Learning path
AI Liability for Developers learning path: everything to study, topic by topic
Assessment covering the legal liability landscape for developers who use AI tools. Explores EU AI Act, US AI policy, product liability for AI-generated code, GDPR/CCPA implications, high-risk AI system requirements, and incident response legal obligations.
Short answer
To learn AI Liability for Developers, work through 6 modules and 28 topics in the order they build on each other. It starts with Regulatory Landscape, then moves on to Product Liability for AI Outputs and Data Protection & AI. Use the map as a checklist, or measure your level and study only what is missing.
What you will study
Topics are grouped by module. Open one to see its objectives and key concepts.
1 · Regulatory Landscape5 topics
EU AI Act — Overview for Developers
Risk-based structure of the EU AI Act, its four risk tiers, and how it applies to developers who build or use AI-assisted tools.
Objectives
- Name the four EU AI Act risk tiers
- Identify which tier applies to common developer use cases
- Distinguish 'provider' from 'deployer' obligations
Key concepts
- risk tiers
- prohibited AI
- high-risk AI
- limited risk
- minimal risk
- provider vs. deployer
- territorial scope
Prohibited AI Uses
AI applications explicitly banned by the EU AI Act and other regulations, including social scoring, real-time biometric surveillance, and subliminal manipulation.
Objectives
- List the EU AI Act's prohibited AI use categories
- Apply prohibition rules to concrete developer scenarios
- Understand penalties for prohibited AI deployment
Key concepts
- social scoring
- biometric surveillance
- emotion recognition
- subliminal manipulation
- prohibited use cases
- penalties
US AI Policy and NIST AI RMF
US federal AI policy landscape, NIST AI RMF as a voluntary standard, sector-specific AI regulations (financial, healthcare), and state-level AI laws.
Objectives
- Describe the NIST AI RMF four core functions
- Identify sector-specific US AI regulations relevant to software developers
- Compare US and EU approaches to AI regulation
Key concepts
- NIST AI RMF
- Executive Order on AI
- sector regulations
- state AI laws
- CFPB AI guidance
- FDA AI guidance
How AI Regulations Reach Individual Developers
How regulatory obligations flow from regulators to companies to individual developers, including employment law, professional liability, and fiduciary duty.
Objectives
- Trace how AI regulations flow to individual developer obligations
- Identify when a developer can be personally liable vs. only the company
- Describe professional liability standards for AI-assisted code
Key concepts
- chain of accountability
- professional liability
- employment obligations
- developer as deployer
- individual vs. corporate liability
Global AI Regulation Landscape
AI regulations beyond the EU and US, including China's AI regulations, UK AI framework, Canadian AIDA, and their implications for globally deployed software.
Objectives
- Name the major non-EU/US AI regulatory frameworks
- Identify which regulations apply when software is deployed globally
- Apply a compliance-by-jurisdiction analysis to a concrete scenario
Key concepts
- China AI regulations
- UK AI framework
- Canadian AIDA
- extraterritorial scope
- compliance across jurisdictions
2 · Product Liability for AI Outputs5 topics
AI-Generated Code as a Product Defect
When AI-generated code constitutes a 'defective product' under product liability law, the elements of defective design vs. manufacturing defect, and how courts have approached software liability.
Objectives
- Distinguish product liability from negligence for AI-generated code
- Apply the defective design test to an AI code failure scenario
- Identify when a software bug becomes a product liability issue
Key concepts
- product liability
- defective design
- manufacturing defect
- software as product
- strict liability
- negligence standard
Employer Liability for Developer AI Use
Vicarious liability when employees use AI tools, employer obligations to establish AI governance, and when employers can assert defenses against liability.
Objectives
- Explain how vicarious liability applies when developers use AI tools
- Identify what employer AI policies must include to reduce liability
- Analyze when an employer can and cannot assert defenses
Key concepts
- vicarious liability
- respondeat superior
- employer AI policy
- negligent supervision
- safe harbor for AI use
AI Use in Contracts and Service Agreements
How client contracts, service agreements, and NDAs address AI-generated deliverables, warranties, liability caps, and disclosure obligations.
Objectives
- Identify standard contract clauses that address AI-generated work
- Determine when client consent is required to use AI tools
- Apply warranty analysis to a contract dispute over AI-generated code
Key concepts
- AI disclosure clauses
- warranty of fitness
- liability caps
- IP assignment for AI code
- client consent for AI use
IP Ownership of AI-Generated Code
Copyright status of AI-generated code, who owns AI tool outputs, training data copyright claims, and work-for-hire doctrine applied to AI.
Objectives
- Describe the current copyright status of AI-generated code
- Apply the work-for-hire doctrine to AI-assisted development
- Identify IP risks when AI reproduces training data
Key concepts
- copyright in AI output
- human authorship requirement
- work-for-hire and AI
- training data claims
- open-source AI outputs
AI Tool Terms of Service Restrictions
Key restrictions in AI tool terms of service affecting commercial use, data handling, output ownership, and prohibited deployment contexts.
Objectives
- Identify key ToS restrictions that affect developer liability
- Compare enterprise and consumer AI tool ToS for commercial development
- Apply ToS analysis to a scenario where code is shipped to clients
Key concepts
- commercial use restrictions
- output ownership ToS
- data retention by AI providers
- prohibited deployment
- ToS for enterprise vs. consumer plans
3 · Data Protection & AI5 topics
GDPR Implications for AI-Generated Code
How GDPR applies when AI tools process personal data, developer obligations under GDPR Articles 25 and 35, and data protection impact assessments for AI features.
Objectives
- Apply GDPR Article 25 to AI-assisted feature development
- Determine when a DPIA is required for an AI feature
- Identify GDPR Article 22 obligations for automated decision-making
Key concepts
- GDPR Article 25 (privacy by design)
- Article 35 DPIA
- AI and automated decision-making
- Article 22
- legitimate basis for AI
CCPA and US State Privacy Laws for AI
California Consumer Privacy Act and CPRA obligations for AI systems, automated decision-making opt-out rights, and state-level AI transparency requirements.
Objectives
- Describe CCPA/CPRA rights that apply to AI-driven features
- Implement opt-out mechanisms for automated profiling
- Compare CCPA and GDPR obligations for AI systems
Key concepts
- CCPA opt-out for automated decisions
- CPRA AI profiling rights
- sensitive personal information
- AI transparency disclosures
- Colorado AI Act
- Connecticut CTDPA
Training Data Liability
Legal risks when AI models are trained on data that contains PII, copyright-protected material, or biased datasets, and developer obligations when using pre-trained models.
Objectives
- Identify liability risks from using models trained on unlicensed or biased data
- Evaluate model cards for training data adequacy
- Apply GDPR right to erasure to AI training data scenarios
Key concepts
- training data copyright
- PII in training data
- bias from training data
- model cards
- data provenance
Privacy by Design for AI Features
Applying privacy by design principles to AI features, including data minimization in AI inputs, purpose limitation, storage limits, and technical privacy controls for AI systems.
Objectives
- Apply privacy by design to an AI feature architecture
- Identify data minimization opportunities in AI prompt design
- Conduct a basic DPIA for an AI-assisted feature
Key concepts
- privacy by design
- purpose limitation
- data minimization in prompts
- AI feature DPIA
- anonymization vs. pseudonymization for AI
Data Minimization in AI Tool Use
Practical data minimization when sending context to AI tools: what data is necessary, how to anonymize before sending, and how to prevent PII leakage through AI tool inputs.
Objectives
- Apply data minimization principles when composing AI prompts
- Identify PII leakage risks in AI tool workflows
- Implement anonymization before sending data to AI tools
Key concepts
- AI prompt data minimization
- anonymization techniques
- synthetic data for AI
- prompt injection and data leakage
- enterprise AI data controls
4 · High-Risk AI Systems5 topics
High-Risk AI Classification
EU AI Act Annex III high-risk AI system categories, how to classify AI components within a software product, and the consequences of misclassification.
Objectives
- Apply Annex III categories to classify AI components in a given system
- Identify when a software feature crosses into high-risk AI territory
- Describe the consequences of misclassifying a high-risk AI system
Key concepts
- Annex III categories
- critical infrastructure AI
- employment AI systems
- biometric identification
- educational AI
- law enforcement AI
High-Risk AI Deployment Requirements
Mandatory requirements before deploying high-risk AI under the EU AI Act: risk management system, data governance, technical documentation, and logging.
Objectives
- List the mandatory pre-deployment requirements for high-risk AI systems
- Design a risk management system for a high-risk AI feature
- Apply data governance requirements to AI training and deployment pipelines
Key concepts
- risk management system
- data governance for AI
- technical documentation (Article 11)
- event logging
- accuracy and robustness requirements
Conformity Assessment and CE Marking
EU AI Act conformity assessment process for high-risk AI, CE marking obligations, notified bodies, and ongoing post-market surveillance requirements.
Objectives
- Describe the EU AI Act conformity assessment process
- Determine when self-assessment vs. third-party assessment is required
- Design a post-market surveillance process for a high-risk AI system
Key concepts
- conformity assessment
- CE marking for AI
- notified bodies
- self-assessment vs. third-party
- post-market surveillance
- serious incident reporting
Mandatory Human Oversight Requirements
EU AI Act and sector-specific requirements for human oversight of high-risk AI decisions, what 'meaningful human review' requires, and technical implementation of oversight mechanisms.
Objectives
- Define 'meaningful human oversight' under AI regulation
- Design technical mechanisms for regulatory-compliant human oversight
- Identify when automated decision-making requires a human review step
Key concepts
- human-in-the-loop requirements
- meaningful oversight
- override mechanisms
- oversight logging
- automated decision accountability
Prohibited AI Techniques in Development
Technical AI techniques that are prohibited or heavily restricted: subliminal manipulation, social scoring, real-time biometric surveillance, and emotion recognition in regulated contexts.
Objectives
- Identify technical implementations that cross into prohibited AI territory
- Apply the subliminal manipulation test to AI feature designs
- Evaluate edge cases near the boundary of prohibited techniques
Key concepts
- subliminal manipulation techniques
- social scoring prohibition
- biometric surveillance boundaries
- emotion recognition limits
- dark pattern AI
5 · Incident Response & Compliance4 topics
Legal Obligations When AI Causes Harm
Developer and organizational obligations when AI systems cause harm: tort liability, negligence standards, duty of care for AI, and when 'I used Copilot' is not a legal defense.
Objectives
- Apply the duty of care standard to AI development practices
- Analyze causation in AI harm scenarios
- Identify when using an AI tool does not transfer liability to the tool provider
Key concepts
- duty of care for AI
- AI negligence standard
- causation in AI harm
- foreseeability of AI failures
- AI harm case law
Breach Notification for AI-Related Incidents
When AI-related incidents trigger breach notification obligations, timelines under GDPR and US state laws, what constitutes a 'breach' for AI systems, and regulatory notification requirements.
Objectives
- Determine when an AI incident triggers breach notification obligations
- Apply GDPR 72-hour notification requirements to AI failure scenarios
- Draft a breach notification for an AI-related data incident
Key concepts
- GDPR 72-hour notification
- US state breach laws
- AI incident vs. data breach
- notification to individuals
- supervisory authority notification
Regulatory Reporting Obligations
Mandatory regulatory reporting when high-risk AI systems cause serious incidents, EU AI Act serious incident reporting, sector-specific reporting (FDA, financial regulators), and how to manage a regulatory investigation.
Objectives
- Identify when AI failures trigger mandatory regulatory reporting
- Apply EU AI Act serious incident reporting requirements
- Develop a regulatory investigation response plan for an AI incident
Key concepts
- EU AI Act serious incident reporting
- FDA adverse event reporting
- FINRA AI incident reporting
- regulatory cooperation
- self-reporting vs. investigated
Third-Party AI Vendor Accountability
Legal accountability when third-party AI tools cause harm, vendor indemnification clauses, AI tool provider liability limits, and how to structure vendor agreements for AI risk allocation.
Objectives
- Analyze vendor agreements for AI liability allocation
- Negotiate indemnification terms for AI tool use in commercial products
- Design a third-party AI vendor due diligence process
Key concepts
- vendor indemnification
- AI provider liability caps
- contractual risk allocation
- insurance for AI liability
- third-party AI due diligence
6 · Expert AI Liability4 topics
Algorithmic Impact Assessment
Conducting algorithmic impact assessments: harm identification, affected population analysis, and mitigation requirements
Objectives
- Conduct a structured algorithmic impact assessment for a high-risk AI system
- Identify affected populations and proportionate mitigation requirements
Key concepts
- harm taxonomy
- affected population
- impact severity
- likelihood assessment
- mitigation requirements
- AIA documentation
- public consultation
Model Documentation Standards
Creating comprehensive model cards and data sheets that satisfy regulatory requirements and organizational transparency standards
Objectives
- Create regulatory-compliant model cards covering all required disclosures
- Design a model card process that is maintainable and enforceable
Key concepts
- model cards
- datasheets for datasets
- intended use
- out-of-scope uses
- performance benchmarks
- bias disclosures
- limitations
Cross-Jurisdictional AI Compliance
Navigating cross-jurisdictional AI compliance requirements: EU AI Act, NIST AI RMF, China AI regulations, and sector-specific rules
Objectives
- Map AI system requirements across multiple jurisdictions simultaneously
- Identify conflicts between different regulatory regimes and propose compliance strategies
Key concepts
- EU AI Act risk tiers
- NIST AI RMF
- prohibited AI practices
- high-risk AI requirements
- conformity assessment
- notified bodies
- extraterritorial scope
Legal Liability in Autonomous Systems
Understanding legal liability frameworks for autonomous AI systems: product liability, negligence, and emerging AI liability regimes
Objectives
- Apply product liability and negligence frameworks to autonomous AI system failures
- Understand the EU AI Liability Directive and its implications for system design
Key concepts
- product liability
- negligence standards
- strict vs fault-based liability
- AI Act liability directive
- duty of care
- indemnification
- explainability requirements
Levels: Junior, Mid, Senior, and Expert
Explain it in your own words
Graded by AI · no account · 1 questionNo options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.
Already studying AI Liability for Developers?
The assessment measures topic by topic, and your plan skips what you already know.
Open to read. An account is only needed to be measured.
Frequently asked questions
Where should I start studying AI Liability for Developers?
Start with Regulatory Landscape: EU AI Act — Overview for Developers, Prohibited AI Uses, and US AI Policy and NIST AI RMF. The map orders topics by what they depend on, so each one prepares the next.
How long does a full AI Liability for Developers assessment take?
A full assessment of this path takes about 46 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.
Do I need an account to use this page?
No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.