Who Should Be Responsible for AI Mistakes?

When an artificial-intelligence system makes a harmful mistake, asking only who pressed the final button is too simple. A developer may design a system that fails in predictable conditions; an organization may choose to use it for a consequential purpose without adequate safeguards; and a user may misunderstand what it can do. These roles are not interchangeable. Responsibility should be shared, but it should fall most heavily on the party with the greatest control over the relevant risk. In practice, developers must address design and testing, organizations must govern deployment and monitor outcomes, and users must follow clear limits rather than treating an AI output as automatically reliable.

This principle is consistent with the National Institute of Standards and Technology’s AI Risk Management Framework. NIST describes the framework as a voluntary resource for managing risks to individuals, organizations, and society across the design, development, use, and evaluation of AI systems. That breadth matters: risk does not begin and end with the model’s code. A developer can reduce known technical weaknesses, but an organization decides where and how a system is used, while users encounter its output in a particular situation. NIST’s framework is not a legal allocation of blame; rather, its full-lifecycle approach supports the argument that responsible practice must assign concrete duties at each stage.

Developers should bear responsibility for risks they can identify and reduce during design and testing. They choose training and evaluation methods, define system capabilities, and communicate limitations. If a tool performs poorly in a foreseeable setting, a developer should investigate and address that weakness instead of presenting the system as more capable than it is. NIST’s framework was developed through an open, consensus-driven process that included public comments and workshops, and it is intended to support risk-management efforts by others. This process does not prove that any particular system is safe; it does show why developer decisions should be examined alongside the input of affected stakeholders and other organizations.

Organizations that buy or deploy AI have a distinct responsibility because they control the context of use. A system suitable for sorting routine requests may be inappropriate for making high-stakes decisions without human review. The Federal Trade Commission’s guidance on the Children’s Online Privacy Protection Act offers a concrete U.S. example of organizational duties around technology: COPPA gives parents control over information websites can collect from children, and the rule applies not only to child-directed sites but potentially to general-audience sites as well. This is not an AI rule, and it does not establish liability for AI mistakes. It illustrates a relevant governance principle: organizations must assess how their service operates and who may be affected, rather than assuming that a technology’s label settles its responsibilities.

The National Highway Traffic Safety Administration’s guidance on driver-assistance technology makes the user’s role especially clear. NHTSA distinguishes systems that provide warnings or emergency interventions from systems that continuously assist with steering or acceleration and braking, while emphasizing that the driver remains responsible and must stay engaged. This example supports a limited, not unlimited, duty for users: people need to understand the system’s function and respond appropriately, but they cannot reasonably be expected to repair hidden design flaws or know undisclosed limitations. Clear instructions and realistic descriptions from developers and vehicle makers are therefore essential to making user responsibility fair and workable.

Responsibility should also continue after deployment. Organizations should monitor whether an AI system behaves as expected in actual use, provide a route for people to report errors, and pause or change use when evidence reveals a serious problem. Developers, in turn, should help investigate failures and update systems or guidance when appropriate. NIST’s later work includes a profile focused on risks posed by generative AI, reflecting that risk management may need to address characteristics of particular technologies. The practical lesson is not that every error can be prevented. It is that a mistake should prompt a defined process for learning and correction, rather than a search for a convenient person to blame.

A serious objection is that shared responsibility can become diluted responsibility: if everyone is accountable, each party may point to someone else. Users may also be blamed for errors despite having little knowledge or meaningful choice, while developers may not know how an organization will adapt a tool. This objection is persuasive when duties are vague. The answer is to allocate responsibility by decision and control. Developers should document capabilities and test for foreseeable failures; organizations should decide whether a use is appropriate and provide oversight; users should follow accessible warnings and procedures. NIST’s voluntary framework cannot by itself compel these actions, so organizations and developers must turn risk principles into specific internal practices.

No single party can prevent every AI mistake, and responsibility should not mean automatic blame whenever an output is wrong. It should mean an obligation to take reasonable steps within one’s control, explain decisions, and help correct harm. Developers control system design; organizations control selection, deployment, and oversight; users control how they act on outputs within the information they receive. NHTSA’s driver-assistance example shows why a clear division is possible: technology can assist without replacing an attentive person, provided its limits are understood. A fair approach to AI follows the same logic, while recognizing that users cannot shoulder duties that only system builders or deploying organizations can fulfill.