Updated 2 November 2026: the EU Directive makes software a product; AI systems appear in a recital, not in the definition. It applies only after 9 December 2026 and does not cover discrimination or pure economic loss, so the hiring example no longer stands as it did. Its proof rule is a rebuttable presumption, not a reversal of the burden. The statement that Turkish hazard liability covers only physical harm has been corrected. Withdrawn: "1.7 trillion parameters", the "prevailing view in Turkish scholarship" and a mistranslated Latin maxim.

Correction (19 October 2026): This article originally said the EU was introducing a presumption of causality through the draft AI Liability Directive (AILD); the Commission withdrew that proposal in 2025, and the passage now describes the presumptions in the revised Product Liability Directive.

An algorithmic error does not by itself trigger strict liability in the EU, the US or Türkiye. Everything depends on a prior question: does the law treat the system as a product, as a service, or as a dangerous enterprise? This article looks at the difference between fault and strict liability, the US debate over whether software is a product, the EU's new directive and Article 71 of the Turkish Code of Obligations (TBK).

1. Background: fault, and the way round it

1.1. Why fault-based liability struggles

The default rule is fault. Under TBK Articles 49 and 50, the person harmed must prove the wrongful act and the fault. An algorithm can cause harm without any coding error in the ordinary sense: the system may simply draw a harmful result from statistical patterns in its data. Developers can then say that no one was careless, and a claimant who cannot see inside a closed model will struggle to prove otherwise.

1.2. Strict liability as an alternative

Strict liability removes the need to prove fault. Turkish law applies it to specific risks: operators of motor vehicles (Highway Traffic Law, Article 85), nuclear operators (Law No. 7381, Article 12) and those who pollute the environment (Environmental Law, Article 28). The question is whether self-learning, high-risk systems belong in that group.

A strict regime is not liability for everything. A product claim still needs a defect, and a hazard claim still needs a qualifying enterprise. Both need a causal link.

2. Legal frameworks: product, service or enterprise?

2.1. United States: no settled line

In US law, strict product liability depends on there being a "product". Both decisions below refer to section 19 of the Restatement (Third) of Torts: Products Liability, which is built around tangible personal property. They show how open the question is for AI and algorithms:

These are two rulings on particular facts, not a national rule. Garcia concerned a pleading motion, and neither decision addresses software embedded in hardware. An earlier version of this article said US courts "have begun" treating embedded algorithms as products and gave a road-atlas example. We could not support either from a source we could open, so both have been removed.

2.2. European Union: software becomes a product

Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive. Article 4(1) defines "product" to include software. Recital 13 names AI systems as an example of software and treats AI system providers as manufacturers. It adds that information is not a product, so the rules do not apply to the content of digital files or to mere source code. Further points matter here:

  • Timing. It applies to products placed on the market or put into service after 9 December 2026 (Article 2(1)). Older products stay under the old directive (Article 21).
  • Damage. Only death, personal injury including medically recognised psychological harm, property damage and loss of non-professional data qualify, and only natural persons can claim (Articles 5 and 6). Recital 24 says pure economic loss, privacy infringements and discrimination do not by themselves trigger liability. A candidate wrongly screened out by a hiring tool will usually have to look elsewhere.
  • Proof. The claimant must prove defect, damage and causal link (Article 10(1)). Where technical or scientific complexity makes this excessively difficult and the claimant shows it is likely, the court presumes defect or causation (Article 10(4)). The defendant can rebut it (Article 10(5)). This eases the burden rather than reversing it.
  • Learning. The ability to keep learning after the market is one of the factors for assessing defectiveness (Article 7(2)(c)).
  • Defence. The state of scientific and technical knowledge can excuse the manufacturer (Article 11(1)(e)). Member States have limited room to remove this defence (Article 18). This is the defence closest to "the algorithm reached this on its own".
  • Open source. Free and open-source software developed or supplied outside commercial activity is excluded (Article 2(2)).

The result is no-fault liability for defective software, not liability for every error. A separate AI Liability Directive, proposed in 2022, would have added presumptions for fault-based claims. The withdrawal was published on 6 October 2025. The AI Act sets safety duties but creates no damages regime; after Regulation (EU) 2026/1744 its high-risk duties start on 2 December 2027 or 2 August 2028, depending on the system.

2.3. Türkiye: TBK Article 71

Article 71 of the TBK says that where harm arises from the activity of an enterprise that poses a significant hazard, the owner of the enterprise and any operator are jointly liable. An enterprise qualifies if, given its nature or the materials, tools or forces used, it is apt to cause frequent or serious harm even with all the care expected of a specialist. Special hazard rules remain in place. Even where the law permits the activity, those harmed can ask for fair compensation.

Whether a business running a high-risk AI system meets this test has not, as far as we could find, been decided by the Court of Cassation, though we did not make a full search of the case law. An earlier version of this article reported a "prevailing view in Turkish legal scholarship"; we had no source for that, so it has been removed. Two things can be said from the text. The test looks at the enterprise and the frequency or gravity of harm, so a shopping recommendation system would be hard to fit and a surgical robot easier. And the text does not limit the type of harm.

Türkiye also has a statutory product rule: under Article 6 of Law No. 7223, the manufacturer or importer answers for harm from a product. The definition of product does not mention software.

2.4. The spectrum in brief

  • Fault-based liability: the current default. The claimant proves fault (TBK Articles 49 and 50).
  • Defect-based, no-fault liability with presumptions: the EU, for products placed on the market after 9 December 2026. The claimant proves a defect or relies on a presumption. Fault is irrelevant.
  • Hazard liability: no defect needed. It applies to qualifying enterprises in Türkiye. In the EU it was proposed for high-risk AI by the European Parliament in its resolution of 20 October 2020, and it was not adopted.

3. What strict liability could mean for the industry

Subjecting algorithmic errors to strict liability would have economic effects as well as legal ones. These are reasoned concerns, not measured results.

  • Small firms. A single large claim could hurt a start-up far more than a large company. The EU Directive partly addresses this in Article 12(2), which lets a manufacturer integrating software from a micro or small enterprise waive recourse by contract.
  • Open source. Liability for downstream uses could discourage open release. The EU has already drawn a line: besides the Directive's Article 2(2), Article 2(12) and Article 53(2) of the AI Act contain limited open-source exceptions.
  • Defensive design. Developers may limit what their systems do in order to reduce exposure. Whether this happens, and whether it is good or bad, depends on the system.

4. Conclusions

None of the three systems examined here imposes strict liability on every high-risk algorithm as such. The EU has chosen defect-based liability. The US is working it out case by case. Türkiye has a general hazard clause that has not been tested on AI, as far as we could find. Any wider regime would have to come with a way of paying for it: a compensation pool or insurance is discussed in our article on AI liability insurance, and the medical setting in our article on misdiagnosis. The guide to AI agent liability applies these rules to agents.

Burhan Doğuş Ayparlar's View

Trying to fit AI harm into the traditional framework of product liability shows how poorly the concepts fit the technology. A microwave oven does not change after sale, whereas a system that keeps learning can. The EU has recognised this by making learning a factor in assessing defects, but the development-risk defence and the limits on damage leave real gaps.

Errors by high-risk algorithms should be assessed under strict (hazard) liability. Companies that release these systems knowingly accept the risk of unpredictable results and earn profits from it. The cost of an algorithmic system's statistical errors should fall on the company that put the system on the market, not on people who know nothing about it.

Turkish law should be updated on this point. As I read it, our traditional hazard liability is concerned mainly with physical dangers such as explosions and poisoning, even though the text of TBK Article 71 is not limited to them. AI can create digital, economic and psychological harm: it can unfairly deny someone a job, lower a credit score or damage a reputation through deepfakes. Türkiye should develop a new concept of digital hazard liability, back it with compulsory insurance and place the burden of proof entirely on the AI provider. This is a proposal for the legislator, not a statement of current law.

Sources (checked 2 November 2026): Turkish Code of Obligations No. 6098, Highway Traffic Law No. 2918, Environmental Law No. 2872 and Laws Nos. 7223 and 7381 (consolidated texts, mevzuat.gov.tr); Directive (EU) 2024/2853, Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 and OJ C/2025/5423 (Official Journal copies); European Parliament resolution P9_TA(2020)0276 (OJ copy); Rodgers v. Christie, No. 19-2616 (3d Cir. 2020); Garcia v. Character Technologies, No. 6:24-cv-1903, Doc. 115 (M.D. Fla. 2025). Restatement section 19 is described as quoted in Rodgers and Garcia; we could not open the Restatement itself. The settlement notice is described from our decision summary and press reports; we could not open the docket. Turkish case law was not searched in full. General information, not legal advice.