On 8 September 2026, the European Commission quietly withdrew its proposal for the AI Liability Directive—a piece of legislation that had been designed to give individuals a meaningful path to redress when AI systems caused them harm. The withdrawal was not announced with fanfare. It was buried in a legislative agenda update, a bureaucratic footnote to a political failure that will have real consequences for real people.
The directive's withdrawal matters because it leaves a structural gap in the architecture of algorithmic accountability. AI systems are now making consequential decisions about people's lives at unprecedented scale: determining credit eligibility, assessing welfare entitlements, flagging individuals for law enforcement attention, screening job applications, and influencing medical diagnoses. When these systems cause harm—through bias, error, or opacity—the individuals affected need a meaningful path to challenge those decisions and seek redress. The withdrawn directive was meant to provide that path. Without it, victims of algorithmic harm must navigate a patchwork of national tort laws that were designed for a pre-AI world and are poorly equipped to handle the evidentiary challenges of algorithmic accountability.
What the Directive Would Have Done
The AI Liability Directive (COM(2022)496) was proposed by the European Commission in September 2022 as a companion to the EU AI Act. Where the AI Act focused on preventing harm through ex ante requirements—risk classification, conformity assessments, technical documentation, human oversight—the directive was designed to address harm after it occurred. Its two central innovations were the "rebuttable presumption of causality" and the right to disclosure of technical evidence.
The rebuttable presumption of causality was a burden-shifting mechanism. Under existing tort law, a claimant who believes they have been harmed by an AI system must prove that the system caused the harm—a task that is technically demanding, expensive, and often impossible without access to the system's internal workings. The directive would have reversed this burden in certain circumstances: if a claimant could show that an AI system was used in a context where it was likely to have caused the harm, the burden would shift to the operator to prove that the system was not at fault.
The right to disclosure was equally important. AI systems are typically proprietary, and their internal logic is not accessible to those affected by their decisions. The directive would have given courts the power to order the disclosure of technical evidence—training data, model architecture, decision logs—enabling claimants and their experts to assess whether a system had behaved as claimed. Without this power, algorithmic accountability is largely theoretical: you cannot challenge a decision you cannot see.
Both mechanisms were contested by industry. The burden-shifting provision was criticised as creating legal uncertainty and potentially chilling AI innovation. The disclosure requirement raised concerns about intellectual property and trade secrets. These objections were not without merit, but they were also self-interested. The result of the political stalemate was withdrawal—and the victims of algorithmic harm are left with neither mechanism.
The Existing Framework and Its Limits
In the absence of the AI Liability Directive, the legal landscape for contesting automated decisions in the EU rests on two pillars: GDPR Article 22 and the EU AI Act. Both are important. Neither is sufficient.
GDPR Article 22: The Right That Rarely Works
Article 22 of the General Data Protection Regulation provides individuals with the right not to be subject to a decision based solely on automated processing if that decision produces legal or similarly significant effects. It also provides the right to obtain human intervention, express a point of view, and contest the decision. On paper, this is a meaningful protection. In practice, it is riddled with limitations.
First, the "solely automated" threshold is easily circumvented. If a human nominally reviews an automated decision—even if that review is cursory, uninformed, or effectively rubber-stamping the algorithm's output—the decision is no longer "solely" automated, and Article 22 does not apply. The European Law Institute's guiding principles on automated decision-making have emphasised that meaningful human oversight requires that the reviewer has the authority, the information, and the time to genuinely override the automated decision. But this standard is rarely enforced in practice.
Second, Article 22 applies only to decisions that produce "legal or similarly significant effects." This is a high threshold. Decisions that affect access to credit, employment, housing, or public services clearly meet it. But many consequential algorithmic decisions—content moderation, search ranking, insurance pricing, targeted advertising—may not, leaving individuals without recourse even when AI systems significantly affect their lives.
The EU AI Liability Directive was withdrawn on 8 September 2026—not because the problem it addressed had been solved, but because the political will to solve it had stalled. The victims of algorithmic harm are left to navigate national tort laws designed for a pre-AI world.
Third, and most fundamentally, Article 22 provides a right to contest but not a right to understand. An individual who successfully invokes Article 22 and obtains human review may still have no meaningful insight into why the automated system made the decision it did. Without transparency, contestation is largely performative.
Meaningful human oversight is not a checkbox. It requires that the reviewer has the authority, the information, and the time to genuinely override an automated decision—conditions that are rarely met in the high-volume, cost-pressured environments where algorithmic systems are most commonly deployed.
The EU AI Act: Prevention Without Redress
The EU AI Act, which became fully enforceable in August 2026, represents a significant advance in AI governance. Its risk-based classification system—identifying high-risk AI applications in areas such as employment, education, credit, law enforcement, and migration—imposes substantial obligations on developers and deployers: conformity assessments, technical documentation, data governance requirements, human oversight, and transparency obligations. Non-compliance can result in penalties of up to 7% of global annual turnover or €35 million.
But the AI Act is fundamentally a preventive instrument. It is designed to reduce the likelihood of harm by imposing requirements on AI systems before they are deployed. It does not create individual rights to redress when harm occurs. A person who is wrongly denied a loan by a high-risk AI system that is technically compliant with the AI Act has no additional rights under the Act to challenge that decision or seek compensation. The Act's transparency requirements may make it easier to understand why the decision was made, but they do not provide a legal pathway to contest it.
This is the gap that the AI Liability Directive was meant to fill. The AI Act prevents harm; the directive would have provided redress when prevention failed. Without the directive, the EU's AI governance framework is structurally incomplete: it has a sophisticated front end but no meaningful back end.
The Munich Precedent: Judicial Clarity in a Legislative Vacuum
In the absence of legislative clarity, courts are beginning to fill the gap. The most significant development in 2026 has been the June ruling by the Landgericht München (Munich Regional Court) concerning Google's "AI Overviews" feature. The ruling established three principles that have significant implications for algorithmic accountability across the EU.
First, the court held that content produced by an AI system is legally the content of the operator, regardless of the underlying model. This is a significant departure from the platform liability frameworks that have governed internet intermediaries for decades. Under those frameworks, platforms are generally not liable for user-generated content. The Munich court held that AI-generated content is not user-generated—it is operator-generated, and the operator bears responsibility for it.
Second, the court held that traditional platform safe harbour protections—including those under the Digital Services Act—do not apply to AI-generated content. This is a consequential ruling. Safe harbour protections have been the primary shield behind which internet platforms have avoided liability for harmful content. If AI-generated content falls outside those protections, operators face a significantly more demanding liability environment.
Third, and most importantly for algorithmic accountability, the court explicitly rejected the argument that operators can shift liability to users by expecting them to fact-check AI outputs. This principle—that the operator, not the user, bears responsibility for the accuracy and safety of AI-generated content—is precisely the kind of clarity that the withdrawn directive was meant to provide at scale.
The Munich Regional Court's June 2026 ruling established a landmark principle: AI-generated content is the operator's content, and platform safe harbours do not apply. This is the kind of judicial clarity that the withdrawn directive was meant to provide at scale.
The Munich ruling is significant, but it is also limited. It is a single national court decision, not binding across the EU. It addresses a specific type of AI harm—inaccurate AI-generated content—rather than the broader range of algorithmic harms that the directive was designed to address. And it was reached through litigation, which is expensive, slow, and inaccessible to most individuals who are harmed by AI systems.
The Munich Regional Court's June 2026 ruling established a landmark principle: AI-generated content is the operator's content, and platform safe harbours do not apply. This is the kind of judicial clarity that the withdrawn directive was meant to provide at scale.
The Accountability Gap in Practice
To understand what the withdrawal of the AI Liability Directive means in practice, it is useful to consider the kinds of harms that individuals are now experiencing from AI systems—and the legal tools available to address them.
Predictive Policing and Risk Scores
Law enforcement agencies across Europe and beyond are using AI systems to predict criminal behaviour, assess recidivism risk, and allocate policing resources. These systems have been extensively documented to exhibit racial and socioeconomic bias, producing higher risk scores for individuals from marginalised communities regardless of their actual behaviour. An individual who is subjected to heightened police scrutiny, denied bail, or given a longer sentence because of a biased risk score has suffered a concrete harm. But proving that the AI system caused that harm—rather than the human decision-maker who relied on it—is extraordinarily difficult under existing legal frameworks.
Automated Welfare Decisions
Welfare agencies in several EU member states have deployed AI systems to detect fraud, assess eligibility, and allocate benefits. The Dutch SyRI system—which was struck down by a Dutch court in 2020 on human rights grounds—was an early example of the risks. But similar systems continue to operate across Europe, often with less transparency and less scrutiny. Individuals who are wrongly denied benefits or flagged as fraudulent by these systems face significant practical barriers to contestation: they may not know that an AI system was involved, they may not have access to the information needed to challenge the decision, and they may lack the resources to pursue legal action.
Employment Screening
AI systems are now widely used in employment screening—analysing CVs, conducting automated video interviews, and scoring candidates on criteria that may not be transparent or explicable. Candidates who are rejected by these systems typically receive no explanation and have no meaningful right to challenge the decision. The EU AI Act classifies employment AI as high-risk, imposing transparency and human oversight requirements. But these requirements are directed at employers, not at candidates, and they do not create individual rights to explanation or contestation that are practically enforceable.
The Path Forward: What Accountability Requires
The withdrawal of the AI Liability Directive does not mean that algorithmic accountability is impossible. It means that achieving it will require more effort, more creativity, and more political will than a single legislative instrument would have demanded. Several pathways deserve attention.
National Legislative Action
In the absence of EU-level harmonisation, member states can and should develop national frameworks for AI liability that incorporate the burden-shifting and disclosure mechanisms that the directive would have provided. Several member states—including Germany, France, and the Netherlands—have sophisticated legal traditions and technical capacity to develop such frameworks. The risk is fragmentation: a patchwork of national laws creates compliance complexity for operators and uncertainty for individuals who may not know which national framework applies to their situation.
Regulatory Enforcement of Existing Rights
Meaningful human oversight is not a checkbox. It requires that the reviewer has the authority, the information, and the time to genuinely override an automated decision—conditions that are rarely met in the high-volume, cost-pressured environments where algorithmic systems are most commonly deployed.
Data protection authorities have significant powers under the GDPR to investigate and sanction violations of Article 22. In practice, these powers have been underused. A more aggressive enforcement posture—investigating systemic violations of automated decision-making rights, imposing meaningful sanctions, and requiring operators to demonstrate that human oversight is genuine rather than nominal—could significantly improve accountability without new legislation.
Judicial Development
The Munich ruling demonstrates that courts can develop meaningful accountability principles in the absence of specific legislation. Encouraging litigation—through legal aid, public interest law organisations, and strategic test cases—can build a body of case law that provides practical guidance for operators and meaningful protection for individuals. This is slow and expensive, but it is not nothing.
Technical Standards as Accountability Infrastructure
The EU AI Act's requirement for technical documentation and conformity assessments creates an infrastructure of accountability that can be leveraged even without specific liability rules. If operators are required to document how their systems work, what data they were trained on, and how they perform across different demographic groups, that documentation can be used in litigation, regulatory investigations, and public accountability processes. The challenge is ensuring that this documentation is genuinely informative rather than a compliance exercise in opacity.
The EU AI Liability Directive was withdrawn on 8 September 2026—not because the problem it addressed had been solved, but because the political will to solve it had stalled. The victims of algorithmic harm are left to navigate national tort laws designed for a pre-AI world.
The Deeper Question: Justice in the Algorithmic Age
Behind the technical and legal questions about AI liability lies a deeper question about justice. AI systems are not neutral tools. They encode values, reflect priorities, and distribute benefits and burdens in ways that are not always visible or intended. When those distributions are unjust—when AI systems systematically disadvantage already-marginalised communities, when they make consequential decisions without accountability, when they cause harm without providing redress—the question is not just legal. It is moral.
The withdrawal of the AI Liability Directive is a political failure, but it is also a moral one. It reflects a choice—made by legislators under pressure from industry—to prioritise the interests of AI operators over the interests of individuals who are harmed by AI systems. That choice has consequences. It means that the people most likely to be harmed by algorithmic systems—those who are already disadvantaged by existing social structures—are also the least likely to have meaningful recourse when those systems fail them.
Algorithmic accountability is not a technical problem with a technical solution. It is a justice problem that requires a justice response: clear legal rights, meaningful enforcement, accessible remedies, and a political commitment to ensuring that the benefits of AI are not purchased at the cost of the rights of those who are most vulnerable to its harms.
Conclusion
The EU's AI governance framework in 2026 is sophisticated in its preventive architecture and deficient in its remedial one. The AI Act imposes meaningful obligations on AI developers and deployers. The GDPR provides important but limited rights to individuals affected by automated decisions. The withdrawn AI Liability Directive would have bridged the gap between prevention and redress. Its absence leaves a structural accountability deficit that courts, regulators, and legislators will need to address through other means.
The Munich ruling of June 2026 offers a glimpse of what judicial accountability can look like. But litigation is not a substitute for legislation. The individuals most likely to be harmed by AI systems are also the least likely to have the resources to pursue legal action. A just response to algorithmic harm requires systemic solutions—clear legal rights, accessible remedies, and meaningful enforcement—not just the occasional landmark ruling.
The withdrawal of the AI Liability Directive is not the end of the story. It is a setback in a longer struggle to ensure that the development of AI is governed by principles of justice as well as principles of innovation. That struggle will continue, in national legislatures, in European institutions, in courts, and in the broader public debate about what kind of society we want to build with these powerful technologies.
