AI incident response and product liability – October 2026

AI incidents are rapidly moving from hypothetical risk to operational reality, bringing new reporting obligations, regulatory scrutiny and liability exposure for organisations across sectors. As AI systems become increasingly embedded within products, services and critical infrastructure, new rules are emerging to govern how incidents are reported and how liability is assigned when harm occurs.

In the latest session of our AI x Dispute Resolution Webinar Series 2026, Jonathan Schuman, Christopher Götz, and David Kidman explored serious incident reporting under the EU AI Act and the evolving product liability landscape for AI. This article summarises the key developments and what organisations should be doing now to prepare.

What is an AI incident?

The EU AI Act introduces reporting regimes for serious incidents involving high-risk AI systems and general-purpose AI models with systemic risk. High-risk systems include those used in areas such as employment, critical infrastructure and biometrics, as well as AI used as a safety component in products including medical devices, lifts and toys.

A reportable incident requires:

• An incident or malfunction involving an AI system.
• A causal connection between the AI system and the harm caused?
• A resulting serious harm.

Importantly, draft Guidance from the European Commission indicates that the AI system does not need to be the direct cause of the harm for an incident to be reportable. A reportable incident may arise where an AI output influences a human decision or another system that subsequently causes harm (i.e. the AI system indirectly causes the harm), including an AI system misclassifying a medical image, leading to incorrect clinical decisions, and an AI recruitment tool producing discriminatory outcomes.

When does an AI incident become reportable?

Not every AI error unexpected outcome will trigger a reporting obligation. The threshold is deliberately high and is limited to incidents resulting in serious harm, including:

• Death or life-threatening injury
• Permanent impairment of health
• Severe disruption of critical infrastructure
• Large-scale interference with fundamental rights
• Serious damage to property
• Long-lasting and widespread environmental harm

By way of example of some of the thresholds that might be applied, draft European Commission Guidance suggests property damage may meet the reporting threshold where repair costs or loss in value exceed 5% of the purchase price.

For organisations, the key challenge will be implementing governance processes that allow potential incidents to be identified, assessed and escalated quickly enough to determine whether a reporting obligation has been triggered.

Providers of general purpose AI models with systemic risk must also report serious incidents where the involvement of the model has directly or indirectly led to any of the types of serious harm set out above. In addition, they must report where the involvement of the model has led to a serious cybersecurity breach – e.g. a cyber attack.

High risk AI serious incident reporting: what you need to know

• The reporting clock starts quickly. Serious incidents involving high risk AI systems must be reported within 15 days, reducing to 10 days where an incident results in death and 2 days where there is a widespread infringement or serious and irreversible disruption of critical infrastructure.
• Deployers and providers both have obligations. A deployer that identifies a serious incident has 24 hours to notify the provider and relevant authority. If the provider cannot be contacted or fails to respond, reporting responsibilities may remain with the deployer.
• One incident can trigger multiple reporting regimes. Depending on the circumstances, organisations may need to report under the EU AI Act, GDPR, NIS2, DORA or other sector-specific requirements.
• Reporting requirements may become more streamlined. The proposed EU Digital Omnibus includes a "single entry point" mechanism designed to simplify reporting across multiple EU regulatory regimes.
• Non-compliance can be costly. Potential fines of up to €15 million or 3% of global annual turnover, whichever is higher.

Product liability: what you need to know

• AI is now expressly covered. The EU Product Liability Directive expands the definition of a product to include software, updates, connected products and standalone AI systems.
• The rules become effective soon. Member States must implement the Directive by 9 December 2026.
• Claimants are being given new tools. The Directive introduces early disclosure requirements and presumptions of defect or causation in certain circumstances, making some AI-related claims easier to pursue.
• Technical complexity may not protect businesses. Where the complexity of an AI system makes it difficult for a claimant to prove their case, courts may apply claimant-friendly presumptions.
• The UK remains a different proposition, for now. The current UK regime does not generally cover standalone AI systems, and the Law Commission has recently published a paper on UK product liability reform, which proposes to expand the regime to AI and other intangibles (including e.g. features of social media).

Recommended steps for deployers and providers

• Establish a clear incident response framework. Define how potential AI incidents will be identified, assessed and escalated across legal, technical, product, security and compliance teams.
• Understand reporting obligations before an incident occurs. Organisations should be able to quickly determine whether an incident meets the reporting thresholds under the EU AI Act and any parallel regulatory regimes.
• Preserve evidence from the outset. Logs, training data, system records and other relevant materials may be needed for root cause analysis, regulatory investigations or subsequent product liability claims. Avoid overwriting, modifying or deleting potentially relevant information.
• Document decisions and investigations, but consider privilege. Internal assessments, risk analyses and remediation actions may later be scrutinised by regulators or relied upon in litigation. Consider involving EU external counsel in the process, to help with asserting privilege over such documents.
• Coordinate incident response and liability planning. AI incident reporting and product liability should not be treated as separate exercises. The records created during an incident investigation may become critical evidence in later proceedings.
• Start preparing now. Although high risk AI system reporting obligations do not apply until 2027 (for Annex III) and 2028 (for Annex I), organisations should begin building governance, reporting and evidence-preservation processes well in advance.

The next session in the series, Evidence in AI disputes, will take place on November 5th, 2026. This session will cover the following topics:

• Challenges of evidence in AI disputes
• Establishing liability where AI is involved
• Use of expert witnesses and technical evidence
• Practical litigation strategies

If you would like to attend this session you can register here, or contact your usual Simmons & Simmons contact or our AI x DR team.