AI liability is no longer theoretical: what governance gaps actually cost

A hospital in Denmark deploys an AI triage tool that systematically underweights symptoms in elderly female patients. A bank in Singapore uses a credit-scoring model that proxies for ethnicity through postcode data. Neither organisation intended harm. Both face regulatory scrutiny, reputational damage, and, in one case, litigation. The AI worked exactly as designed. That is precisely the problem.

These are not edge cases anymore. Across industries, the gap between "we have an AI policy" and "we can actually account for what our AI does" is where governance failures concentrate. As AI systems become embedded in consequential decisions, that gap carries legal, financial, and strategic weight.

The regulatory landscape has moved past principles

For several years, AI governance meant publishing an ethics statement and forming an internal committee. That era is over. The EU AI Act, which began phasing in enforcement from 2025, classifies a significant number of commercial AI applications as high-risk, including tools used in hiring, credit, education, and medical triage. High-risk status means mandatory conformity assessments, human oversight requirements, audit trails, and registration in a public EU database. Non-compliance carries fines of up to 30 million euros or 6% of global turnover, whichever is higher.

In the United States, federal legislation remains fragmented, but the FTC, EEOC, and CFPB have all issued guidance or taken enforcement actions related to AI-driven discrimination and deceptive practices. The EEOC's 2023 guidance on AI in hiring (published as past guidance, still actively referenced in 2026 enforcement) made clear that employers cannot outsource liability to a vendor. If an AI screening tool has disparate impact on a protected class, the employer is responsible, regardless of who built the tool.

China's generative AI regulations, effective from mid-2023 and refined since, require service providers to conduct security assessments and register their models with the Cyberspace Administration. Japan and South Korea have developed their own frameworks. The direction across every major jurisdiction is the same: specificity, accountability, and penalties.

What has changed most sharply in the past eighteen months is enforcement. Regulators are issuing fines, not just warnings. Italy's data protection authority fined OpenAI (the vendor behind ChatGPT) in early 2024, a case that dragged through appeals into 2026, over GDPR-related data processing concerns. That action put every European organisation using third-party AI on notice that "our vendor handles compliance" is not a legally defensible position.

What this means for the AI user

The most common mistake organisations make is treating AI governance as a one-time procurement checklist. A vendor provides documentation. Legal reviews it. Procurement signs off. The tool goes into production. Two years later, the tool has drifted, the use case has expanded beyond the original scope, and no one has re-evaluated the risk profile.

Model governance is a continuous process, not a gate. AI systems behave differently as the data they process shifts over time. A fraud detection model trained on pre-pandemic transaction patterns will perform differently in 2026. That is not a hypothetical, it is a documented failure mode across the financial services sector. Governance programmes that lack scheduled re-evaluation cycles are only partially functional.

For practical purposes, this means several things for teams deploying AI:

• Understand what your vendor can and cannot tell you. If you are using a third-party model and cannot get documentation on training data sources, bias testing methodology, or performance across demographic subgroups, that is a risk signal, not an administrative inconvenience. Push for it in contract negotiations or factor the uncertainty into your risk assessment.
• Separate the "we built it" from the "we're accountable for it" question. Under the EU AI Act and analogous frameworks, deployers (the organisations putting AI into use) carry significant obligations, not just developers. If your HR team is using an AI recruiting tool built by a vendor, your organisation is the deployer and therefore holds accountability for its outputs.
• Document decisions, not just processes. Regulators and litigants want to see evidence that human oversight was meaningful, not performative. A log showing that a human "reviewed" 400 AI-generated credit decisions in forty minutes does not demonstrate oversight. It may actually demonstrate the opposite.
• Pay attention to second-order use cases. AI tools frequently get repurposed after initial deployment. A summarisation tool rolled out for meeting notes gets used for performance reviews. A customer service chatbot starts handling sensitive complaints. Each shift can move a tool into a higher-risk category without anyone formally reassessing it.

The liability exposure from these gaps is no longer abstract. IBM's Institute for Business Value (a vendor-affiliated research arm, so treat the specific numbers with appropriate caution) estimated in 2024 that organisations without mature AI governance frameworks faced materially higher costs when AI-related incidents occurred, whether through legal fees, remediation, or reputational impact on customer retention. Independent researchers at MIT Sloan have similarly documented that governance failures in AI correlate with larger-scale operational disruptions than comparably scoped failures in conventional software.

Concrete steps that reduce actual risk

• Commission an internal audit of every AI tool currently in production, including third-party ones. Categorise each by the EU AI Act risk tiers, even if your organisation is not based in the EU. Multinationals and companies with European customers or employees cannot opt out.
• Require vendors to contractually commit to providing bias evaluation reports and performance data disaggregated by relevant demographic variables. If a vendor cannot provide this, document that refusal as part of your risk register.
• Appoint a named individual with genuine authority, not just a title, who is accountable for AI governance outcomes. Diffuse accountability is functionally no accountability.
• Build re-evaluation triggers into deployment contracts: a specific date-based review, or a review triggered by any significant change in use case, user volume, or underlying model version.
• Run red-team exercises on high-stakes AI applications. This means deliberately trying to identify failure modes before regulators or claimants do.

Governance gaps in AI are not primarily a technology problem. They are a process and accountability problem, which makes them eminently manageable with the right structures in place. The organisations that treat this seriously now will spend considerably less time and money on it in three years than those that wait for a formal incident to force the issue.