AI-generated content: who is liable for errors under Dutch and EU law?

If AI-generated content contains errors or infringes someone’s rights, the business that chose to use and publish it is in principle liable, just as for any other content it publishes. The main exception: the business can pass the loss on to its AI supplier only if the contract allows it, or claim against the producer under product liability if the AI system itself was defective.

There is no specific AI liability law in the Netherlands. The European Commission withdrew its proposed AI Liability Directive, so claims run through the Dutch Civil Code (BW), copyright law, the GDPR and the product liability rules, while the EU AI Act sets duties that a court can use to measure careful conduct.

Who is liable for errors in AI-generated content?

The party that deploys the AI and publishes or acts on its output carries the first risk. A chatbot on your website speaks for you: towards your customers, its answers are your answers.

Towards your customers, you are liable for a failure to perform your contract under Article 6:74 BW. If you use an unsuitable tool to perform that contract, Article 6:77 BW attributes the failure to you, unless that would be unreasonable given the content of the contract, common opinion and the circumstances. That you did not know the tool was unsuitable does not help you.

Towards third parties, such as a person defamed in an AI-written text, liability follows from the unlawful act (onrechtmatige daad) under Article 6:162 BW. The injured party must show an unlawful act, attribution, damage and a causal link. Publishing unchecked AI output on a sensitive topic can itself be careless conduct.

Can you pass the loss on to the AI supplier?

Only to the extent your contract with the supplier allows. Standard terms of large AI providers usually exclude liability for the accuracy of output, and between businesses such clauses are in principle valid; read more on limitation of liability.

A limitation clause cannot be relied on where that would be unacceptable under the standards of reasonableness and fairness (Article 6:248(2) BW), for example in case of intent or deliberate recklessness. With consumers, unreasonably onerous clauses in general terms and conditions can be annulled.

When does product liability apply to AI?

Product liability makes the producer liable without fault for damage caused by a defective product, under Articles 6:185 and following BW. These articles implement the 1985 Product Liability Directive and cover death, personal injury and damage to other property used privately, not pure financial loss.

Directive (EU) 2024/2853 replaces the old directive and states expressly that software, including AI systems, is a product. Member States must transpose it by 9 December 2026; it applies to products placed on the market after that date. Until the Dutch implementing act enters into force, the current articles apply.

The time limits are strict. A product liability claim prescribes three years after you became aware of the damage, the defect and the producer, and the producer’s liability ends ten years after the product was put into circulation (Article 6:191 BW).

Which duties does the EU AI Act impose?

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. It does not itself give injured parties a damages claim, but breaching its duties makes it easier to argue that you acted carelessly.

• Since 2 February 2025: banned AI practices (such as social scoring and manipulative techniques) and the duty to ensure AI literacy of staff.
• Since 2 August 2025: obligations for providers of general-purpose AI models, including technical documentation and a copyright policy.
• Since 2 August 2026: transparency duties under Article 50, such as telling people they are dealing with a chatbot and labelling deepfakes.
• High-risk systems (for example recruitment and credit scoring tools): risk management, data governance, logging and human oversight. The EU has moved to postpone these obligations, so check the current dates for your system.

Fines for the most serious infringements reach €35 million or 7% of worldwide annual turnover, whichever is higher. In the Netherlands, supervision is shared between sector regulators, with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the Netherlands Authority for Digital Infrastructure (RDI) coordinating; the national implementing act has not yet entered into force.

Who owns AI-generated content, and who is liable for infringement?

Copyright protects only a work that is the author’s own intellectual creation, reflecting free and creative choices of a human being. Output produced by a short prompt without further human input is therefore in principle not protected under the Dutch Copyright Act (Auteurswet).

The more you select, arrange and edit the output yourself, the stronger your claim to authorship. Keep records of your prompts, choices and edits; in the Netherlands copyright is not registered, so this evidence is what you rely on in a dispute. See our guide to intellectual property law.

If the output reproduces a protected work, the publisher of that output infringes, whether or not the AI made the copy. The rights holder can demand that you stop and claim damages; you then have to look to your supplier under the contract.

Is training an AI model on protected works allowed?

Training involves copying works, which requires permission unless an exception applies. Article 4 of the Digital Single Market Directive (2019/790) allows text and data mining by anyone with lawful access, unless the rights holder has reserved its rights in an appropriate manner, such as machine-readable means for online content.

Article 3 of that Directive gives research organisations and cultural heritage institutions a wider exception for scientific research, without an opt-out. Providers of general-purpose AI models must also have a policy to respect these reservations under the AI Act.

What about personal data in AI output?

If an AI system processes personal data, the GDPR applies in full. You need a legal basis, must respect the data subjects’ rights and, for high-risk processing, carry out a data protection impact assessment under Article 35 GDPR.

Incorrect statements about a person in AI output can breach the accuracy principle and give rise to a damages claim under Article 82 GDPR. Whether you act as controller or processor decides who bears these duties; see controller and processor roles.

How do you prove an AI error caused your loss?

The party that relies on a legal consequence must prove the facts, under Article 150 of the Dutch Code of Civil Procedure (Rv). There is no special EU rule that eases this for AI, now that the AI Liability Directive has been withdrawn.

A court may give the defendant a heavier duty to explain where it alone holds the logs and documentation. Secure the output, screenshots, prompts and correspondence immediately, because without them causation is hard to show.

A damages claim under Article 6:162 BW prescribes five years after you became aware of both the damage and the liable person, and in any case twenty years after the event (Article 3:310 BW). You interrupt prescription with a written notice clearly reserving your right to performance (Article 3:317 BW).

What should you check as a business using AI?

As the deployer, you carry the first risk towards customers and third parties. Check these points before you publish or rely on AI output.

• Is every output on legal, medical, financial or reputational topics reviewed by a person before publication?
• Does your contract with the AI supplier exclude liability for output, and can you negotiate a warranty or indemnity?
• Are your chatbots and synthetic images labelled as AI, as Article 50 of the AI Act now requires?
• Does the tool process personal data, and do you have a legal basis and, where needed, a data protection impact assessment?
• Do your own terms and conditions limit your liability towards customers within what Dutch law allows?

What should you check if AI content has harmed you?

As the injured party, you must prove the error, the damage and the causal link. Check these points first.

• Have you saved the content, its date, its source and where it was published?
• Who published or used the content: the business that deployed the AI is usually your first defendant.
• Is the content defamatory, a copyright infringement or a GDPR breach? Each route has its own requirements.
• Did you send a written demand to stop and to rectify, which also interrupts prescription?
• Can you calculate your loss, such as lost turnover, correction costs or licence fees?

What can we do for you with AI-generated content?

Our IT law team advises businesses that use AI and parties harmed by its output.

• We review your AI supplier contract for liability exclusions, warranties and indemnities.
• We draft or update your terms and conditions and AI use policy.
• We assess which AI Act duties apply to your system and since when.
• We send a cease-and-desist letter and liability notice when AI content infringes your rights.
• We assess and draft a damages claim, or defend you against one.

Summary

• The business that deploys AI and publishes its output is in principle liable towards customers and third parties.
• Recourse against the AI supplier depends on the contract; product liability covers defective products, not pure financial loss.
• Directive (EU) 2024/2853 brings software and AI under product liability; transposition is due by 9 December 2026.
• Purely AI-generated output is in principle not protected by copyright, but infringing output exposes the publisher.
• Secure evidence early and interrupt prescription in writing; a tort claim prescribes five years after awareness.

Frequently asked questions