Imagine this scenario: you plan your dream trip to a tropical paradise, buy your plane ticket, book your hotel, consult ChatGPT about sightseeing itineraries and visa requirements. The AI tells you that you don't need a visa and provides a list of unmissable attractions. Convinced that you could travel without bureaucracy, you arrive at the airport to board and then discover that you were missing an essential detail: the ESTA ( Electronic System for Travel Authorization ), required to enter the United States and its territories. The result: denied boarding and a shattered dream. This happened to a Spanish couple, but it could happen to anyone who isn't paying attention.
The incident gained traction on social media and highlighted a central dilemma of our time: when artificial intelligence fails, who should be held responsible ? Is it solely the fault of the travelers, who did not check the information with official sources? Or is there some kind of responsibility to be attributed to the system that provided the incorrect answer?
This seemingly trivial example touches on profound legal issues. After all, are we facing an individual misinterpretation or an inherent risk of the technology? And, in the case of more serious damages—an incorrect medical diagnosis, a poorly managed financial transaction, or an autonomous system involved in an accident—how can Brazilian law frame civil liability for damages caused by artificial intelligence?
Global and Brazilian context
The European Union took the lead in the discussion about who is responsible for errors in artificial intelligence systems by approving the AI Act , establishing rules for development and use, classifying risks and even providing for liability scenarios. The European bloc seeks to balance innovation and the protection of fundamental rights, adopting the precautionary principle: the greater the potential risk of the technology, the greater the requirement for security and transparency from the supplier.
In the United States, the path has been more fragmented. There is no single federal law on AI, but different states and agencies are already discussing guidelines for assigning responsibility in cases of failures. In general, the American logic tends to value market self-regulation and case-by-case accountability, via judicial precedents. Lawsuits involving accidents with autonomous vehicles , for example, have served as a laboratory to determine whether the fault falls on the manufacturer, the software developer, or the user themselves.
And what about Brazil? Here, we still don't have specific legislation on civil liability for damages caused by AI. What we have are traditional legal tools, and in the absence of regulation, the Brazilian judiciary has resorted to the Consumer Protection Code (CDC) to condemn companies that manage Artificial Intelligence systems for damages caused to people.
The courts have already begun to receive cases in which artificial intelligence is not merely a backdrop, but an active part of the legal conflict. The problem is that there is still no uniform answer: each panel interprets differently the extent of civil liability when the damage results from AI systems.
In the Federal District and Territories Court of Justice (TJDFT), a landmark case of improper debt collection led the Court to reflect on the role of AI in banking systems. The court acknowledged that financial institutions operate with algorithms and robots to manage debt, but made a crucial distinction: "bad faith is a human attribute, not a machine's." Therefore, it dismissed the double restitution of the undue payment, understanding that inconsistencies generated by "automated systems cannot be treated as deliberate fraud." Here, the message is clear: AI errors are not the same as human malice.
A similar situation was judged by the TJ-PR (Court of Justice of Paraná) more recently and had a different decision. A bank claimed it was not at fault for fraudulent operations carried out through its AI-based technological protection solution, but the Court concluded that the institution failed to "demonstrate the absence of a system failure" and recognized its responsibility. In this case, artificial intelligence did not serve as a shield; on the contrary, the technological vulnerability reinforced the duty to compensate.
The Court of Justice of Santa Catarina (TJ-SC) ruled on a case involving a ride-hailing driver whose contract was suspended because the platform's facial recognition system failed to validate his identity. The court determined that the machine learning model's failure constituted a violation of good faith and ordered compensation. In its decision, AI ceased to be merely a neutral tool: the platform was held responsible for the malfunction of the algorithm that controlled the employment relationship.
In the Minas Gerais Court of Justice (TJ-MG), the debate centered on the automatic banning (generated by an AI algorithm) of a WhatsApp account. Meta argued for the legitimacy of the blocking and lack of interference, but the court recognized that there had been interference in the application and demanded a protocol guided by Brazilian law: prior notification, a justified reason, and the opportunity for defense. The decision reinforces the horizontal effectiveness of fundamental rights in the digital environment and affirms the company's responsibility for the decisions and consequences made by machines, algorithms, and AI.
There are also decisions in which AI appears linked to deepfakes and digital fraud. In 2025, the Court of Justice of Paraná (TJ-PR) addressed the civil liability of social media platforms that hosted AI-generated content under two key considerations: urgency to contain the damage and the duty of traceability to identify authors. It recognized the probability of the right and the danger of damage (article 300 of the CPC) in the face of the fraudulent use of the author's image in a video "probably made by AI," with a nationwide scam. It applied the Brazilian Internet Civil Rights Framework (Marco Civil da Internet) to guide the liability of the application provider: (i) removal of the content by court order, based on article 19, §4; and (ii) provision of connection records (IP, date and time) under article 22, in line with the retention periods of articles 13 (connection provider, 1 year) and 15 (application provider, 6 months). Result: determination of removal within 48 hours, daily fine, and delivery of the IPs. In this case, AI was not only the instrument of fraud, but also the reason why the damage reached more serious proportions — since the realism of the videos intensified the impact on the victims' reputations.
Brazilian jurisprudence is still "testing" the normative lenses to understand civil liability for artificial intelligence systems. This mosaic reveals a pattern in formation: when the system increases the risk of harm and there is a verifiable failure, the chance of conviction based on the Consumer Protection Code (CDC) and articles 186, 187, and 927 of the Civil Code increases. When there is a lack of proof of causality or wrongdoing, the response is more restrained. In common, the courts have required technical documentation and identification mechanisms to assign some level of responsibility.
Possibilities of AI civil liability in the current legal landscape
The review of the above judicial precedents demonstrates a practical problem: proving human error within a complex system. Who failed? The team that trained the model? Who operated the system in the specific case? In algorithmic environments, the breach of duty of care (negligence, recklessness, or incompetence) exists, but it is diffuse. Therefore, perhaps the key to a solution is to reconstruct the decision-making process: usage policies, logs, audits, data validation, ignored alerts. Without a technical trail, blame becomes a moving target.
In Brazil, civil liability for AI follows a hybrid arrangement: when there is demonstrable human error, we speak of subjective liability. This is the classic fault of the Civil Code. It applies to situations where it is possible to point to a breach of the duty of care: the team that trained the model without minimum validation, the integrator that deployed it outside of specifications, the operator who ignored warnings. Here, technical evidence—logs, internal policies, test records—is central to the debate.
When the problem is the security of the service or product, the framework shifts to strict liability. Fault is not discussed: damage + causal link is sufficient. It is the logic of the risk of the activity (Civil Code, art. 927, sole paragraph) combined with the Consumer Protection Code (arts. 12 and 14). This comes into play when AI, placed on the market, does not offer the security that is reasonably expected, as in cases of biased facial recognition, automated scoring that denies essential services, and opaque decision-making systems that generate losses. If the system fails, the supplier is liable—except for well-proven exclusions.
There is also joint and several liability. It's always good to remember that AI solutions often operate as ecosystems: the model manufacturer, integrator, application provider, and professional operator all benefit from the same chain and, in terms of consumption, tend to be jointly liable (Consumer Protection Code, articles 7 and 25). Outside the Consumer Protection Code, joint and several liability can arise when actions contribute to the damage. Without explainability, audit trails, testing, and risk governance, the evidence becomes weak—and the chance of liability for damages caused by artificial intelligence increases.
The regulatory challenge is to organize this landscape, which is why Bill 2338/2023 aims to consolidate a risk-based regime, with duties of transparency, governance, and human oversight for high-impact systems.
Bill 2338/23 and the civil liability of artificial intelligence.
Bill 2338/23, already approved in the Senate, is under analysis by the Chamber of Deputies and marks the most consistent attempt by the Brazilian Congress to build a regulatory framework for artificial intelligence. Among the central points is the treatment of civil liability for damages caused by AI systems, a crucial issue for providing security to victims, predictability for operators, and incentives for innovation.
As Laura Schertel, rapporteur of the draft bill PL 2338/23, points out , AI regulation is based on rights, risk classification, accountability, and sectoral supervision . Furthermore, Laura is a professor in the IDP Online postgraduate program in Digital Law, Data, and Artificial Intelligence, which offers applied study, case discussions, and preparation for regulatory implementation and litigation involving AI, with 100% online and live classes, recordings, problem-based methodology, and access to virtual libraries.
Bill 2338/23 adopts a dual accountability model, based on the degree of risk that each system presents, a choice that reflects the recognition that not all AI operates with the same potential to cause harm: a customer service chatbot does not pose the same risks as an autonomous vehicle or a credit rating algorithm.
In high-risk or excessively risky systems, the bill suggests applying the strict liability regime. That is, the supplier or operator is liable regardless of fault, only needing to demonstrate the damage and the causal link. The list includes activities such as automated recruitment, autonomous vehicles, and credit rating systems.
In consumer relations, the rules of the Consumer Protection Code prevail, always under a regime of objective and joint liability among suppliers. In other systems, the rule is presumed fault, with the burden of proof reversed in favor of the victim. This means that, in case of litigation, it will be up to the system's agent to prove that it acted in accordance with legal and regulatory standards (transparency, auditability, explainability, risk prevention, non-discrimination, among others).
The proposal also outlines situations in which the agent may be exempt from liability, such as when proving that they did not put the system into circulation or that the damage resulted from the exclusive actions of the victim, a third party, or an external fortuitous event. The text also uses the expression "taking advantage of the system," which has generated debate for suggesting the adoption of the risk-benefit theory, which is less protective than the created risk theory.
The challenge will be to transform this regulatory framework into effective practice: ensuring that victims have real means of redress, that operators and developers have clear parameters, and that innovation continues to be encouraged. After all, artificial intelligence does not eliminate human responsibility—it only transforms it into a more complex field that demands transparency, governance, and heightened care.
