When the Algorithm Gets It Wrong, Who Pays? Corporate Civil Liability for Decisions Made by Artificial Intelligence

Artificial intelligence systems already decide, alone or nearly alone, a growing number of matters that used to pass through the hands of a manager, an analyst, or a recruiter. Credit approval, dynamic pricing, resume screening, fraud detection, customer service, and even contract termination are being automated by companies of all sizes, driven by the promise of efficiency gains and lower operating costs. The problem arises when these systems make mistakes, discriminate, or cause harm to a customer, employee, or supplier. At that point, the question that lands on the company's legal department is direct: who answers for what the machine decided?

Under Brazilian law, the answer is almost always the same: the company does. The algorithm has no legal personality, cannot be sued, and does not sign contracts. It is a tool, however sophisticated, and whoever uses it as part of their economic activity answers for the effects of its operation toward third parties. That logic, which seems simple enough, hides a series of nuances about the type of liability that applies, the burden of proof, and the defenses available, all of which every manager should understand before delegating sensitive decisions to an automated system.

Strict liability: the risk of the activity falls on whoever profits from it

Article 927, sole paragraph, of the Brazilian Civil Code establishes that there is a duty to repair damage, regardless of fault, whenever the activity normally carried out by the party causing the damage implies, by its nature, risk to the rights of others. Companies that adopt AI in mass decision making processes, such as credit granting or personnel selection, can hardly argue that such activity is free of risk. On the contrary, the very logic of large scale automation assumes that systemic errors, when they occur, affect a significant number of people at once, which reinforces the application of risk based liability theory.

When the relationship involves a consumer, the situation is even stricter for the company. The Consumer Protection Code, in articles 12 and 14, imposes strict liability on the supplier for defects in the product or service, dispensing with any discussion of fault. If a recommendation system misleads a consumer, if a chatbot provides wrong information that causes a loss, or if a pricing algorithm practices price discrimination without technical justification, the supplying company answers regardless of whether it can prove negligence. Arguing that the decision was made by an artificial intelligence rather than a human does not remove that liability, it merely shifts the discussion to another point: did the company have the means to foresee and prevent the harm when designing, training, or contracting that system?

What the LGPD requires when the decision is automated

The Brazilian General Data Protection Law, Law 13,709 of 2018 (LGPD), specifically addresses this topic in article 20, guaranteeing data subjects the right to request review of decisions made solely on the basis of automated processing of personal data, whenever such decisions affect their interests. This includes decisions related to personal, professional, consumer, and credit profiles, or to aspects of personality. In practice, this means that a company that denies financing, rejects a job application, or closes an account based exclusively on a score calculated by an algorithm needs to be prepared to explain, clearly and accessibly, the general criteria behind that decision, should the data subject request it.

This duty of explainability runs into a technical problem known as the algorithmic black box: many machine learning models, especially those based on deep neural networks, do not allow for a simple, linear explanation of why they arrived at a particular result. That does not excuse the company from its legal duty. On the contrary, it reinforces the need to adopt, from the development or procurement stage of the system, models that allow some degree of interpretability, or at least to document the criteria, variables, and weights used in training, so that the logic behind the decision can be reconstructed when required by the National Data Protection Authority or by the courts.

The advancing regulatory framework for artificial intelligence in Brazil

A specific bill to regulate the use of artificial intelligence in the country is making its way through the National Congress, originating from a proposal drafted by a committee of legal scholars and already approved in one of the legislative houses. The proposal classifies AI systems by risk level, establishes stricter obligations for those classified as high risk, a category that typically includes systems used in recruitment, credit granting, credit scoring, insurance, and worker performance evaluation, and expressly provides for the civil liability of both the supplier and the operator of the system for damages caused.

Even before this bill is definitively enacted into law, this regulatory movement already signals the direction courts and oversight bodies tend to take when interpreting cases involving AI: the greater the potential impact of an automated decision on the rights of individuals, the higher the standard of diligence expected from the company implementing it. Managers who wait for the law to take effect before worrying about AI compliance run the risk of being caught off guard by court rulings that already apply these standards based on the general principles of civil liability and data protection currently in force.

Algorithmic bias and discrimination: a concrete legal risk, not a hypothetical one

One of the most well documented risks in AI systems applied to decisions about people is the reproduction, and in some cases amplification, of biases present in the historical data used to train the model. A resume screening system trained on a company's past hiring data, where that company historically favored a certain candidate profile, tends to reproduce that pattern, even if no line of code explicitly mentions gender, race, or age. The same applies to credit granting models that use an applicant's postal code as an indirect variable, quietly reproducing socioeconomic segregation.

This type of indirect algorithmic discrimination is already drawing increasing attention from labor courts and consumer protection agencies, and it can constitute a discriminatory act subject to compensation for collective or individual moral damages, in addition to scrutiny by the Labor Prosecutor's Office or antitrust authorities, depending on the sector. A company that outsources the decision to a technology vendor does not escape liability toward the injured party. At most, it may seek reimbursement from the system's vendor, provided the licensing agreement includes clear clauses on liability and guarantees against any demonstrable discriminatory bias.

Algorithmic governance as legal and reputational protection

The most effective way to reduce legal exposure in this area is not to avoid using artificial intelligence, but to build internal governance processes that document how each system was chosen, tested, and monitored. This involves keeping records of the model versions used, the criteria and data sets employed in training, periodic bias audit tests, and the existence of an effective human review channel for decisions that significantly affect the rights of customers or employees, a mechanism known as human in the loop.

Contracts with AI solution providers also deserve extra attention. Clauses defining liability for system failures, audit obligations, guarantees regarding the quality of training data, and service levels for correcting detected errors significantly reduce the risk of the contracting company bearing, alone, the cost of damages stemming from a failure that technically originated in the vendor's product. The absence of such clauses, unfortunately still common in standardized software licensing agreements, leaves the user company exposed to third party claims with no contractual basis to pass the cost on to the party technically responsible for the failure.

Adopting artificial intelligence in business decision making processes is not, and should not be treated as, a purely technical information technology choice. It is a strategic decision with direct implications for civil liability, personal data protection, labor law, and consumer law, one that requires the involvement of legal counsel from the very conception of the project, not only once the first lawsuit lands on the board's desk. Companies that treat legal compliance as a step to be addressed after implementation tend to discover, too late, that the cost of fixing a system already in operation is far greater than the cost of designing it correctly from the start, with legal guidance tailored to the particularities of each sector and type of automated decision.