AI and criminal law: who is liable when an algorithm causes harm?

Under Dutch and European law an algorithm cannot be criminally responsible, not even partly. Article 51 of the Dutch Criminal Code (Wetboek van Strafrecht, Sr) recognises only natural persons and legal persons as offenders, so the real question is which person or company is responsible for what the AI system did.

Dutch criminal law already answers that question through functional perpetration (functioneel daderschap) and corporate criminal liability. This article explains how those doctrines apply to AI, how the EU AI Act sets the standard of care, how algorithmic output is used as evidence and what a defence and compliance programme look like. For the supply-chain angle, see our companion article on who is responsible when a machine commits a crime.

Why can an algorithm not be a suspect?

A criminal offence requires conduct by a perpetrator who can be blamed, and an AI system has no will and cannot be punished. Article 51(1) Sr provides that offences can be committed by natural persons and legal persons; software is neither.

Sanctions such as imprisonment, a fine or a community sentence cannot be imposed on a model. Deleting a model punishes its owner, not the system. Everything criminal law wants to achieve after AI-caused harm must therefore be achieved through the people and organisations behind it.

Who is liable instead?

The operator, the company and its leadership. Dutch criminal law has two mechanisms for holding someone responsible for conduct they did not physically carry out, and both apply to AI without modification.

Functional perpetration

Under the test the Supreme Court (Hoge Raad) formulated in the IJzerdraad judgment, a person is the functional perpetrator if they had the power to decide whether the conduct took place and accepted it, or habitually accepted such conduct.

For AI, power of disposal is usually easy to prove: the operator can configure, retrain and switch off the system. Acceptance decides the case. The evidence concerns what the operator knew about failure modes, what testing and earlier incidents showed and what was done about it. Knowingly accepting a considerable risk is enough; that is the Dutch standard for conditional intent (voorwaardelijk opzet).

Corporate liability and de facto leadership

Where the operator is a company, Article 51 Sr applies. In the Drijfmest judgment (ECLI:NL:HR:2003:AF7938) the Supreme Court held that conduct can be attributed to a legal person if it took place in its sphere. Indicators are that the conduct was carried out by someone working for it, fits its normal business, benefited it, and that the company could control it and accepted it, including by failing to take reasonable care. An AI system deployed for the company’s work meets most of these indicators.

Article 51(2) Sr also allows prosecution of those who gave the order or de facto led the offence (feitelijk leidinggeven). In its judgment of 26 April 2016 (ECLI:NL:HR:2016:733) the Supreme Court held that a formal position is neither required nor sufficient. A passive role can be enough where the person was able and obliged to prevent the conduct, and at least knowingly accepted the considerable chance that it would occur. In an AI case the evidence is who received the validation report, who approved deployment and who accepted a known error rate.

Which offences are most likely?

Prosecutions involving automated systems usually rest on negligence. If an AI-driven vehicle, machine or medical device causes death, the offence is causing death by negligence under Article 307 Sr (up to two years’ imprisonment); for serious injury, Article 308 Sr.

Discrimination is the second category. Discriminating against people in the exercise of an office, profession or business on grounds such as race, religion, belief, sex or sexual orientation is an offence under Article 429quater Sr; intentional discrimination on grounds of race is a crime under Article 137g Sr. A model that systematically disadvantages a protected group can therefore become a criminal matter. Our guide to criminal procedure in the Netherlands explains how such a case runs.

How does the AI Act affect criminal liability?

The EU AI Act (Regulation (EU) 2024/1689) does not create criminal offences, but it writes down what a careful provider or deployer must do. A departure from that standard is evidence of negligence; compliance is evidence of care.

The Act sorts systems by risk. Some practices are prohibited, such as social scoring, untargeted scraping of facial images and emotion recognition at work or in education. High-risk systems include safety components of regulated products and uses such as recruitment, credit scoring, law enforcement, migration and the administration of justice. Systems that interact with people or generate synthetic content carry transparency duties.

Provider or deployer: which role do you have?

A provider develops a system and places it on the market under its own name; a deployer uses a system under its own authority. Providers carry the design obligations, deployers the duties of correct use, human oversight and monitoring.

A deployer becomes a provider if it puts its own name on a high-risk system, substantially modifies it or changes its purpose so that it becomes high-risk. Fine-tuning a purchased model and using it for a new purpose can move you across that line. In a criminal investigation the same question returns as: who had the power of disposal? Record the roles in writing and in the contract.

What already applies?

The prohibitions, the AI literacy duty, the rules for general-purpose AI models and the transparency obligations of Article 50 already apply. The digital omnibus (Regulation (EU) 2026/1744) postponed the obligations for high-risk systems. The proposed AI Liability Directive was withdrawn, so civil liability for AI harm remains a matter of Dutch tort and product liability law.

Fines under the Act are administrative: up to €35 million or 7% of worldwide annual turnover for prohibited practices, with lower ceilings for other breaches. In the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur) coordinate supervision. See our articles on prohibited AI practices, high-risk AI systems and our overview of the EU AI Act.

A prosecutor uses the Act as a checklist. If a deployer used a screening tool without checking training data for bias and without the required human oversight, the breach is documented and acceptance follows from the decision to deploy anyway. Conversely, a company that can produce its risk assessment, validation results, oversight protocol and incident log has built its defence in advance.

How is algorithmic output used as evidence?

Algorithmic output such as facial recognition matches, number plate recognition or fraud risk scores is not a separate category of evidence. Under Article 339 of the Code of Criminal Procedure (Wetboek van Strafvordering, Sv) evidence is limited to fixed categories, so the output reaches the court through written documents such as an official police report, or through an expert statement.

The defence tests three questions. Is the method validated, and by whom? Under which conditions does it fail, and were they present? And can the defence verify it, with access to information on training data, error rates and configuration? A match presented without an error rate or any possibility of verification is weak evidence, and challenging it is a legitimate defence.

The court can appoint an expert at its own initiative or at the request of the defence. Where an AI method falls outside any recognised field of expertise, that itself is an argument about reliability. The new Code of Criminal Procedure has been adopted and is planned to enter into force in 2029; until then the current Sv applies.

What does data protection law add?

Article 22 GDPR gives a person the right not to be subject to a decision based solely on automated processing that significantly affects them. In criminal enforcement, the Police Data Act (Wet politiegegevens) implements the parallel EU rules for the police. For a suspect this can be a route to information about a system; for a company, automated decision-making without a lawful basis is a separate breach that will be read alongside any criminal allegation.

How do you defend a case in which AI is involved?

The “black box” defence, that nobody could know what the system would do, is weaker than it looks. Dutch criminal law asks whether the defendant could decide whether the conduct took place and accepted the risk, not whether they foresaw the exact output; deploying an unexplainable system where it can cause serious harm may itself be accepting that risk.

Three defences work better, and all are evidential:

• No real control: the system was bought as a finished product, configured and maintained by the provider, and the defendant had neither the information nor the ability to intervene. This shifts attention to the provider and depends on the contract and what was reported.
• Due care: a documented risk assessment, validation before deployment, human oversight by someone with authority to override, monitoring and prompt action on incidents.
• Causation: in a chain from training data to model to human decision to outcome, the prosecution must prove that this defendant’s conduct caused the result.

Preserve logs, model versions, configurations and incident reports early, because they are routinely overwritten. The ordinary safeguards apply in full, including the right to remain silent under Article 29 Sv; see our article on the right to remain silent in criminal matters. For fraud with automated tools, see our guide to fraud and financial crime in the Netherlands.

What does the childcare benefits affair show?

The childcare benefits affair (toeslagenaffaire) shows how automated risk selection combined with unquestioned output can harm thousands of families without anyone being held criminally responsible. The Dutch Tax Administration (Belastingdienst) used risk classification in which nationality played a role; the Dutch Data Protection Authority found that processing unlawful and imposed a fine, and the government resigned in January 2021.

Three failures translate into legal exposure for any organisation: decisions could not be explained and so not challenged, human oversight existed on paper only, and a flag reversed the burden of proof in practice. That diffusion of responsibility is exactly what functional perpetration and Article 51 Sr are designed to counter, and why the AI Act demands identifiable human oversight and documentation.

What should you check as a company deploying AI?

Most compliance work under the AI Act also produces the evidence you would need in a criminal investigation.

• Have you listed every AI system in use, including features inside purchased software, and classified each under the AI Act?
• Is a named person responsible for each system, with authority to approve deployment and to switch it off?
• Is human oversight real: can the reviewer understand the output and reject it, and are overrides logged?
• Have you documented training data, testing, known error rates and decisions about them?
• Has a data protection or fundamental rights impact assessment been done where required?
• Do your contracts give you the provider’s technical documentation and incident notifications?

What should you check as a provider of AI systems?

As a provider you carry the design obligations and are first in line when deployers point up the chain.

• Is your intended purpose defined precisely in the instructions for use?
• Do you have technical documentation on data sources, bias testing and design choices?
• Have you disclosed known limitations and failure conditions to deployers in writing?
• Do you have a procedure for incident reporting and for informing deployers about substantial modifications?
• Does your contract set out which party may modify or retrain the system?

What if AI is used as a tool to commit an offence?

Then the offence is simply the offence; the technology does not change the legal analysis. Fraud with a cloned voice or a synthetic video of a director is fraud (oplichting) under Article 326 Sr; a generated false document is forgery under Article 225 Sr; posing as someone with their identifying data is identity fraud under Article 231b Sr.

Since the Sexual Offences Act (Wet seksuele misdrijven) took effect on 1 July 2024, making public a sexual image of a person while knowing it may harm them is punishable under Article 254ba Sr; a generated image is not excluded because it was not recorded. Systematic harassment through automated accounts can be stalking under Article 285b Sr, which is only prosecuted on complaint. AI mainly changes the scale and the difficulty of proof: the authenticity of audio and video now has to be proven. See our article on proving digital deception in the Netherlands.

What can we do for you with AI and criminal liability?

Our criminal law and IT law teams work together on these cases.

• We assess your exposure under Article 51 Sr and functional perpetration for each AI system you use.
• We review your AI governance, oversight protocol and documentation so they can serve as evidence of care.
• We draft and negotiate the allocation of responsibilities between provider and deployer.
• We challenge algorithmic evidence and request access to validation data in criminal proceedings.
• We assist companies and directors during investigations by the Public Prosecution Service and regulators.

Summary

• An algorithm cannot be an offender; Article 51 Sr covers only natural and legal persons.
• Operators are liable through functional perpetration, companies through the Drijfmest criteria, directors through de facto leadership.
• The AI Act sets the standard of care: a breach is evidence of negligence, compliance is evidence of care.
• Algorithmic output enters a criminal case through a police report or expert statement and can be challenged on validation and error rates.

Frequently asked questions