Who Answers When the Algorithm Errs? AI and the Dilemma of Responsibility

In March 2018 a self-driving test car operated by Uber struck a woman crossing the road in Arizona, and she died. Who was responsible? The answer of the US National Transportation Safety Board (NTSB) was not a single name.

What did the investigators find?

The system detected the woman about 5.6 seconds before impact but “never accurately classified her as a pedestrian or predicted her path”, and its design did not allow emergency braking, relying instead on the driver to intervene. The Board concluded that the probable cause was the test driver's failure to monitor the road, as she was distracted by her phone. It counted the “inadequate safety culture” of Uber's self-driving unit as a contributing factor, as well as the weak oversight of the state transport department over testing such vehicles, and it noted other factors. The example shows the point: it was not the algorithm alone, nor one person alone, but a network of decisions.

Why is the old way of accounting hard?

The law is used to distinguishing liability based on a fault attributed to an actor from liability for a defective product or a thing in someone's custody. Intelligent systems are built on data collected by one party, trained by a second, tuned and sold by a third, and used by a fourth in a context no one foresaw. When harm occurs, each party points to another, and the injured party struggles to prove a causal chain beyond their means to trace. The problem grows because an algorithmic error repeats at scale with the same decision, so its effect exceeds that of a single judge or employee in one case. (See the article “Algorithmic Bias” for examples of repeated injustice.)

What do the laws do?

It is not enough to ask whom to blame after harm occurs; it is better to prevent it. The European Union's AI Act follows a risk-based approach: it bans unacceptable practices such as social scoring, and requires high-risk systems to have risk management, data governance, logging, and a design that allows human oversight. After the amendments of the 2026 “AI Omnibus”, the application of high-risk obligations for the Annex III list was postponed to 2 December 2027, so the implementation picture is still taking shape.

On the compensation side, the Product Liability Directive (2024/2853) recognises software as a product and establishes strict liability. It presumes defect or causation, rebuttably, where the injured party cannot prove because of technical complexity or the defendant refuses disclosure, and it requires states to transpose it into their laws by 9 December 2026.

In the Kingdom

Saudi Arabia's Personal Data Protection Law took effect on 14 September 2023, with a compliance period extending to September 2024. For automated processing that makes decisions it requires additional transparency, explicit consent and an impact assessment. In September 2023 the Saudi Data and Artificial Intelligence Authority (SDAIA) issued its seven AI ethics principles, among them fairness, transparency and explainability, and accountability and responsibility.

Five questions before deploying an influential system

First: who is the person responsible for reviewing the decision, and can he halt it? Second: can the system explain its decision in language the injured party and the judge understand? Third: are logs kept to allow tracing? Fourth: has there been independent audit before and after deployment? Fifth: how is the injured party compensated quickly even before the wrongdoer is determined? On the last, the competent authorities may consider forms of cooperative insurance or guarantee funds, consulting specialists on their Sharia requirements.

None of this means halting innovation for fear of its consequences, for errors occur in all human and machine work. What matters is that every influential system has an accountable steward and a path to redress, and that we rely on God after taking the means.