respondents confirmed that the lack of adaptation of existing liability rules to AI may negatively affect trust in AI (60% or 135 out of 227) and the uptake of AI-enabled products and services (56% or 126 out of 227). In particular, responding NGOs consumer organisations, academic/research institutions and EU citizens overwhelmingly confirmed these problems: 81% (or 77 out of 95) of citizens and 89% (or 16 out of 18) of these organisations anticipate a negative effect on trust in AI; 79% (or 74 out of 94) of citizens and 78% (or 14 out of 18) of these organisations expect a negative effect on AI uptake. By contrast, 58 % (or 49 out of 85) of responding business stakeholders (business associations and companies/business organisations) did not uphold them, while still a quarter of them confirm them (27 % or 23 out of 85). 2.6. The consequences: internal market obstacles and affected stakeholders (a) Directly affected stakeholders Potentially liable companies: The representative 2020 IPSOS survey of European companies showed that liability for potential damages is the most recurrent barrier to the adoption of AI technologies. The economic study found that a majority of businesses active in the market for AI-enabled products and services perceive their liability exposure outside the scope of the PLD as uncertain to varying extents. Where companies are considering a cross-border rollout of AI-enabled products or services, the costs and burden linked to legal uncertainty are amplified by fragmentation between MS’ liability rules. This means that such companies have to carry out complex assessments and quantifications of liability risks for each relevant MS. A significant share of businesses active in the AI market does or will incur costs due to legal fragmentation and uncertainty regarding the application of national liability rules to damage caused by AI: legal information/representation and compliance costs, internal risk management costs, opportunity costs in the form of foregone revenue due to companies’ hesitation to explore new markets. Moreover, liability rules may sometimes have a bearing on which technological solution is favoured by developers of novel products and services and may influence how products and services are designed. Going cross-border may therefore involve costly technological adaptations that thwart economies of scale. Companies deterred from investing in AI-technologies miss out on benefits in terms of increased profits or efficiency gains. The economic study estimated that the total values of the EU27 AI market affected by legal uncertainty and legal fragmentation ranges from EUR 1.739 billion to EUR 4.973 billion in 2021. These shares of the total AI market in the EU27 were obtained by multiplying the value of the AI market per sector with the respective shares affected by legal uncertainty and fragmentation. To ensure consistency, the estimated AI market sizes assumed for the impact assessment accompanying the proposed AI Act were taken as a starting point, representing overall investments in AI technologies. For the sake of robustness and in order to account for uncertainty, these estimates allow for a wide range of market definitions and possible future developments. The shares affected by legal uncertainty and fragmentation were determined based on a sector-by-sector analysis, taking into account the ability of the AI applications deployed in the respective sector (now or in the foreseeable future) to cause harm and thus give rise to liability claims. The EP concluded in 2020 that fragmentation and uncertainty, relating to the liability provisions applicable across the EU, that may emerge in the absence of a common EU approach can provide negative incentives for innovation and diffusion of AI systems while also contributing to excessive costs for consumers. These internal market obstacles will likely contribute to slowing down the innovation that drives the overall digital transition. Legal uncertainty and fragmentation regarding civil liability presents significant barriers across all sectors and both to products and services. The results of the public consultation confirm these consequences. A clear majority of overall respondents expect that legal fragmentation and/or the lack of adaptation with respect to civil liability for AI will, for instance, entail at least to some extent additional costs for companies (e.g. legal information costs, insurance costs) (75% or 153 out of 205) and the need to adapt AI technologies, distribution models and cost-management models (70% or 146 out of 205).

SMEs in particular: Start-ups and other SMEs are likely to be significantly more affected by legal uncertainty and fragmentation than large companies: they cannot rely on comparable in-house legal expertise and an established cross-border network. As smaller companies often lack sufficient external funding, the additional costs incurred due to legal uncertainty may be prohibitive for start-ups and other SMEs, or at least reduce their competitiveness in relation to large companies. These effects are particularly weighty because the EU market is driven by SMEs developing, deploying or using AI technologies. It is estimated that SMEs account for more than 95 % of companies active in this market, with micro-enterprises representing over 80 % of all firms involved in AI research and software development. Yet it is estimated that only 19 % of micro-enterprises active in the internal AI market are involved in cross-border activities (as opposed to 68 % of large corporations). This points to a significant unused internal market potential. As most start-ups and other SMEs are not using the potential of the single market to scale up, the fragmentation of the AI landscape, notably in terms of regulations, impedes the creation of a regional ecosystem with bigger scale. In the public consultation, business associations representing SMEs confirmed the relevant internal market obstacles to a larger extent than other business stakeholders. The responding individual SMEs also agreed that the lack of adaptation and fragmented AI-specific liability rules at national level will increase companies’ costs, insurance premiums, entail higher prices of AI-enabled products and services and cause companies to refrain from using AI. Insurance companies: Legal uncertainty regarding the liability exposure of insurance holders can make it more difficult to calculate premiums and offer coverage, in particular for cross-border activities and for situations covered by fault-based liability. Such difficulties affect the insurance companies themselves. But they are also of concern to the companies facing unpredictable – and potentially very high – liability exposure when unable to procure desired insurance coverage. Finally, they also affect the victims bearing the liable party’s insolvency risk. Moreover, liability insurance premiums depend, to some extent, on insurers’ prospect of successful redress claims allowing them to claim back the amounts they paid out. Outside the scope of the PLD, such redress claims rely to a large extent on fault-based liability, which means that insurance companies will face significant uncertainty in estimating their own chances of success on the redress level for damage caused by AI-enabled products and services. Victims of damage caused by AI-technologies may be (i) private persons, businesses or public entities owning AI-enabled products or using AI-enabled products and services and (ii) natural persons, businesses or public entities without any link to those products and services (third-party damage). See 2.5. for detailed explanations on the difficulties faced by victims. (b) Indirectly affected stakeholders Consumers: As explained under 2.5., a lack of compensation of damage caused by AI is likely to contribute to low levels of consumer trust and demand of AI-enabled products and services. If restrained consumer demand, coupled with legal uncertainty and fragmentation faced by businesses, delay the roll-out of novel AI-technologies in the internal market, consumers would, to some extent, be deprived of the benefits promised by AI. They could miss out on benefits like faster and more personalised services, innovative and performant products as well as advances in the fields of health, safety, security, mobility, sustainability, media, etc. Companies active in AI: The trust deficit and the consequential lower uptake of AI-enabled products and services is likely to affect all companies with a stake in the rollout of AI in the form of lost market opportunities. This includes also those entities in the AI value chain, such as researchers, developers and providers of related technologies or equipment (e.g. cloud service providers), who are likely to face reduced demand. General economic consequences: If victims are left to bear the burden of damage caused by AI, the overall cost allocation of introducing this technology is inefficient, as this cost is borne by those that neither can control the risk nor benefit from it. Burdening victims disproportionately and allowing for an externalisation of costs linked to the roll-out of AI would create inefficient incentives. It would also undermine the innovation potential linked to the development of safe AI-enabled products and services. In an even broader sense, the existence of obstacles to the functioning of the internal market in AI-enabled products and services affects the European economy and society as a whole. The cross-sector relevance of AI was confirmed by a representative survey of 2020, showing that at least 35 % of EU companies from each of the sectors covered have adopted AI technologies. The identified liability-related obstacles are likely to have a negative impact on the overall growth and innovation capacity of the European market. The fact that EU companies cannot take full advantage of the internal market prevents them from becoming more competitive on a global scale, and may thus further weaken the EU’s position vis-à-vis its competitors in the global AI race (primarily the US and China), as the EU already lags behind them. By putting forward a balanced approach regarding liability for damage caused by AI, the EU has the opportunity to set a global benchmark and ultimately generate a competitive advantage for ‘AI made in Europe’. While the longer term impact of Covid-19 on the situation of the internal market for AI-enabled products and services is still somewhat uncertain, the pandemic has expedited the trend towards increased digitalisation, and economic growth has picked up strongly in 2021 and 2022. The war in Ukraine is likely to have a significant negative effect on the EU economy, and forecasts will have to be reviewed taking into account his factor. However, at the time of submitting this impact assessment no updated estimates were available yet. General societal consequences: A liability framework which is significantly more difficult to apply when AI is involved will not sufficiently motivate risk takers (producers, service providers, operators, users, etc.) to make efforts to avoid harm to others. In particular, inefficient liability rules will not sufficiently motivate compliance with safety rules or with the ex-ante requirements introduced by the AI Act. Compensation gaps could call into question citizens’ trust not only in AI, but also in the ability of the legal and judicial system to ensure fair and equitable results. 2.7. Likely evolution of the problems without Union intervention Legal uncertainty regarding the application of national liability rules might to a certain extent diminish in the long term as MS adopt AI-specific liability rules or national courts clarify the interpretation of existing rules. However, the adoption of AI-specific liability rules at the national level would in all likelihood exacerbate the problem of fragmentation since such rules would be different and not benefit from a harmonised interpretation by the European Court of Justice. Judicial solutions adopted by national courts are by nature limited to the particular case at issue and in most cases do not bind other courts, which in turn can adopt different solutions. Therefore, legal uncertainty for business and victims’ difficulties in claiming compensation will persist, to a large extent, while fragmentation in the internal market will increase. The AI Act and various safety related rules aim to improve the availability of relevant information on, and the transparency and explainability of high-risk AI systems, the safety of those systems and the effective protection of fundamental rights. The requirements of the AI Act and future detailed standards providing details on these requirements can help to determine the duties of care for fault-based claims. The information to be documented and the logged records of the system pursuant to the AI Act can be useful, if the victim has access to it, for establishing liability. However, these proposals do not contain provisions designed to facilitate the victim’s claim, e.g. on the burden of proof or access to information. They will therefore not remove the AI-specific problem drivers in the context of liability. For this reason, the impact assessment for the AI Act underlined the importance of combining that initiative with specific liability-related measures. It is to be expected that the problem drivers of the difficulty of claiming compensation linked to e.g. the autonomy, opacity and complexity of certain AI systems will become more relevant in the future, as increasingly independent AI-systems will carry out ever more advanced tasks (see 5.1.). The negative effect of a perceived lack of compensation on societal trust is likely to further increase, if the risks posed by AI-enabled technologies materialise in practice and the public becomes increasingly aware of difficulties in claiming compensation. Accidents involving AI-enabled products often receive a very large amount of public attention. Behavioural research has shown that the level of consumers’ anxiety towards the use of AI applications and their likelihood to take up AI-enabled products/services is correlated with their exposure to media coverage of accidents involving such products/services. This effect could already be observed e.g. by the change in public perception of self-driving vehicles following high-profile crashes. It is very likely to become more relevant with the increased rollout of AI applications capable of causing harm. As the market for AI-enabled products and services is expected to grow substantially, and AI can be implemented in more and more situations and sectors, the economic and societal relevance of the identified problems is also likely to increase in absolute terms. The economic study concluded that the sum of the AI market share affected by liability issues will increase at a compound annual growth rate of 44% – 56% until 2025.

3.Why should the EU act? 3.1. Legal basis The initiative constitutes a core part of the EU AI strategy. The problems identified in section 2 (legal uncertainty, legal fragmentation, lack of compensation diminishing consumer trust) hinder the development of the internal market and thus amount to significant obstacles to cross-border trade in AI-enabled products and services. On the one hand, these obstacles stem from the fact that businesses that want to produce, disseminate and operate AI-enabled products and services across borders are uncertain whether and how existing liability regimes would apply to damage caused by AI. This uncertainty concerns not only their own MS but particularly other MS where they will export to or operate their products and services. This assessment was recently confirmed by the comparative law study. Certainty would be necessary for these businesses to know the relevant liability risks and to be able to insure themselves against them. On the other hand, there is concrete evidence showing that a number of MS would take unilateral legislative measures to address the specific challenges posed by AI with respect to liability. For example, AI strategies adopted in Italy, Malta, Czech Republic, Poland and Portugal mention initiatives to clarify liability. Given the already existing large extent of differences between MS’ existing civil liability rules, it is very likely that any national AI-specific measures on liability would follow existing different national approaches and therefore increase such differences. In a cross-border context the law applicable to a non-contractual obligation arising out of a tort/delict is by default the law of the country in which the damage occurs. Thus, adaptations of liability rules taken on a purely national basis would increase the barriers to the roll-out of AI-enabled products and services across the internal market and contribute further to fragmentation. In light of the existing situation and the content and aim of the planned initiative, the appropriate legal basis is Article 114 TFEU. This initiative addresses the abovementioned obstacles by harmonising targeted aspects of MS’ existing civil liability rules applicable to AI-systems, in order to improve the conditions for the functioning of the internal market in AI-enabled products and services. The choice of that legal basis is also supported by the EP which has called twice upon the Commission to use this legal basis for a legislative proposal. 3.2. Subsidiarity: Necessity and added value of EU action (a) Necessity of action at EU level The identified obstacles have significant impact on cross-border trade of AI-enabled products and services. The negative effects of legal uncertainty – additional legal information/representation and risk management costs as well as foregone revenue – were found to be worse for companies trading cross-border. Likewise, fragmentation between MS regarding the conditions under which business would face compensation claims for damage caused by AI would increase transaction costs especially regarding cross-border trade, entailing significant internal market barriers. The significance of these obstacles is reinforced by the fact that legal uncertainty and fragmentation disproportionately affect start-ups and other SMEs, which account for the large majority of companies and the major share of investments in the relevant markets. Smaller businesses lack the necessary financial resources as well as the specialised legal and technical expertise to cope with the identified challenges. Thus, they are more likely to be deterred from rolling out their products or services across borders, incurring lost revenue. This situation is making the EU market overall less strong and innovative and European companies less competitive. MS could to some extent address the problem of legal uncertainty and improve the effectiveness of liability claims by adapting their respective rules. However, they would necessarily do so by building on the approaches of their own, already very different liability regimes. This would lead to further fragmentation, with the negative effects outlined under 2.4. and 3.1. The relevant problems can therefore be addressed effectively only at EU level. (b) Added value of EU action The conditions for the roll-out and development of AI-technologies in the internal market can be significantly improved by preventing fragmentation and increasing legal certainty through harmonised measures at EU level, compared to the baseline scenario involving possible adaptations of liability rules at national level. The economic study concluded – as a conservative estimate – that targeted harmonisation measures on civil liability for AI would have a positive impact of 5 to 7 % on the production value of relevant cross-border trade as compared to the baseline scenario. This added value would be generated notably through reduced fragmentation and increased legal certainty regarding stakeholders’ liability exposure. This would lower stakeholders’ legal information/representation, internal risk management and compliance costs, facilitate financial planning as well as risk estimates for insurance purposes, and enable companies – in particular SMEs – to explore new markets across borders. Moreover, it is only through EU action that the desired effect of promoting consumer trust in AI-enabled products and services by preventing liability gaps linked to the specific characteristics of AI can be achieved consistently across the internal market. Harmonised adaptations of existing liability rules are needed to prevent AI-induced liability gaps across all MS, ensuring a consistent (minimum) level of protection for all victims (citizens and companies) and consistent incentives to prevent harm and ensure accountability. Given the long-standing and entrenched divergences between national tort law traditions, any attempt of a general broad stroke harmonisation of tort law would meet with strong subsidiarity concerns from MS. The same is not the case for a targeted initiative addressing AI specific challenges at EU level. The pivotal role of AI as a key enabling technology distinguishes it from other products and services. This is why the Commission and MS have jointly committed to align their AI policy to remove fragmentation and address challenges globally, recognising the need for coordinated measures to create the right conditions for the rollout of AI in the internal market. By putting forward targeted and harmonised adaptations of certain aspects of existing national liability rules, this initiative presents a clear added value, without putting into question MS’ traditional civil liability frameworks. (c) Stakeholder views A public consultation conducted in 2017 by the EP showed that 90 % of individual stakeholders consider it necessary to regulate developments in both robotics and AI, and 96 % of those favouring a regulatory approach preferred action at EU or international level rather than action at MS level. A statistically representative Eurobarometer of 2019 confirmed that half of EU citizens (50 %) agreed that public policy intervention is needed, whereas only 7 % considered that no specific action is needed, and 16 % considered that industry providers of AI can deal with these issues themselves. These results were clearly confirmed by the outcome of the public consultation on the AI White Paper in 2020. 63 % of respondents were in favour of adapting national liability rules for all or for specific AI applications to better ensure proper compensation and a fair allocation of liability. Citizens were particularly supportive, with 72% of respondents calling for some adaptations. While the overall support among companies was 45%, it was higher among SMEs with 60% of respondents. This confirms that, as explained before, the effect of the identified legal uncertainty and fragmentation is disproportionately larger on SMEs. The need for EU action was again confirmed by the results of the public consultation done in the context of this impact assessment. When asked to rank PO by preference, the baseline option ‘No EU action on liability for AI’ had clearly the lowest average preference score of all responses. Moreover, ca. 60 % of respondents think that EU action to ease the victim’s burden of proof is necessary and justified, while only 25 % disagree with this. The public consultation showed particularly strong support for EU action amongst EU citizens, consumer organisations and NGOs; almost all of them chose ‘No EU action’ as their least preferred PO. Although business stakeholders tend to be more sceptical about EU action on liability for AI, there was support also from the business side: The share of responding companies/business organisations in favour of EU action to ease the victim’s burden of proof was the same as of those opposing it (ca.40 % respectively). SMEs are slightly more favourable towards EU action than other types of business stakeholders: 4 of the responding associations representing SME interests supported EU action to ease victims’ burden of proof, while 3 did not; all responding individual SMEs were in favour of EU action to address difficulties of proof linked with AI.

The comparably less pronounced support from businesses, in relation with all the other categories of stakeholders, is likely to have two main reasons. Firstly, experience seems to indicate that business stakeholders, when contributing to public consultations of the Commission, which is considering a legislative intervention, usually tend to do so from the perspective of a future subject of obligations imposed by EU law, focusing on potential burdens, and not from the perspective of a potential beneficiary. Accordingly, in the case of the public consultation on AI liability, businesses mainly may have seen themselves as liable person/entity, and not as a potential victim of damage. The experiences in the context of the economic study, where business stakeholders provided input on the policy options from the perspective of potentially liable parties and not of potential victims of harm, seem to support such a viewpoint. In line with the above-mentioned differences in results when looking at views of businesses overall and SMEs specifically, the latter could however likely to be more able to view themselves in the victim’s position. This may be one major reason why respondents of this category had somewhat different views than large companies or business associations. Secondly, businesses may tend to focus mostly on how the legislation would apply to them directly and not to consider the broader effects of policy measures, from which they would benefit indirectly. Businesses might tend to disregard the macroeconomic effects of building trust in a technology, while they are more aware of the effects of the lack of it. Therefore, most businesses replying to the consultation seemed to compare a situation of no intervention to a situation of regulation at EU level: When considering no legislative intervention, on the one hand significant shares of business stakeholders acknowledged a link between a lack of adaptation of national liability rules applicable to AI and legal uncertainty and legal fragmentation. They also expect to incur costs due to these problems, especially when engaging in cross-border trade. On the other hand, many businesses may likely tend to associate the lack of adaptation of national liability rules with an indeed high probability that even if companies are responsible for harm caused by AI-enabled products and services they would not have to compensate the harm at all because potential victims would not be able to prove their otherwise justified compensation claim. By contrast, when considering a situation of regulation at EU level, a large share of business stakeholders may focus more on the fact that harmonised measures to prevent AI-specific compensation gaps would increase the chances of success of such a liability claim against them. These considerations might be given more weight than the fact that the AI liability initiative aims to help also businesses that suffered harm to claim compensation, or the potential benefits in terms of increased legal certainty and reduced fragmentation. Authorities from only 5 MS participated in the public consultation, expressing split views on the AI liability initiative. A dedicated workshop was subsequently organised to get a broader picture of Member States’ opinions. However this aim was not achieved, Member States were in their very large majority not in a position to confirm either clear support or opposition. Member States seemed to adopt more a ‘wait-and-see’ stance. A reason may be that they may expect the Commission to put forward a legislative proposal and may not have wished to pre-empt their position during the legislative negotiations. 4.Objectives: What is to be achieved? Specific Objectives Increase legal certainty about the liability risk exposure of business activities involving AI Prevent the emergence of fragmented AI-specific rules across the internal market Prevent a lack of compensation (ensure same level of protection in cases involving AI) General objectives Functioning of the internal market (reduce obstacles and prevent emergence of new obstacles) Ecosystem of trust → Promote the uptake of AI-enabled products and services Promote the roll-out of trustworthy AI in Europe (economic, social, environmental benefits of AI) 4.1. General objectives In line with the overall Commission strategy, the primary general objective of this initiative is to contribute to the roll-out of AI in order to reap its benefits as a set of enabling technologies for the growth of the digital economy and its societal advantages. The contribution of this initiative to this objective is twofold. Firstly, it would improve the conditions for the functioning of the internal market: reducing existing obstacles and preventing the emergence of new obstacles to the cross-border trade in AI-enabled products and services. This would have beneficial effects for the European economy and the competitiveness of the European AI-sector. Secondly, in line with the Commission human-centric approach and the White Paper on AI, this initiative contributes to the ‘ecosystem of trust’ in AI by ensuring that persons having suffered harm caused with the involvement of AI systems enjoy the same level of protection as persons having suffered harm caused by other technologies and that efficient redress mechanisms fairly distribute loss. Increased trust will lead to increased uptake of AI. 4.2. Specific objectives (a) SO1: Increase legal certainty about the liability risk exposure of business activities involving AI - Description: This initiative aims at reducing legal uncertainty regarding companies’ liability risk exposure. Legal certainty is a key concern for investors.

By clarifying the conditions for assessing and quantifying liability risks, the initiative seeks to create investment stability. By reducing legal information/representation, risk management and litigation costs, companies should have stable and favourable conditions to produce, market and operate AI-enabled products and services. This initiative thus promotes the roll-out of AI-enabled products and services. This SO applies to all AI-related business but is particularly relevant for cross-border operations, where the negative effects of legal uncertainty are multiplied by the number of MS into which AI-enabled products and services are exported to or are operating in. - Stakeholders targeted: Legal certainty is meant to benefit all companies active in AI. Increasing legal certainty would be beneficial to a higher degree for start-ups and other SMEs, which perceive uncertainty to a greater extent and are disproportionately affected by the associated costs and burden. By reducing legal uncertainty, the initiative aims also to promote a wide range of offers in the relevant insurance market and enable insurance companies to reduce risk premiums. Those taking up AI will be able to insure their liability risk, with the effect of limiting liability exposure to the insurance premiums. Such insurance decreases possible liability costs very significantly. It also makes them predictable and therefore manageable. This benefits in particular start-ups with lower capital cover, because a liability risk is more likely to be an existential threat for such companies than for large companies. Insurance coverage is also advantageous for victims, because they benefit from faster and easier compensation, even in the event that the liable party is insolvent. (b) SO2: Prevent the emergence of fragmented AI-specific rules across the internal market - Description: The initiative aims to prevent the emergence of different national rules adapting in different ways national liability regimes to the specificities of AI. This would exacerbate the already existing legal heterogeneity and create more fragmentation. It would also slow down the roll-out of AI as a set of enabling technologies. Legal fragmentation adds to the burden linked to legal uncertainty when operating across national borders. The second SO is thus intertwined with the first. Preventing legal fragmentation in form of diverging adaptations of liability rules at national level alleviates those types of burden that apply specifically when operating across borders. For instance, the initiative would reduce the need for companies to adapt their business models and the technological parameters of AI-enabled products and services in light of diverging proof-related liability rules. - Stakeholders targeted: Attaining this SO would benefit primarily companies, whose activities are linked to the development or use of AI, that are already operating, or are considering to expand, across borders. As with the first SO, start-ups and other SMEs are affected to a markedly higher degree than large companies, given that the former are much more likely to be deterred by legal fragmentation from exploring new geographical markets. This SO covers also insurance companies. More consistent extra-contractual liability rules would facilitate it for them to offer competitive coverage of AI-related activities in several MS, notably by enabling a consistent risk-assessment and insurance product design. (c) SO3: Prevent a lack of compensation in cases involving AI to promote societal trust and the uptake of AI-enabled products and services - Description: By preventing AI-specific liability gaps, the initiative promotes societal acceptance and consumer trust, both in AI as a new technology and in the justice system. This SO forms part of the EU’s human-centric approach to create an ‘ecosystem of trust’. - Stakeholders targeted: This initiative aims at increasing societal trust in AI-technologies and access to an effective justice system. It ensures that civil liability is well functioning, adapted to the specificities of AI, and justified claims for compensation of harm are successful. It will reach this aim by facilitating claims where the specific characteristics of AI (see 2.2.) would otherwise make it difficult or prohibitively costly for victims to meet the burden of proof. Increasing societal trust would benefit all companies in the AI-value chain, because strengthening citizens’ trust will contribute to a faster uptake of AI, and create a competitive advantage for European AI companies. Due to the incentive effect of liability rules, preventing liability gaps would also indirectly benefit all citizens through an increased level of protection of health and safety (Article 114(3) TFEU) and the obviation of sources of health risks (Article 168(1) TFEU). (d) Consistency with other Commission proposals concerning AI and the PLD revision Not only is this proposal an important element of the overall Commission strategy to promote the roll-out of AI and its human-centric approach. It will also incentivise compliance with safety requirements and requirements designed to safeguard fundamental rights, applicable to AI-enabled products and services. Beside its other main objective to achieve fair compensation, liability law acts as deterrent to unwanted behaviours, in this case, a non-compliance with safety and fundamental rights requirements (see 1.3.). Potentially liable persons will be more diligent in observing rules meant to prevent harm by AI systems. This comes from the knowledge that, in addition to possible administrative sanctions (e.g. fines, withdrawal of products, and suspension of licences), they face the risk of having to pay compensation for a damage caused. The general and SO of this initiative are also consistent with those of the general PLD revision (PLD impact assessment section 4). The two initiatives are designed to complement one another. In their combination, they will create a clear and consistent legal framework ensuring effective protection of victims of AI. Given the PLD’s horizontal, technology-neutral approach, the PLD revision is not aimed at AI in particular but covers all kinds of products. This initiative addresses AI-specific challenges. The PLD revision pursues also additional objectives, such as making the PLD fit for the circular economy. (e) Contribution to achieving the Sustainable Development Goals By promoting the development and rollout of AI, this initiative indirectly supports several targets across all the Sustainable Development Goals (SDGs). TA more direct contribution of this initiative to the SDGs is towards Goal 16, especially target 16.3. This initiative will ensure that victims of harm caused by AI-enabled products/ services have effective access to the evidence necessary to build a case in court, so as to enjoy the same chances of a successful claim as victims of harm caused by other technologies. By ensuring to the former the same level of protection as to the latter, this initiative promotes the goal of ‘equal access to justice for all’. 5.What are the available policy options? 5.1. What is the baseline from which options are assessed? (a) Description The baseline builds on the existing legal framework outlined under 1.2., which consists primarily of MS’ fault-based and strict liability rules as well as the PLD. It is also assumed that the proposed AI Act, the Machinery Products Regulation (‘MPR’) and the General Product Safety Regulation will be adopted. The expected adaptation of national liability rules by a number of MS, likely leading to further fragmentation, is taken into consideration when assessing the impacts of the identified problems under the baseline. A time horizon of 10 years is envisaged for the baseline and for the assessment of the PO against that baseline.

Interplay with PLD review: This same baseline is used in the impact assessment on the not AI-specific measures of the PLD review. In particular, the Commission is considering to clarify liability under the PLD in respect of: -software/digital elements (including AI) necessary for tangible products to operate, -who qualifies as producer for defective updates and upgrades, -liability for the failure to provide a software update to keep the product safe and -how to ease the burden of proof in the case of complex products. These measures could allow to a greater extent than before compensation under the PLD of harm to life, health and consumer property caused by defective AI systems related to products. The measures for AI-induced damage looked at in the present impact assessment would complement the PLD for those liability claims not covered by the PLD, in particular for: -claims based on the fault of a person that led the AI to cause harm (not on product defect); -claims against other entities than producers (e.g. users, operators, service providers, cyber attackers); -claims for damage caused by AI-enabled services; -claims to compensate damage suffered by businesses, -claims to compensate types of damage not covered under the PLD (e.g. immaterial damage not resulting from personal injury or damage to consumer property, damage caused by discrimination, etc.). Beyond this, for persons having suffered harm caused by AI systems the objective of the AI White Paper is that these victims have the same level of protection as persons having suffered harm caused by other technologies. Both impact assessments together look at all three pillars of liability (fault based liability, PLD, strict liability, see 1.2.) in a holistic way. As a result, for all three pillars of liability the victims should not have less routes to compensation than for harm caused by other technologies. For those two reasons, the measures examined in the impact assessment on the PLD review and the PO defined in this impact assessment present a synergetic whole for damages caused by AI-systems. (b) Impacts of problems under the baseline scenario - Market barriers linked to legal uncertainty and fragmentation (problems 1 and 2): It is likely that at least some MS will adapt their respective liability rules under the baseline scenario. Depending on their respective approaches, this may increase legal certainty to a varying extent. However, legal uncertainty would not be addressed in a systematic and coherent manner across the internal market. In those MS that will not adopt general legislative measures, only ad hoc judicial solutions will emerge, based on a case-by-case interpretation of existing liability rules. Affected businesses, in particular SMEs, are therefore likely to continue facing most of the costs of legal uncertainty described under 2.6. In addition, the national legal or case-law solutions reacting to AI specific challenges would increase the level of legal fragmentation, which would lead to higher costs for companies operating cross-border. With the expected roll-out of increasingly autonomous, opaque and complex AI-systems over the coming years, AI will be implemented in ever more sectors of the economy and society. It is therefore highly likely that damages and ensuing liability claims involving AI-systems will become more frequent, and the economic relevance of the liability-related problems will increase under the baseline scenario. It was estimated that the total value of the EU27 market shares affected by those problems will increase almost seven- to ten-fold between 2021 and 2025 (from between EUR 1.739 billion to EUR 4.973 billion to between EUR 10.204 billion and EUR 21.342 billion. The market shares affected by legal uncertainty and fragmentation were determined by a sector-by-sector analysis in the economic study, taking into account the current and forecast take-up rate of AI-enabled technologies, the percentage of companies perceiving liability as a barrier to AI adoption and the ability of the AI applications deployed in the respective sector (now or in the foreseeable future) to cause harm and thus give rise to liability claims. For all of these factors, the study made reasoned assumptions based on data from the aforementioned representative company survey on AI, relevant individual stakeholder feedback as well as a detailed market analysis. The size of the market shares affected by legal uncertainty and fragmentation provides an indication of the order of magnitude of the economic relevance of the problems to be addressed by this initiative. This indicator is not intended to provide a precise quantification of the economic impact of the legal uncertainty and fragmentation. Such quantification proved impossible due to a lack of data, as the AI-enabled products and services affected by the initiative are in the early stages of rollout or not yet on the market. It is also acknowledged that the factors and assumptions supporting these estimates are to a certain extent uncertain, as they reflect uncertain projections on future technological and market development. In particular, the assumption that the size of the market shares affected by legal uncertainty and fragmentation will increase proportionally to the increase in the overall size of the AI market depends on a number of yet unknown factors, such as the extent to which revised safety rules will decrease the instances of harm caused by AI and possible advances in the field of explainable AI. Taking into account that the increasing degree of complexity and behavioural autonomy of AI systems is likely to exacerbate the problems to be addressed by the AI liability initiative, and that MS will over time become increasingly likely to adapt their liability rules unilaterally in the absence of EU action, the assumption of a proportional increase of the market shares affected by legal uncertainty and fragmentation appears conservative. In any case, a maximum of robustness is ensured by a allowing for a wide bracket between the high and low estimates, which can accommodate differing market definitions and future developments. - Lack of compensation for victims leading to a lack of societal trust and hampering take-up by consumers (problem 3): In those MS that adapt their liability frameworks to the challenges of AI, claims for compensation could become similarly effective as in cases where no AI-technologies are involved. However, in those MS which will refrain from adapting liability rules reacting to AI specific challenges during the coming years it will often be prohibitively difficult or even impossible for victims to claim compensation. Over the course of the baseline period, the increasing prevalence of AI-systems in more and more sectors of the economy and society will mean more accidents and more liability claims that are likely to be attract significant media attention. This will drive consumers’ awareness of liability-related issues. As confirmed by dedicated behavioural research, persisting – and increasingly mediatised – safety concerns will in turn also contribute to a lack of societal trust in AI. Thus, liability-specific issues, if not addressed consistently at EU level, are expected to have a significant negative effect on societal trust and the uptake of AI. That is because lack of trust means less willingness to engage with the technology. Delayed or reduced uptake of AI-technologies in the internal market will affect all companies in the AI-value chain. It will also lead to reduced or delayed benefits of AI for the society. The practical consequence of this situation is both unfair and economically inefficient. On the one hand, certain risk-takers that benefit from integrating AI into their activities will be able to externalise to the victims the costs linked with the use of AI. On the other hand, victims – be they natural persons or companies – will be burdened with costs that they have no means to prevent. The liability framework would thus fail to fulfil its functions of preventing unwanted behaviours and ensuring an efficient cost allocation of risks.

Persistent liability gaps are also likely to frustrate, to some extent, the White Paper objective of ensuring the safety of AI for the benefit of all EU citizens, as liability rules will not incentivise potentially liable persons to prevent accidents. (c) The relevance of liability-specific problems given the AI Act, MPR and General Product Safety Regulation The legislative proposals (in particular the AI Act and MPR) were also adopted as Commission’s follow-up to the AI White Paper to address specific problems of AI and they pursue the same overall objective as the present initiative. These proposals introduce requirements to be met before AI systems placed on the market, to reduce safety risks and breaches of fundamental rights. They also provide for monitoring of how these systems operate in practice and reporting of incidents.. These provisions reflect that there is no absolute safety, only a level of accepted risk. The impact assessments accompanying the proposed AI Act, MPR and General Product Safety Regulation indeed conclude that these initiatives will reduce accident rates, while quantified estimates of the expected safety gains regarding AI-enabled products or services in particular are not available. It is therefore assumed, albeit only in qualitative terms, that safety levels will increase during the baseline period, an assumption that has been incorporated in this impact assessment. Hence, it is certain that these proposals, while reducing the risk for accidents, will not exclude harm caused by AI systems. The AI liability initiative will deal only with those accidents happening once the AI Act and other relevant safety legislation are adopted and applied. Once adopted, the requirements that market players (e.g. professional users) have under the AI Act could inform the standard of care that courts will have to assess in liability claims against them. Similarly, the information to be documented/logged pursuant to the AI Act could be used in liability claims, to the extent victims could have access to such evidence under various national laws. However, in line with the staged approach of the Commission’s AI policy, and the complementary nature of safety and liability rules, the provisions of the AI Act and the MPR are not designed to address the problem drivers and problems tackled by this initiative. Their provisions are not designed to clarify how liability rules should apply to AI and to facilitate the individual compensation of victims of harm. This means that, under the baseline scenario, the liability situation will remain subject to the same challenges as explained above. The Commission aims to address these challenges and achieve synergies between these proposals and the envisaged civil liability related measures (see s.1.3. and 2.8 and Annex 7). 5.2. Description of the policy options Legal instrument for implementing the PO: Each of the PO could be implemented either by a binding legislative instrument or by a non-binding recommendation addressed to MS to implement the preferred measures in their national law. The approach for selecting the suitable instrument is set out in Chapter 6. (a) PO1: Easing the burden of proof for AI-related claims Description: The problems are primarily linked to the difficulty of the victim to prove the necessary facts due to the specific characteristics of certain AI systems. This PO would help the victim to handle its burden of proof in a way that justified liability claims can be successful. PO1 would involve three complementary measures. Two of these – (i) and (ii) – are closely aligned with the approach and duties set by the AI Act. Definitions of the AI Act (AI-system, provider, user) would be taken over to ensure consistency. None of these two measures would involve the introduction of any new risk categories; the risk-categorisation of the AI Act would be mirrored. They would be fully compatible with the confidentiality safeguards included in the AI Act. Measure (iii) would not involve any differentiation according to the risk profile of AI systems. None of the measures of PO1 would provide for any substantive obligations regarding the development or use of AI systems. PO1 would not define either what constitutes in national law ‘fault’ or ‘causality’. MS would be able to fit provisions into their national liability regimes without disrupting their legal traditions. (I)The disclosure, for liability claims, of information that the user or provider of a high-risk AI has to record or document pursuant to the AI Act. Obtaining information recorded or documented pursuant to the AI Act could help the victim to make a successful liability claim. For instance, it could help to provide evidence for demonstrating fault as one of the conditions of liability to be proven by the victim. This could be done for example by proving that the liable person did not comply with their obligations under the AI Act. Example: A highly autonomous cleaning robot causes harm (cf. example under 2.2. and Annex 12). The victim claims compensation from the company operating the cleaning robot. For the purpose of the AI Act, this company is the ‘user’ of the robot’s AI systems. Access to relevant parts of the technical documentation (Annex IV of the AI Act), e.g. the instructions of use, would show the victim what the user was required to do to prevent such accidents. For example, the user may be required to ensure human oversight. The user might also be required to ensure that the AI systems are only used in certain operational environments (e.g. geographical and meteorological conditions, etc.). This information can help the victim to establish that the liable person has not complied with such requirements and therefore committed a fault. According to this measure, the victim could request from the possibly liable party the disclosure of such information concerning the victim’s claim. The competent national court could order that such disclosure would be subject to stringent safeguards to ensure proportionality and protect the legitimate interests of all parties concerned, for instance confidential information, intellectual property rights and trade secrets. If the possibly liable person does not disclose the information, the victim would benefit from a presumption that the facts, which the withheld information might have proven actually, did occur. Such presumption would facilitate the burden of proof of the victim. The liable person would have the opportunity to rebut the presumption. This means that the liable person would have the opportunity to prove that the presumed facts did in reality not occur. That person could also avoid liability by refuting any of the liability conditions set by the applicable liability rules, for instance demonstrate that the relevant AI system was carefully selected and used, taking into account the requirements of the AI Act.

Example: In the cleaning robot example, the victim requests access to the data recorded during the operation of the cleaning robot in order to prove that the robot’s sensors were not properly cleaned at the time of the accident. The competent court can order necessary safeguard measures to ensure that all legitimate confidentiality interests are protected. If the company responsible for operating the cleaning robot (= the possibly liable party) nevertheless does not disclose this information, the victim could claim and the court would presume for the purposes of the victim’s liability claim that the sensors were not properly cleaned. This may constitute a fault of the liable party. However, the liable party could rebut the presumption by showing that the sensors were actually clean. It could also avoid liability in other ways, e.g. by showing that there is no causal link between the presumed failure to clean the sensors and the damage. This measure would not only help the victim. Providers and users of AI systems would be given an additional incentive to comply with the documentation/logging requirements of the AI Act. If they had complied, they could disclose the information (subject to necessary confidentiality safeguards) and would be able to demonstrate that they acted in accordance with legal requirements. This additional incentive would support the compliance with the AI Ac