Corporate Accountability for AI: From External Liability to Internal Governance

As losses and injuries caused by Artificial Intelligence are beginning to materialize in the real world, questions of accountability arise both outside and inside the corporation. AI-related harms to third parties can trigger corporate liability, but indirectly also fiduciary duty claims against directors and officers, transmitting external risks inward to boards and the C-suite. This raises the question of whether existing legal frameworks, across both dimensions, are equipped to respond.

In two companion pieces, I address this question from different but interconnected angles. The first is an essay, forthcoming in the Harvard Journal of Law & Technology, that examines corporate liability to third parties for AI-related harms. The second, to be published as a conference book chapter, builds upon that analysis to explore how external liability exposure shapes the fiduciary duties of directors and officers. Together, the pieces develop an account of corporate AI accountability that connects the external and the internal dimensions of AI and corporate duties.

The starting point for both papers is the recognition that AI harms are already materializing. Litigation is accumulating across a range of contexts, including chatbots linked to misinformation, delusion, and suicide; social media algorithms associated with mental health harms and educational disruption; algorithmic tools implicated in discriminatory outcomes; and autonomous vehicles involved in serious accidents. This raises the question of how the law should respond.

The first paper’s central argument is that existing private law doctrines remain broadly adaptable, even as agentic AI will introduce new stresses. Courts have thus far resisted the idea that AI creates an accountability vacuum, treating AI-related harms as the responsibility of the corporations that develop and deploy the technology. Negligence, product liability, and other tools continue to provide workable frameworks. The paper surveys emerging case law through three functional lenses: AI as an information interface, AI as a risk-creating system, and AI as a delegated decision-maker. It shows that across all three categories, courts have focused on organizational conduct rather than getting bogged down in attempting to tie liability to an AI system’s ‘own’ misconduct. 

At the same time, the paper identifies emerging structural pressures. Corporate liability depends traditionally on identifying human acts, knowledge, or states of mind that can be attributed to a corporate entity. As AI systems become more autonomous, this human-centered model grows strained. Harmful outcomes may emerge from interactions between AI agents, organizational processes, and human actors in ways that cannot easily be traced to individual wrongdoing. The paper argues that the appropriate response lies in moving toward more depersonalized forms of corporate liability, grounded in direct entity-level duties and collective organizational standards of care and ensuring public safety, rather than in recognizing AI as a legal agent or person, or even in strict liability approaches. While there are challenges and liability gaps in existing law, they are likely also narrow and amenable to targeted reform rather than fundamental doctrinal reinvention. 

The second paper takes this analysis as its foundation and turns to the internal dimension of AI accountability. Its central claim is that the two sides of the problem are connected. External liability risks are transmitted inward, informing the standards that directors and officers are expected to meet in governing their corporation’s use of AI. The paper describes this as an ‘outside in’ dynamic: the developing body of case law on AI and corporate liability, limited as it still is, already provides a practical guide for shaping managerial duties. While this guidance remains far from perfect, it is nevertheless useful given that apart from some dicta in a case highlighted in the paper we still appear to lack specific judicial commentary on AI in the context of fiduciary obligations.

The paper identifies three principal areas where AI intersects with managerial duties. First, directors and officers must navigate the appropriate use of AI in their own decision-making, resisting both excessive reliance on AI and an unwarranted failure to engage with AI tools. Second, they must also make considered decisions about how AI is deployed across corporate operations, ensuring adequate policies, processes, and safeguards from the outset. And third, once AI systems are in place, boards and management carry ongoing oversight responsibilities that should be informed by the principles courts have applied in external liability cases. For instance, successful litigation involving AI harms can constitute red flags that trigger heightened duties of attention. 

The conclusion that emerges from both papers is that AI does not require a wholesale reimagining of corporate law. Existing frameworks provide the foundation. But AI does expose their limitations, accelerates an ongoing shift toward more entity-centered models of accountability, and highlights the growing importance of organizational processes, system design, and governance over individual judgment. In the long run, however, AI may prove a catalyst for a more fundamental transformation, one in which the importance of any remaining human fiduciaries’ personal contributions to decisions fades into the background and their accountability will be assessed solely by reference to the organizational systems and safeguards that they put in place.

The author’s forthcoming essay and conference book chapter can be accessed here and here.

Martin Petrin is the Jarislowsky Dimma Mooney Chair in Corporate Governance at Osgoode Hall Law School and the Schulich School of Business at York University, Toronto, Canada.