A behavioral AI system produces a score. That score influences a decision. The decision harms someone. Who is liable? In a 34-engine system where no single component made the decision, the answer is not obvious — and that ambiguity is a governance failure, not a legal grey area.
The Technology in Plain Language
the behavioral AI platform is a system where 34 separate AI engines each score one dimension of a person's behaviour — their emotional state, negotiation posture, credibility, motivation, and more. A control plane combines these scores. A governance wrapper converts the outputs to safe language. A product adapter presents the result to a human decision-maker — a lawyer, a salesperson, a compliance officer.
No single engine decided anything. The decision was distributed across 34 computations, a collation step, a language filter, and a human reader. Each step has a different owner.
The Accountability Gap
Under traditional product liability, the manufacturer of a defective product is liable. Under professional liability, the practitioner who relied on a tool bears responsibility. Multi-engine AI breaks both frameworks:
- The engine developer says: "The engine scored correctly. The control plane combined it incorrectly."
- The platform developer says: "The governance wrapper translated the output correctly. The adapter displayed it correctly."
- The product company says: "We presented the score. The human made the decision."
- The human decision-maker says: "The AI told me."
This is not hypothetical. It is the accountability structure of every multi-engine AI system deployed today.
What the Law Currently Says
EU AI Act (2024): High-risk AI systems must have a human oversight mechanism and a designated responsible person. The Act applies to the deployer (the company putting the system in front of users) — but it does not resolve accountability across the supply chain of components.
GDPR Article 22: Individuals have the right not to be subject to solely automated decisions that produce legal or similarly significant effects. The word "solely" is key: if a human reviews the AI output before acting, Article 22 may not apply — even if the human review is perfunctory.
Indian IT Act / DPDP Act 2023: The Data Protection Board can hold "data fiduciaries" accountable for automated processing harms, but guidance on multi-party AI supply chains is not yet developed.
What Developers Should Do
- Document the accountability chain. For every engine in the registry, name the team or vendor responsible for its outputs.
- Surface the engine provenance. Explainability traces (see Explainability Traces as First-Class Objects) should be retained and producible in disputes.
- Do not hide behind safe language. The governance wrapper translates harmful labels — but the original label should be auditable internally. Destroying it destroys the evidence trail.
- Contractual allocation. Supplier agreements between engine developers and platform developers should explicitly allocate liability for scoring errors.
What Regulators Should Consider
Mandatory engine accountability registration: every AI system deployed in a regulated context should maintain a public registry of the AI components used, who developed each, and who is responsible for each component's outputs. This mirrors the approach taken for pharmaceutical supply chains.
The EU AI Act's conformity assessment process is a step in this direction — but it applies to the system as a whole, not to individual components within a multi-engine architecture.