---
title: "Fault for Services, Strict Liability Only for Machines: Wang Liming on Tort Liability When AI Agents Cause Harm"
author: "DCC Editorial"
published: 2026-11-04T04:00:00.000Z
url: https://datacompliancechina.com/posts/wang-liming-ai-agent-tort-liability/
description: "In Tsinghua University Law Journal (《清华法学》) 2026 No. 5, Wang Liming (王利明) of Renmin University sets out how Chinese tort law should handle harm done by AI agents. His answers: an agent is never a liable party, so liability falls on the people along its value chain; AI that provides a service, such as generative AI, is judged by fault, while strict product liability applies only to agents that enter the physical world as tangible things and threaten life, body, health or tangible property; where fault applies, operators and deployers should prove they took reasonable care; multiple actors are not jointly and severally liable by default, but answer in proportion to their causal contribution, with the party closest to the end user carrying the heaviest risk-control duty; open-source and free providers get lighter treatment; causation should be presumed when the evidence sits with the defendant; and the 'mass micro-torts' agents produce, such as leaks of many people's personal information, call for representative and public-interest litigation rather than individual suits. DCC summarizes the article section by section and maps each proposal against the Supreme People's Court's AI Disputes Opinions (法发〔2026〕10号), the PIPL and the Civil Code. Most of Wang's framework is already in the Opinions; the reversal of the burden of proof for service agents, the presumption of causation, and substitute measures for data-subject rights go further."
tags: ["ai-agents", "tort-liability", "product-liability", "fault", "causation", "burden-of-proof", "mass-torts", "personality-rights", "civil-code", "embodied-ai", "open-source"]
laws_cited: ["spc-ai-disputes-opinions", "pipl", "civil-code-personal-info", "ai-agent-standardization-innovation-opinion"]
domains: ["ai-governance", "personal-information"]
account: "china-civil-commercial-law"
original_title: "王利明：论人工智能体应用中的侵权责任认定｜前沿"
original_author: "王利明 (Wang Liming), Researcher, Center for Civil and Commercial Jurisprudence, Renmin University of China"
original_publication: "《清华法学》 (Tsinghua University Law Journal), 2026 No. 5 — excerpted by 中国民商法律网 (China Civil and Commercial Law Network) WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/YWz3PKNizf_O3RreDGgkeA"
source_language: "zh"
---

> **Source: Data Compliance China** — https://datacompliancechina.com/posts/wang-liming-ai-agent-tort-liability/ · China data law, translated and annotated for overseas counsel. Cite as: Data Compliance China, "Fault for Services, Strict Liability Only for Machines: Wang Liming on Tort Liability When AI Agents Cause Harm", https://datacompliancechina.com/posts/wang-liming-ai-agent-tort-liability/
> *Editor's Note — DCC.*
>
> **What this is.** A DCC-framed structured summary of a law-journal
> article, not a translation. Wang Liming (王利明) is a professor at Renmin
> University of China Law School and a researcher at its Center for Civil
> and Commercial Jurisprudence. He is one of the most influential figures in
> Chinese civil law, and was long the leading advocate of the Civil Code's
> separate book on personality rights. The article, *On Determining Tort
> Liability in the Application of AI Agents*, appeared in *Tsinghua
> University Law Journal* (《清华法学》) 2026 No. 5. DCC worked from the
> roughly 4,100-character digest that the 中国民商法律网 channel published
> on November 3, 2026, not from the full journal text. The section
> structure below is the author's; the framing, the mapping to Chinese law
> and the takeaways are DCC's.
>
> **Why it matters.** China has no AI law. The Supreme People's Court's
> [AI Disputes Opinions](/laws/spc-ai-disputes-opinions/) of September 2026
> are the working rules, and they leave the hard questions about agents
> (who is liable, and on what proof) to the Civil Code and the PIPL. Wang's
> article is a comprehensive academic answer to those questions, from a
> scholar whose views have repeatedly carried into legislation. Companion
> reading: Cheng Xiao on
> [fault and statutory duty for generative-AI providers](/posts/genai-provider-fault-statutory-duties/).

## The argument in brief

Wang defines an AI agent (人工智能体) as AI that can perceive its
environment, make decisions autonomously and carry out tasks. Agents
amplify the familiar AI harms, such as fabricated audio and video that
damages reputation, and add physical harm once they act in the real world.
He organizes his answer around four features of agent torts: **several
liability principles** rather than one, **many potential defendants**,
**special kinds of protected interests**, and **harm at mass scale**. His
conclusions:

- An agent is not a civil subject and cannot be liable. Liability stays
  with people: "liability lies with the person, not the thing".
- AI that provides a **service** is judged by **fault**. AI that enters the
  physical world as a **tangible product** is subject to **strict
  liability**.
- Where fault applies, the **burden should shift**: operators and deployers
  should prove they took reasonable care.
- Defendants along the value chain are **not jointly and severally liable
  by default**. Each answers for its own causal contribution, and the
  party closest to the end user bears the heaviest risk-control duty.
- **Causation** is assessed in two steps, factual and then legal, and
  should be **presumed** where the evidence is out of the victim's reach.
- The typical agent harm is a **mass micro-tort**. Where no real damage has
  occurred, the remedy is access, correction and deletion. Where it has,
  courts set damages at their discretion, and representative or
  public-interest litigation should carry the claims.

## 1. What agents harm, and how the law should respond

*DCC summary of Part One.*

**Personality rights and personal information.** Wang sees four new risks:

1. **Mass processing.** Agents gather personal information actively and
   can reassemble a person's identity, behavior and preferences from
   fragments, sweeping in other people's information along the way.
2. **Mass leakage.** In the physical world an agent can encounter and keep
   in long-term memory huge volumes of many people's information, which an
   attack could expose at once.
3. **Fast spread, hard tracing.** Input personal information can turn into
   model weights and keep creating risk later. An agent doing a task
   collects information about its user and any third party it meets, and
   third parties can hardly notice.
4. **Physical-world capture**, such as the cameras on autonomous vehicles
   and drones recording personal information as they operate.

Future AI legislation and judicial interpretations should respond in four
ways, he argues:

- Agents that enter the physical world and threaten personal and property
  safety should follow **product-liability** principles.
- The **notice-and-takedown** rule fits poorly. An agent's output feeds
  directly into execution and is usually not published, so there is
  nothing to take down.
- Data subjects often cannot know what an agent processed about them, or
  whether it is accurate, so the rights of access, correction and deletion
  are hard to use in practice. Developers and providers should be required
  to offer **substitute measures**.
- Data subjects should be able to seek a **personality-rights injunction**.

**Intellectual property.** An agent can search, scrape, download, copy,
edit, adapt, publish and distribute on its own, so copyright infringement
can run through every stage. Wang sorts the cases:

- Use of a work that does not exploit its expressive elements falls outside
  copyright.
- Training on works without authorization should be judged by fair use,
  approached with "prudence and tolerance" to encourage development. The
  factors are purpose and nature of the use, nature of the work, amount and
  proportion used, the measures taken, and the cost of obtaining a
  license.
- Publishing output identical or similar to a work is infringement, with
  damages allocated between user and service provider by fault.

**Physical personality rights and tangible property.** Once agents act in
the physical world, harm extends to life, body and health, and to
property. The threshold question is whether the agent is a **product**,
because that decides whether strict liability applies. Even outside
product liability, Wang would have the agent's provider bear the burden of
proving there is **no causation**, given the many links in the chain and
the opacity of algorithms.

## 2. Which liability principle

*DCC summary of Part Two.*

Wang splits AI torts by what is supplied:

- **Services, typified by generative AI: fault-based liability.** Providing
  a service is in substance providing information. Wrong information
  generally carries no unreasonable danger to person or property.
  Hallucination cannot yet be eliminated, and strict liability would chill
  innovation.
- **Products in the physical world, typified by embodied AI: strict
  liability.** Design or manufacturing defects causing personal or
  property harm fit product liability. The party that creates an abnormal
  danger should bear the cost of preventing it, and producers and
  operators have the most control over development and deployment.

The dividing line, in his words:

> Only where an agent enters the physical world and becomes a tangible
> thing can it be called a product; otherwise it is a service.

Strict liability should apply only when **four conditions** are all met:

1. **Tangibility.** In principle limited to tangible movables, and not
   extended to software.
2. **Physical danger.** The agent enters the physical world, deals with
   people directly, and creates an unreasonable danger to person or
   property.
3. **Foreseeability and controllability** of that threat.
4. **The interest harmed.** Limited to physical personality rights (life,
   body, health) or tangible property rights (ownership, usufruct).

Outside product liability, service providers are liable only for fault.
But to ease the victim's burden, Wang would **reverse the burden of
proof**: operators and deployers would have to prove they exercised
reasonable care.

## 3. Who is liable

*DCC summary of Part Three.*

**The agent is not a civil subject.** However AI develops, it must stay
under human control, and the basic rule is that liability lies with the
person, not the thing. A new liable subject would make sense only if it
had the financial resources to satisfy damage claims, which an AI does
not. For the same reason, vicarious liability does not fit.

**Many defendants.** An agent passes through many stages from development
to use and combines many hardware and software technologies. Product
liability already involves both producers and sellers. Wang's rules for
allocating liability among them:

1. **No automatic joint and several liability.** The actors have no common
   intent to harm, so there is no joint tort, and not necessarily joint
   dangerous conduct either.
2. **Weigh fault and causal contribution** (原因力).
3. **Distance from the end user matters.** Developers and providers that do
   not deal directly with end users, and that have met their compliance
   and contractual obligations, are not liable to third parties for
   downstream AI torts. Those that supply end users directly are best
   placed to control the agent's risk and should bear the heavier
   risk-control duty.
4. **Open-source and free supply.** A party that provides a service on an
   open-source basis, and gave reasonable warning of the risks of use,
   should have its liability reduced or excluded. For parties providing a
   service free of charge, the conditions for liability should be
   stricter.

Insurance should also be used to spread the risk.

## 4. Causation

*DCC summary of Part Four.*

Causation is especially hard for agents, for four reasons:

- the value chain has many actors who usually do not commit a joint tort,
  so each one's contribution must be judged separately;
- an agent is partly autonomous, and its output depends on training data,
  operating environment and user input as well as its design;
- the algorithmic black box makes it harder for victims to show where
  harm arose; and
- some harm is **cumulative**: personal-information harm builds up from many
  acts of collection, processing, calling and output.

Wang therefore treats each actor's conduct as a **partial cause**
(部分因果关系), with liability in proportion to its contribution. He
assesses causation in two steps.

**Factual causation.** A victim may be unable to tie the harm to any single
actor, but viewed as a whole, the agent's operation usually caused it.

**Legal causation,** adjusted for agents by four considerations:

1. **Foreseeability.** If the training data was lawfully sourced and the
   actor took reasonable security measures, it could not foresee the
   particular harm.
2. **Capacity to control risk.** The closer an actor is to the end user,
   and the better it understands the use scenario and the user's needs,
   the better placed it usually is to prevent the harm.
3. **Controllable versus inherent risk.** Where a risk cannot be avoided by
   reasonable existing technical measures, legal causation should not be
   lightly found.
4. **Value judgment.** Whether putting liability on a given actor helps
   prevent harm, allocate risk and promote innovation.

**Presumed causation.** Where the victim cannot reach the evidence, the
algorithm is opaque, and the evidence is mainly in the defendant's hands,
causation should be presumed, to lighten the burden of proof reasonably.

## 5. Mass micro-torts

*DCC summary of Part Five.*

A mass tort harms many victims across a wide area. AI mostly produces
**mass micro-torts** (大规模微型侵权): each victim suffers a small harm, or
just a greater exposure to risk. An agent that scrapes personal information
at scale, or processes it in training without proper cleaning and
anonymization, can easily leak it this way.

- **No real damage:** no claim for damages, but the victim can use the
  rights of correction, access and deletion.
- **Real damage:** the victim may claim damages. Because individual losses
  may be too small to prove, courts in practice set the amount at their
  discretion.
- **Procedure:** substantive and procedural law should work together.
  Representative litigation or public-interest litigation brings in
  organizations and authorities better able to resolve disputes, which
  overcomes the evidentiary difficulty and high cost of individual suits.

## How Wang's framework lines up with current Chinese law

*DCC's mapping.* Most of the framework is already in the SPC's
[AI Disputes Opinions](/laws/spc-ai-disputes-opinions/) (法发〔2026〕10号),
issued in September 2026. The parts that go further
are proposals, not law.

| Wang's position | Where Chinese law stands now | Status |
|---|---|---|
| Service AI is judged by fault | Opinions Art. 3: fault under Civil Code Art. 1165(1) unless a law provides no-fault or presumed-fault liability | Already the rule |
| Product liability only for tangible agents in the physical world | Opinions Art. 9: identify AI products "that have a physical object as their carrier", using the Product Quality Law's definition | Already the rule; Wang adds limits on the harms covered |
| Reverse the burden for service providers: operators and deployers prove reasonable care | For personal-information harm, [PIPL Art. 69](/laws/pipl/) already presumes the handler at fault unless it proves otherwise. Elsewhere, Opinions Art. 3 keeps ordinary fault | Law for PI harm; a proposal beyond it |
| Provider proves no causation, and causation is presumed when evidence is out of reach | Opinions Art. 17: adverse inference where a party controlling evidence refuses without justification to produce it; courts may collect evidence and use experts | Partly covered; presumption is a proposal |
| Notice-and-takedown fits agents poorly | Opinions Art. 7 applies Civil Code Art. 1195 notice-and-takedown to generative-AI providers for generated content | Wang identifies a gap for agents whose output is acted on rather than published |
| Personality-rights injunctions available | Opinions Art. 8, applying the Civil Code's injunction (Art. 997) to AI | Already the rule |
| Substitute measures for access, correction and deletion | PIPL Arts. 45–47 set the rights; no agent-specific substitute exists | Proposal |
| Lighter treatment for open-source providers | Opinions Art. 13: appropriate exemption for open-source developers and providers, considering the license, security measures and disclosure | Already the rule |
| No default joint and several liability; proportionate shares | Civil Code Art. 1172 (separate torts causing the same harm: each answers in proportion; equal shares if that cannot be determined); joint liability under Art. 1168 needs a joint tort | Consistent with the Code |
| Mass micro-torts: court-set damages, representative and public-interest suits | PIPL Art. 69(2) lets courts set damages "according to the actual circumstances" where loss and gain cannot be determined; PIPL Art. 70 lets procuratorates, consumer organizations and CAC-designated bodies sue | Available; see the SPP's [2026 typical cases](/laws/spp-pi-protection-typical-cases-2026/) for public-interest damages in practice |

## What it means for counsel

*DCC's reading.*

**Whoever faces the end user carries the risk.** Wang's test of distance
from the end user, and the SPC's Article 3 factors (the preventive
measures taken by developers and providers, and the user's capacity to
foresee and control harm), point the same way. In an agent deployment, the
company that offers the agent to users is the likeliest defendant. An
upstream model developer that met its compliance and contractual duties
should usually be out of the frame. Contracts between model providers,
agent builders and deployers should reflect that allocation, and so should
the compliance record each keeps.

**Software agents stay on the fault side.** Both Wang and the SPC confine
strict product liability to AI with a physical carrier. A purely software
agent that books, buys or sends is a service, and liability turns on fault.
For personal-information harm, PIPL Article 69 already reverses the
burden. So the practical question for a software-agent deployer is whether
it can prove it was not at fault, and that depends on records: security
measures, authorization scopes, logs and responses to complaints.

**Mass, small harms will be litigated collectively.** Wang's
representative-litigation and public-interest route already exists under
PIPL Article 70. The Supreme People's Procuratorate's November 2026
typical cases show procuratorates setting public-interest damages by
sensitivity, volume and cross-border risk rather than by any one victim's
loss. An agent that leaks or over-collects across many users is the kind
of defendant that framework targets.

**Watch the proposals.** The reversal of the burden of proof beyond PI
cases, the presumption of causation, and substitute data-subject measures
for agents are not law. They are, however, what the leading civil-law
scholar recommends to future AI legislation and judicial interpretations.

---

— *王利明 (Wang Liming), 论人工智能体应用中的侵权责任认定 (On Determining
Tort Liability in the Application of AI Agents), 《清华法学》 (Tsinghua
University Law Journal) 2026 No. 5; excerpted by 中国民商法律网, November 3,
2026. DCC structured summary; mapping and commentary are DCC's.
[Source post (Chinese).](https://mp.weixin.qq.com/s/YWz3PKNizf_O3RreDGgkeA)*

— Not legal advice.