For nearly thirty years, Big Tech has been shielded from liability for harms caused by content on their platforms, treated by the law as neutral conduits rather than publishers of what their users post. But that defensive wall, until recently hard to pierce, is beginning to be eroded. The shift from platform content to platform design in how litigators and consumers are pursuing platform liability is no longer hypothetical. It is happening across jurisdictions, at different speeds and through different mechanisms, and, most notably in the recent cases against Meta, it is beginning to reach the AI systems that organisations and individuals now depend on, partner with, or deploy.

At a recent breakfast event, Liability and Reputation in the Age of AI, DRD Partnership was joined by Jacob Turner, barrister at Fountain Court Chambers and a member of the UK Jurisdiction Taskforce (UKJT) drafting committee for the Legal Statement on AI Harms, for an expert discussion with senior legal counsel and disputes specialists on where the law is heading and what it means for how organisations think about legal exposure and reputational defence.

The conversation kicked off with reflections on the landmark ruling in K.G.M. v. Meta Platforms, Inc. earlier this year, in which a Los Angeles jury found Meta and YouTube liable for the design of their platforms and the harm caused to a young woman’s mental health. As Jacob observed in opening the discussion, the ruling matters because it signals a shift in the centre of gravity for technology liability. Since the enactment of Section 230 of the US Communications Decency Act in 1996, the caes have focused on the content on these platforms, focused on what was said, who said it, and whether it crossed established legal thresholds. The focus is now moving to the design of the platforms themselves, how they were originally built, what was known about the harms they might cause, and what should have been known about how they might develop.

How the content to design shift might translate to England and Wales

A recurring question was whether the K.G.M. reasoning could travel across the Atlantic. The room’s view was that it could, in principle, but that the path is materially harder than in the US.

The Consumer Protection Act 1987, based on the Product Liability Directive of 1985, was drafted with physical goods in mind. Traditionally interpreted as covering movables, e.g. a lightbulb, a table, a car, the Act is difficult to apply to pure software. The EU, by contrast, has revised its product liability directive to cover software and has introduced presumptions of causality and defect where producers have not complied with regulatory safety obligations under instruments such as the EU AI Act. The UK sits between the two approaches, without either the US route through jury-friendly product liability or the EU route through statutory reform.

The Law Commission is currently consulting on whether product liability should be extended to cover pure software, and separately on whether the opt-out class action regime, currently restricted to competition claims, should be extended to consumer claims. In the absence of any reform, the UK risks falling behind its US and EU counterparts.

The negligence route was also discussed. Jacob referenced the UKJT’s recent Legal Statement on Liability for AI Harms, which concludes that the common law is well placed to accommodate liability for AI-caused harm, while acknowledging that holding upstream large language model providers responsible for downstream harm remains difficult, particularly where there are intermediate developers or bad actors in the chain. English cases such as Tulip Trading Ltd (on the design of cryptocurrency platforms) suggest a doctrinal route exists, but the practical reality remains challenging.

Lifting the lid on the black box

Even where the doctrinal path exists in principle, a more immediate obstacle is often practical. A significant strand of the discussion focused on how claimants and their advisers can meaningfully obtain the information they need about how algorithms and AI systems function. Traditional disclosure routes have limitations, and technology companies have been consistently reluctant to reveal the architecture behind their systems.

Several attendees noted the utility of data subject access requests and the right to an explanation of automated processing, though these are frequently met with jurisdictional deflection. One attendee described a case in which Instagram, faced with a joint request endorsed by the English High Court, insisted that the claimants pursue the process through the US courts, running the clock down before trial.

The US ‘Section 1782’ procedure, allowing evidence to be obtained in the US in support of foreign civil and criminal proceedings, was raised as a promising if underused route to lifting the lid on how systems source and process information.

When AI is the source of harm: publisher, platform or product?

The traditional defamation model requires a publisher and typically assumes that the content complained of has been created by an original human author. When a large language model or an AI overview generates a false and damaging statement, that assumption breaks down.

The discussion turned to a recent decision of the High Court in Munich, in which Google was found liable for a defamatory statement generated in an AI overview, where the source material linked to did not in fact contain the allegation. The court held Google liable as a publisher in its own right, on the basis that it had produced and distributed the statement to the world. The implications are significant. As reputations become increasingly machine-mediated, the models themselves are important audiences organisations need to think about, and questions of who is responsible when they get it wrong will only grow more pressing.

Stepping back, the general consensus arrived at in the room was that change, when it comes, is more likely to be driven by private action than by Parliament, with a well-resourced action under the competition regime or through group litigation the most plausible route. Ideas were also raised about shifting the whole basis on which platform liability is considered, moving from duties of care to strict liability, and regulating ex ante through insurance rather than ex post through litigation. The suggestion was not that any of this is imminent, but that the UK, sitting between the US and EU approaches, could consider the question in a more fundamental way.

Read more about our Crisis & Reputation Management and Litigation Communications services, and how we help organisations navigate complex legal, regulatory and reputational risks.