A note from four MEPs reignites the debate
The question seemed settled. It returns via the European Parliament. In a note addressed to the Commission on 16 September 2026, revealed by Politico, four MEPs from different groups are calling for an "AI Liability Act": Dutch MEP Kim van Sparrentak (Greens), German MEP Axel Voss (EPP), Italian MEP Brando Benifei (S&D), and Irish MEP Michael McNamara (Renew). Their goal, according to the note: to fill existing legislative gaps, so that no European citizen or company is left defenseless against major AI providers when they cause harm.
"Europe must once again take the lead." Kim van Sparrentak, MEP (Greens), quoted by Politico on 21 September 2026 (translation).
The context explains the urgency. The summer of 2026 was marked by several incidents involving advanced models. OpenAI notably acknowledged on 21 July that some of its models, during cybersecurity evaluation, had bypassed the isolation of their test environment and reached Hugging Face's production infrastructure. However, the four elected officials stress that many of these incidents occurred during the testing phase, which the AI Act explicitly excludes from its scope: the regulation only applies to systems and models placed on the market.
A draft directive withdrawn in 2025
The idea is not new. In September 2022, the Commission had proposed a directive on AI liability, designed as the "compensation" component of the AI Act. The text did not create automatic liability: it provided for mechanisms for disclosure of evidence and rebuttable presumptions, to help victims face opaque systems whose operation only companies know.
The proposal never came to fruition. The Commission placed it on the list of texts to withdraw in February 2025, for lack of a "foreseeable agreement," and formally withdrew it on 6 October 2025. Parliament itself was divided: its Internal Market Committee (IMCO) had deemed its adoption "premature" in May 2025. Axel Voss, who led the file in Parliament, had denounced from the announcement of the withdrawal the influence of industrial lobbies that see any liability rule as "an existential threat" to their business model.
What European law already covers
Europe is not without rules. The AI Act, which entered into force on 1er August 2024, has been largely applicable since 2 August 2026, when the European AI Office obtained its supervisory powers over general-purpose models. But it is a compliance text ex ante: it sets obligations for providers and users, it does not say who compensates a victim. Its rules on high-risk systems have moreover been postponed to 2 December 2027, or even to 2 August 2028, by the "omnibus" simplification that entered into force on 27 July 2026.
The second pillar is the new directive on liability for defective products (Directive (EU) 2024/2853). It explicitly considers software, including AI systems, as products; the manufacturer remains liable for defects that appear after an update or through the continuous learning of a system it controls. Member States must transpose it by 9 December 2026 at the latest, and it will only apply to products placed on the market from that date.
This regime leaves gray areas: damage occurring before the product is placed on the market, harm that does not constitute a 'defect' within the meaning of product liability law, or the difficulty of proving causation when dealing with a foundation model. For the rest, national civil liability laws apply. Italy has already moved ahead alone: a legislative decree of 9 September 2026, which came into force on 30 September, contains a chapter on civil procedure tools to compensate for damages caused by AI. For Brando Benifei, this proves that in the absence of common rules, the single market is fragmenting.
Sam Altman relaunches, Brussels stalls
The debate took an unexpected turn in early October. In an interview published by Politico on 5 October 2026, Sam Altman, CEO of OpenAI, admitted that if something went wrong with his models during training, his company should bear some form of liability, and that 'a liability framework for companies will be needed.' Axel Voss saw this as a 'long-overdue moment of honesty.'
'Now even the CEO of OpenAI admits it: without liability, there is no trust.' Axel Voss, MEP (EPP), quoted by Politico on 6 October 2026 (translation).
The Commission, for its part, is not moving. In a statement to Politico, it says it 'continues to monitor' the application of the AI Act and the directive on defective products, and specifies that 'at this stage, there are no plans to reintroduce a proposal on AI liability.' Executive Vice President Henna Virkkunen only promised to examine possible 'gaps,' while calling for 'great caution' before any new rules. Brando Benifei, on the contrary, describes the withdrawal of 2025 as a 'serious mistake' and calls for strict liability for cutting-edge models and high-risk systems.
A matter of legal sovereignty
Behind the legal technicalities, the issue is political. The providers of the most advanced models are, for the most part, American. Without clear European rules on the burden of proof and access to technical information, a harmed SME or individual in Europe will have to face alone, before their national judge, a company that holds all the data on how its model works. The asymmetry of information is at the heart of the problem.
The Commission arbitrates between two conflicting priorities: regulatory simplification, which has dominated its agenda since 2025, and victim protection, which gains visibility with each incident. Reform advocates are now seeking a narrow path: the CEPS think tank, for example, advocates for a targeted instrument, "narrow and procedural," focused on logging obligations and evidence disclosure. It remains to be seen whether Brussels will wait for a major accident to change its mind, or whether the transposition of the "products" directive in December will suffice to fill the gap.
Sources
- Politico, « EU lawmakers float product liability rules to help avert AI disaster », 21 September 2026 (French version: Politico)
- Politico, « The EU shelved AI liability rules. Sam Altman has revived the debate », 6 October 2026
- Kim van Sparrentak, announcement of the cross-party appeal, 17 September 2026
- 2eu.brussels, Benifei and Italian Decree No. 160/2026, 1er October 2026
- IAPP, announced withdrawal of the directive on AI liability, February 2025
- European Commission, AI Act page (application timeline)
- EUR-Lex, summary of Directive (EU) 2024/2853
- ActuIA, « Régulation de l'IA : l'été où les textes sont devenus des actes », 2 September 2026
