Fault for Services, Strict Liability Only for Machines: Wang Liming on Tort Liability When AI Agents Cause Harm

Editor’s Note — DCC.

What this is. A DCC-framed structured summary of a law-journal article, not a translation. Wang Liming (王利明) is a professor at Renmin University of China Law School and a researcher at its Center for Civil and Commercial Jurisprudence. He is one of the most influential figures in Chinese civil law, and was long the leading advocate of the Civil Code’s separate book on personality rights. The article, On Determining Tort Liability in the Application of AI Agents, appeared in Tsinghua University Law Journal (《清华法学》) 2026 No. 5. DCC worked from the roughly 4,100-character digest that the 中国民商法律网 channel published on November 3, 2026, not from the full journal text. The section structure below is the author’s; the framing, the mapping to Chinese law and the takeaways are DCC’s.

Why it matters. China has no AI law. The Supreme People’s Court’s AI Disputes Opinions of September 2026 are the working rules, and they leave the hard questions about agents (who is liable, and on what proof) to the Civil Code and the PIPL. Wang’s article is a comprehensive academic answer to those questions, from a scholar whose views have repeatedly carried into legislation. Companion reading: Cheng Xiao on fault and statutory duty for generative-AI providers.

The argument in brief

Wang defines an AI agent (人工智能体) as AI that can perceive its environment, make decisions autonomously and carry out tasks. Agents amplify the familiar AI harms, such as fabricated audio and video that damages reputation, and add physical harm once they act in the real world. He organizes his answer around four features of agent torts: several liability principles rather than one, many potential defendants, special kinds of protected interests, and harm at mass scale. His conclusions:

• An agent is not a civil subject and cannot be liable. Liability stays with people: “liability lies with the person, not the thing”.
• AI that provides a service is judged by fault. AI that enters the physical world as a tangible product is subject to strict liability.
• Where fault applies, the burden should shift: operators and deployers should prove they took reasonable care.
• Defendants along the value chain are not jointly and severally liable by default. Each answers for its own causal contribution, and the party closest to the end user bears the heaviest risk-control duty.
• Causation is assessed in two steps, factual and then legal, and should be presumed where the evidence is out of the victim’s reach.
• The typical agent harm is a mass micro-tort. Where no real damage has occurred, the remedy is access, correction and deletion. Where it has, courts set damages at their discretion, and representative or public-interest litigation should carry the claims.

1. What agents harm, and how the law should respond

DCC summary of Part One.

Personality rights and personal information. Wang sees four new risks:

1. Mass processing. Agents gather personal information actively and can reassemble a person’s identity, behavior and preferences from fragments, sweeping in other people’s information along the way.
2. Mass leakage. In the physical world an agent can encounter and keep in long-term memory huge volumes of many people’s information, which an attack could expose at once.
3. Fast spread, hard tracing. Input personal information can turn into model weights and keep creating risk later. An agent doing a task collects information about its user and any third party it meets, and third parties can hardly notice.
4. Physical-world capture, such as the cameras on autonomous vehicles and drones recording personal information as they operate.

Future AI legislation and judicial interpretations should respond in four ways, he argues:

• Agents that enter the physical world and threaten personal and property safety should follow product-liability principles.
• The notice-and-takedown rule fits poorly. An agent’s output feeds directly into execution and is usually not published, so there is nothing to take down.
• Data subjects often cannot know what an agent processed about them, or whether it is accurate, so the rights of access, correction and deletion are hard to use in practice. Developers and providers should be required to offer substitute measures.
• Data subjects should be able to seek a personality-rights injunction.

Intellectual property. An agent can search, scrape, download, copy, edit, adapt, publish and distribute on its own, so copyright infringement can run through every stage. Wang sorts the cases:

• Use of a work that does not exploit its expressive elements falls outside copyright.
• Training on works without authorization should be judged by fair use, approached with “prudence and tolerance” to encourage development. The factors are purpose and nature of the use, nature of the work, amount and proportion used, the measures taken, and the cost of obtaining a license.
• Publishing output identical or similar to a work is infringement, with damages allocated between user and service provider by fault.

Physical personality rights and tangible property. Once agents act in the physical world, harm extends to life, body and health, and to property. The threshold question is whether the agent is a product, because that decides whether strict liability applies. Even outside product liability, Wang would have the agent’s provider bear the burden of proving there is no causation, given the many links in the chain and the opacity of algorithms.

2. Which liability principle

DCC summary of Part Two.

Wang splits AI torts by what is supplied:

• Services, typified by generative AI: fault-based liability. Providing a service is in substance providing information. Wrong information generally carries no unreasonable danger to person or property. Hallucination cannot yet be eliminated, and strict liability would chill innovation.
• Products in the physical world, typified by embodied AI: strict liability. Design or manufacturing defects causing personal or property harm fit product liability. The party that creates an abnormal danger should bear the cost of preventing it, and producers and operators have the most control over development and deployment.

The dividing line, in his words:

Only where an agent enters the physical world and becomes a tangible thing can it be called a product; otherwise it is a service.

Strict liability should apply only when four conditions are all met:

1. Tangibility. In principle limited to tangible movables, and not extended to software.
2. Physical danger. The agent enters the physical world, deals with people directly, and creates an unreasonable danger to person or property.
3. Foreseeability and controllability of that threat.
4. The interest harmed. Limited to physical personality rights (life, body, health) or tangible property rights (ownership, usufruct).

Outside product liability, service providers are liable only for fault. But to ease the victim’s burden, Wang would reverse the burden of proof: operators and deployers would have to prove they exercised reasonable care.

3. Who is liable

DCC summary of Part Three.

The agent is not a civil subject. However AI develops, it must stay under human control, and the basic rule is that liability lies with the person, not the thing. A new liable subject would make sense only if it had the financial resources to satisfy damage claims, which an AI does not. For the same reason, vicarious liability does not fit.

Many defendants. An agent passes through many stages from development to use and combines many hardware and software technologies. Product liability already involves both producers and sellers. Wang’s rules for allocating liability among them:

1. No automatic joint and several liability. The actors have no common intent to harm, so there is no joint tort, and not necessarily joint dangerous conduct either.
2. Weigh fault and causal contribution (原因力).
3. Distance from the end user matters. Developers and providers that do not deal directly with end users, and that have met their compliance and contractual obligations, are not liable to third parties for downstream AI torts. Those that supply end users directly are best placed to control the agent’s risk and should bear the heavier risk-control duty.
4. Open-source and free supply. A party that provides a service on an open-source basis, and gave reasonable warning of the risks of use, should have its liability reduced or excluded. For parties providing a service free of charge, the conditions for liability should be stricter.

Insurance should also be used to spread the risk.

4. Causation

DCC summary of Part Four.

Causation is especially hard for agents, for four reasons:

• the value chain has many actors who usually do not commit a joint tort, so each one’s contribution must be judged separately;
• an agent is partly autonomous, and its output depends on training data, operating environment and user input as well as its design;
• the algorithmic black box makes it harder for victims to show where harm arose; and
• some harm is cumulative: personal-information harm builds up from many acts of collection, processing, calling and output.

Wang therefore treats each actor’s conduct as a partial cause (部分因果关系), with liability in proportion to its contribution. He assesses causation in two steps.

Factual causation. A victim may be unable to tie the harm to any single actor, but viewed as a whole, the agent’s operation usually caused it.

Legal causation, adjusted for agents by four considerations:

1. Foreseeability. If the training data was lawfully sourced and the actor took reasonable security measures, it could not foresee the particular harm.
2. Capacity to control risk. The closer an actor is to the end user, and the better it understands the use scenario and the user’s needs, the better placed it usually is to prevent the harm.
3. Controllable versus inherent risk. Where a risk cannot be avoided by reasonable existing technical measures, legal causation should not be lightly found.
4. Value judgment. Whether putting liability on a given actor helps prevent harm, allocate risk and promote innovation.

Presumed causation. Where the victim cannot reach the evidence, the algorithm is opaque, and the evidence is mainly in the defendant’s hands, causation should be presumed, to lighten the burden of proof reasonably.

5. Mass micro-torts

DCC summary of Part Five.

A mass tort harms many victims across a wide area. AI mostly produces mass micro-torts (大规模微型侵权): each victim suffers a small harm, or just a greater exposure to risk. An agent that scrapes personal information at scale, or processes it in training without proper cleaning and anonymization, can easily leak it this way.

• No real damage: no claim for damages, but the victim can use the rights of correction, access and deletion.
• Real damage: the victim may claim damages. Because individual losses may be too small to prove, courts in practice set the amount at their discretion.
• Procedure: substantive and procedural law should work together. Representative litigation or public-interest litigation brings in organizations and authorities better able to resolve disputes, which overcomes the evidentiary difficulty and high cost of individual suits.

How Wang’s framework lines up with current Chinese law

DCC’s mapping. Most of the framework is already in the SPC’s AI Disputes Opinions (法发〔2026〕10号), issued in September 2026. The parts that go further are proposals, not law.

What it means for counsel

DCC’s reading.

Whoever faces the end user carries the risk. Wang’s test of distance from the end user, and the SPC’s Article 3 factors (the preventive measures taken by developers and providers, and the user’s capacity to foresee and control harm), point the same way. In an agent deployment, the company that offers the agent to users is the likeliest defendant. An upstream model developer that met its compliance and contractual duties should usually be out of the frame. Contracts between model providers, agent builders and deployers should reflect that allocation, and so should the compliance record each keeps.

Software agents stay on the fault side. Both Wang and the SPC confine strict product liability to AI with a physical carrier. A purely software agent that books, buys or sends is a service, and liability turns on fault. For personal-information harm, PIPL Article 69 already reverses the burden. So the practical question for a software-agent deployer is whether it can prove it was not at fault, and that depends on records: security measures, authorization scopes, logs and responses to complaints.

Mass, small harms will be litigated collectively. Wang’s representative-litigation and public-interest route already exists under PIPL Article 70. The Supreme People’s Procuratorate’s November 2026 typical cases show procuratorates setting public-interest damages by sensitivity, volume and cross-border risk rather than by any one victim’s loss. An agent that leaks or over-collects across many users is the kind of defendant that framework targets.

Watch the proposals. The reversal of the burden of proof beyond PI cases, the presumption of causation, and substitute data-subject measures for agents are not law. They are, however, what the leading civil-law scholar recommends to future AI legislation and judicial interpretations.

— 王利明 (Wang Liming), 论人工智能体应用中的侵权责任认定 (On Determining Tort Liability in the Application of AI Agents), 《清华法学》 (Tsinghua University Law Journal) 2026 No. 5; excerpted by 中国民商法律网, November 3, 2026. DCC structured summary; mapping and commentary are DCC’s. Source post (Chinese).

— Not legal advice.