What is AI accountability?

    AI accountability means a named person answers for each AI system, can explain what it did, and carries the consequences when it causes harm. Who is liable, how duties split across the AI value chain, and how accountability is evidenced.

    AI accountability means that for every AI system, a named person or body can be identified who must answer for how it behaves, explain and justify its outcomes, and carry the consequences and provide remedy when it causes harm. It appears in every major AI framework and is among the hardest principles to evidence.

    Answerability, responsibility, liability

    The term is used loosely. It has three parts, and a program needs all three.

    • Answerability. Someone can be required to explain what the system did and why, to a customer, an auditor, a regulator or a court. This depends on transparency and, for individual decisions, explainability.
    • Responsibility. A named person owns the system: approves it, funds it, monitors it and can switch it off. A department is not an owner. A committee is not an owner.
    • Liability. Someone bears the consequences, whether regulatory penalties, damages or reputational cost, and has to provide remedy to the person harmed.

    The OECD AI Principles (principle 1.5) frame accountability as AI actors being accountable for the proper functioning of AI systems, with traceability of datasets, processes and decisions so outcomes can be analyzed and challenged. Traceability is often underweighted in practice. If a decision cannot be reconstructed, nobody can answer for it.

    Case law: "the algorithm did it" is not a defence

    Two cases are the most frequently cited on the basic question.

    Moffatt v. Air Canada (2024 BCCRT 149, 14 February 2024). Air Canada's website chatbot told a grieving customer he could claim a bereavement fare retroactively, which contradicted the airline's actual policy. Air Canada argued the chatbot was "a separate legal entity that is responsible for its own actions." The BC Civil Resolution Tribunal called that a "remarkable submission" and held the airline responsible for all information on its website, chatbot included. The award was $812.02 in total. The principle has been widely cited since.

    Mobley v. Workday (N.D. Cal.). A job applicant alleged that Workday's AI screening tools discriminated on age, race and disability. In July 2024 the court allowed the case to proceed on the theory that Workday could be liable as an agent of the employers using its tools. In May 2025 it preliminarily certified a nationwide collective under the Age Discrimination in Employment Act, and as of October 2026 the litigation is continuing. For vendors, the case shows accountability can travel up the supply chain. Employers remain responsible for the hiring decisions.

    US regulators take the same view of deployers. In December 2023 the FTC banned Rite Aid from using facial recognition for surveillance for five years. The finding was that it deployed a vendor's technology without reasonable safeguards, testing or monitoring.

    Accountability across the AI value chain

    Most organizations deploy AI they did not build. That makes the split of duties the central accountability question.

    • Providers (those who develop a system or have it developed and place it on the market under their name) carry the design-side duties under the EU AI Act. For high-risk systems these include risk management, data governance, technical documentation, logging, accuracy and robustness, and a quality management system. Article 17(1)(m) requires that system to include an accountability framework setting out the responsibilities of the management and other staff.
    • Deployers (those using a system under their authority) carry the use-side duties in Article 26. They must use the system according to its instructions, assign human oversight to people with the necessary competence, training, authority and support, monitor operation, keep automatically generated logs for at least six months, and inform workers and affected people where required. Public bodies and certain private deployers (for example in credit scoring, and in risk assessment and pricing for life and health insurance) must complete a fundamental rights impact assessment under Article 27.
    • Deployers can become providers. Under Article 25, a distributor, importer or deployer becomes the provider of a high-risk system if it puts its own name or trademark on it, makes a substantial modification, or changes its intended purpose so that it becomes high-risk. A common example is repurposing a general chatbot for candidate screening.
    • General-purpose model providers have their own documentation and transparency duties, applicable since 2 August 2025 and enforceable by the Commission since 2 August 2026. They must give downstream providers enough information to meet their own obligations. Deployers should request that information and review it.

    As of October 2026, the Annex III high-risk obligations apply from 2 December 2027, after the 2026 Digital Omnibus (Regulation (EU) 2026/1744). The deferral gives time to build the accountability structure. It does not change who it attaches to.

    Contracts allocate cost, not duty. A vendor indemnity can reimburse a fine. It cannot answer a regulator's questions, reverse a wrongful decision or discharge the deployer's obligations to the people affected. Contracts should still require notice of model changes, access to documentation and test results, incident notification, audit rights and cooperation with regulators.

    Liability law by jurisdiction (status as of October 2026)

    • European Union. The proposed AI Liability Directive was formally withdrawn. The notice was published in the Official Journal on 6 October 2025, citing no foreseeable agreement. The revised Product Liability Directive (EU) 2024/2853 will apply from 9 December 2026. It brings software, including AI systems, explicitly within strict product liability and eases the burden of proof for claimants facing technically complex products. For AI providers selling into the EU, it is the main civil liability route.
    • Canada. There is no federal AI statute. The Artificial Intelligence and Data Act died with Bill C-27 in January 2025, and the June 2026 national strategy, AI for All, promises new legislation. Bills C-36 (privacy reform replacing PIPEDA) and C-34 (online safety, including AI chatbot duties) were tabled in June 2026 and, as of October 2026, are not law. Accountability still comes from existing law. PIPEDA's first fair information principle is Accountability and requires a designated individual answerable for compliance. Quebec's Law 25 adds automated-decision duties. For the federal government, the Directive on Automated Decision-Making was amended on 24 June 2025 to strengthen senior-level accountability, and existing systems had until 24 June 2026 to comply. For federally regulated financial institutions, OSFI's Guideline E-23 applies to all models, AI included, from 1 May 2027.
    • United States. There is no federal AI liability statute, and federal policy is pushing back on state laws (Executive Order 14365, December 2025; DOJ AI Litigation Task Force formalized 9 January 2026). Accountability comes through existing law: anti-discrimination, consumer protection (the FTC Act), credit (ECOA and FCRA) and product liability. After a federal magistrate judge's order in xAI v. Weiser (27 April 2026) barred enforcement of Colorado's 2024 AI Act pending a preliminary-injunction ruling, the state repealed that Act before it took effect and re-enacted a narrower automated decision-making law, SB 26-189, signed on 14 May 2026 and operative from 1 January 2027.

    Mechanisms that make accountability real

    A principle becomes a control when it produces evidence. These are the mechanisms, roughly in the order a program should build them.

    • An inventory with a named owner per system. One person, by name. A system without an owner is the finding. See board oversight for how this reaches directors.
    • Decision rights. Who may approve a new AI use, who may accept residual risk, and who may switch a system off. Write them down before the first incident, not during it.
    • Assessments before deployment. Risk assessment for every system, impact assessment for systems that affect people. NIST AI RMF GOVERN 2 requires documented roles, responsibilities and lines of communication, and executive leadership taking responsibility for risk decisions. ISO/IEC 42001 Annex A control A.3.2 requires AI roles and responsibilities to be defined and allocated.
    • Traceability. Logs that let a specific decision be reconstructed later: input, model version, output, human action. Without them, answerability is a guess.
    • Human oversight with authority. Oversight only counts if the reviewer can change the outcome. See human-in-the-loop.
    • Contestation and redress. A channel for affected people to challenge a decision, staffed by someone able to reverse it, with outcomes recorded.
    • Independent assurance. Periodic review by someone outside the team that runs the system. See AI audit.
    • Consequences. Findings that lead to change, owners held to their commitments, and decisions to stop a system that actually stop it.

    Where accountability breaks

    • The many-hands problem. Data science built it, IT runs it, the business uses it, procurement bought it, and each believes another function owns the risk. The fix is organizational, not technical: one named owner with authority across the functions.
    • Third-party models. The largest and least understood category. The organization cannot inspect the model, the provider can change it without notice, and the contract rarely says what happens then.
    • Agents. Systems that take actions such as sending emails, executing transactions or changing records stretch accountability further, because the decision and its effect can happen before any human sees either. The deploying organization is accountable for what its agents do. Permissions and limits should be designed on that basis.
    • Accountability theatre. A responsible-AI committee that meets, minutes and never stops anything.

    The NTIA view

    The US National Telecommunications and Information Administration's AI Accountability Policy Report (March 2024) framed accountability as a chain: information flows (documentation and disclosure) feed independent evaluation (audits and red-teaming), which feeds consequences (liability, regulation, market pressure). Break any link and the chain fails. It remains a useful diagnostic for internal programs, whatever the current federal policy direction.

    For the program this sits inside, see what is AI governance? and what is an AI strategy?. For the oversight control, see human-in-the-loop. For how accountability is tested, see AI audit. For current litigation, see AI lawsuits.

    Sources and references

    Frequently asked questions

    What is AI accountability?

    AI accountability means that for every AI system a named person or body can be identified who must answer for how it behaves, explain and justify its outcomes, and carry the consequences and provide remedy when it causes harm. It combines answerability, responsibility and liability.

    Who is accountable when AI makes a mistake?

    The organization that deployed the system, in almost every case so far. In *Moffatt v. Air Canada* (2024), a tribunal rejected the argument that a chatbot was a separate entity responsible for its own statements. Vendors can share liability, and under the EU AI Act providers carry their own obligations, but deploying a third-party tool does not transfer accountability for its use.

    Is the AI vendor or the customer liable?

    Often both, for different things. The EU AI Act splits duties between providers and deployers, and a deployer that rebrands, substantially modifies or repurposes a high-risk system becomes its provider. In the US, *Mobley v. Workday* allowed discrimination claims against a vendor as an agent of its employer customers. Contracts allocate cost between the parties but do not remove regulatory duties.

    What is the difference between AI accountability and AI transparency?

    Transparency is disclosure: making it known that AI is used and how it works. Accountability is answerability: someone must justify the outcome and bear the consequences. Transparency is a precondition for accountability, because no one can be held to account for a system nobody can see, but disclosure alone holds no one responsible.

    How do you demonstrate AI accountability to an auditor?

    With artifacts: an AI inventory with a named owner per system, documented decision rights and approvals, risk and impact assessments, logs that let a decision be reconstructed, records of human oversight and overrides, incident and complaint records with outcomes, and evidence that someone with authority acted on findings.

    Does the EU AI Act require an accountable person?

    Indirectly but clearly. Providers of high-risk systems must run a quality management system that includes an accountability framework setting out management and staff responsibilities, under Article 17(1)(m). Deployers must assign human oversight to people with the competence, training and authority to carry it out, under Article 26(2).

    Share on LinkedIn