Commentary. Artificial-intelligence policy is entering a consequential phase. Regulators are no longer debating whether AI needs oversight; they are deciding how much responsibility should fall on developers, deployers and the institutions that use these systems. Our view is that the next generation of rules should be judged less by its ambition on paper than by whether ordinary people can obtain a remedy when AI causes harm.
Recent developments point in that direction, but not yet far enough. The UK Law Commission has proposed extending product-liability rules to AI systems, while the European Commission is consulting on procedures for investigating and penalising certain providers under the EU AI Act. In financial services, the UK Financial Conduct Authority has published examples of good and poor AI practice, and Singapore’s Monetary Authority has issued risk-management guidelines covering generative AI and autonomous systems.[Source]
These measures share a sensible premise: companies should not be able to present AI as an inscrutable force of nature. If an automated system rejects a loan, misidentifies a person, exposes confidential information or acts beyond a customer’s instructions, the affected person needs to know who is responsible and what evidence can be challenged.
The case for stronger accountability
Voluntary promises have not solved that problem. AI systems are trained and deployed through long chains of vendors, contractors and users. That complexity can become a shield: the model maker blames the integrator, the integrator blames the customer, and the customer blames the software. Liability rules can change those incentives by requiring firms to document decisions, test systems, monitor failures and preserve records.
The financial sector illustrates why this matters. The FCA has warned that frontier AI with cyber capabilities may accelerate vulnerability discovery faster than firms can respond. Singapore’s guidelines likewise call for governance, risk assessment, lifecycle controls and oversight of third parties, with implementation phased from 2027.[Source] [Source] These are not abstract concerns. Banks and insurers make decisions at scale, and a small error rate can affect thousands of people.
The counterargument is real
There is a legitimate risk of overregulation. Start-ups cannot absorb the compliance budgets of global technology companies. Vague duties could encourage defensive innovation, push development into less transparent jurisdictions and make organisations abandon useful tools in health care, education or public administration. Businesses also need clear technical standards, not a patchwork of overlapping national rules.
Those objections should shape the rules, but they should not erase accountability. Proportionate regulation can distinguish between a low-risk drafting assistant and a system that determines access to housing, employment, credit or essential services. Regulators can provide sandboxes, model documentation and safe harbours for firms that meet credible standards. They can also coordinate internationally rather than forcing every company to interpret conflicting regimes.
What effective rules should require
- A named accountable organisation for every high-impact deployment.
- Independent testing before and after release, including tests for discrimination, cyber risk and misuse.
- Accessible explanations and human review when an automated decision materially affects a person.
- Mandatory incident reporting and preservation of logs sufficient for meaningful investigation.
- Compensation mechanisms that do not require individuals to prove the inner workings of a proprietary model.
Europe’s debate shows the stakes. Members of the European Parliament have called for international action and criticised the loss of a dedicated AI Liability Directive, while discussions continue over whether existing product-liability rules are enough.[Source] The answer should not be another symbolic declaration. It should be a legal route through which a person harmed by an AI-assisted decision can obtain an explanation, correction and, where appropriate, compensation.
Innovation does not depend on the absence of rules. It depends on trust. The companies most confident in their systems should welcome measurable obligations, because transparent safeguards distinguish durable products from reckless experiments. Policymakers should resist both technological panic and regulatory theatre. The fair test is simple: when an AI system fails, does the public know who must answer for it?