Who is responsible when an artificial intelligence system causes harm? Is it enough for a company to purchase an AI solution from a trusted provider, or does it also have its own responsibilities regarding the security and use of that system? These questions were discussed during the panel “The AI Act in Practice: Who Is Really Accountable for Your AI?”, held on 2 November at AI Expo Europe 2026 in Bucharest.
The National Institute for Research and Development in Informatics – ICI Bucharest contributed to the panel with a presentation on legal liability for AI systems, the importance of procurement policies, and the risks organisations need to manage when adopting these technologies.
A key point of the intervention concerned the new EU Product Liability Directive, which covers software, AI systems and their components. The Directive provides for strict liability for damage caused by defective products and, under certain conditions, introduces legal presumptions regarding the existence of a defect and the causal link between that defect and the damage caused. However, determining liability in cases involving cyberattacks on critical infrastructure is more complex and depends on the circumstances of each incident.
Another topic addressed by the ICI Bucharest representative was the role of AI procurement policies in both the public and private sectors. A well-planned procurement process involves more than selecting a supplier and assessing costs. Organisations also need to consider system security, testing procedures, relevant certifications, and training for employees who will use these technologies.
However, the risks are not limited to officially procured systems. Employees may use AI tools that have not been approved by their organisation, sometimes entering internal information into external applications or relying on AI-generated outputs without verifying them. Such practices raise security and data protection concerns, as well as questions about organisational responsibility. Internal policies and staff training are therefore important for preventing incidents, while liability assessments may also consider whether reasonable preventive measures were in place.
AI Expo Europe 2026 brought together representatives of public authorities, technology companies, and experts from the legal and research communities to discuss the practical challenges of AI adoption and implementing European regulations.