Congress makes AI developers or deployers liable for AI harms

Where things stand (as of 13 Oct 2026)

No qualifying law exists, and Congress is in recess until after the 3 Nov midterms. Every AI bill that has actually moved this Congress leaves out a private damages remedy:

• The House KIDS Act (H.R.7757; passed 267-117 on 29 Jun 2026) is enforced only by the FTC and state attorneys general, and it says it does not change Section 230.
• The Senate Commerce package (KOSA, the Cruz-Schatz CHATBOT Act, the Youth AI Privacy Act and the AI toy act, reported 5 Aug) has the same FTC/state AG enforcement. I OCR'd the committee amendments. The Youth AI Privacy Act as introduced let parents sue for actual and punitive damages, but the committee adopted Lummis amendment 2, "To strike the private right of action."
• The GUARD Act (reported 30 Apr) relies on attorney general suits and criminal penalties.
• Rand Paul blocked KOSA by unanimous consent on 30 Sep.

The bills that would qualify are all early-stage:

• the AI LEAD Act (S.2937), with 4 cosponsors and no Judiciary Committee action since Sept 2025;
• the Hawley-Murphy AI Agent Accountability Act, which would extend the computer-hacking law's (CFAA) civil action to AI agent developers and operators; it was announced 1 Oct with no text yet;
• Trahan's CLAIM Act, released as a discussion draft on 7 Oct.

Blackburn's March "TRUMP AMERICA AI Act" draft folded the AI LEAD Act in as Title VII, which includes a federal cause of action (§731). The Thune-Cruz-Klobuchar catastrophic-risk "duty of care" bill, as reported, appears to be government-enforced and to preempt some state laws. The Obernolte-Trahan GAAIA and FRONTIER drafts rely on fines and injunctions.

Polymarket puts any AI safety bill before 2027 at 4.5%, and those odds mostly reflect bills that would not qualify here.

Reference class and base rate

Since 2000, Congress has rarely created liability aimed at a technology's makers or operators. FOSTA (2018) is the main example. More often it has passed shields: Section 230, the Y2K Act, PLCAA, Price-Anderson. When it has created private remedies for tech harms (TCPA, VAWA 2022, DEFIANCE), they mostly target misusers, a category this question excludes. That points to a low base rate, roughly 1–3% a year.

Adjustments

Some factors push the rate up:

• AI risk salience is extraordinary: the July agent breach of Hugging Face, Anthropic's bio-threshold disclosure, and 73% of the public saying firms aren't doing enough.
• Democrats are favoured to win the House and Silver Bulletin gives them 73% for the Senate.
• Liability is a point where several camps meet. Bessent told Congress not to give AI labs a liability exemption and said "creators are liable for what they build"; Sacks and Ferguson describe developers as bearing liability. Hawley and the Democrats push it too.
• The question counts narrow provisions: a Section 230 carve-out for AI outputs, removal of an "AI acted autonomously" defence, a CFAA extension, or possibly AI-pricing bans with private rights of action, if they expressly address AI.
• Thin markets give 34.5% (Polymarket) for a comprehensive federal AI framework law by end-2027, and 44–48% bid/ask on Kalshi for a federal AI kill-switch law by then.

Other factors push it down:

• Private rights of action keep getting stripped in this Congress.
• Industry super PACs are spending heavily, and House Democrats' AI commission is industry-friendly.
• Trump calls AI risk a "hoax" and can veto until January 2029; the filibuster still applies.
• The White House's March framework wanted to limit developer liability for third-party misuse.
• When a technology is deemed strategic, Congress has often responded with a shield or a compensation fund instead, which would resolve NO here.

Hazard model

Period	Annual hazard	Main driver
Q4 2026 (lame duck)	~0.6%	No qualifying bill near the floor
2027–28	~5–6%	Democratic Congress, but Trump veto
2029–31	~6–6.5%	About 1/3 chance of a Democratic trifecta, which I give roughly a 35% chance of producing a qualifying law

Within each year, Q4 carries more hazard (NDAA, year-end packages) and the first quarter of each new Congress less. Accumulating these gives about 11.5% by end-2028 and about 27% by end-2031.

The strongest case against a lower number is that, if a broad AI package passes in 2027–28 (markets imply 35–45%), at least one liability-type provision is quite likely to ride along. The strongest case against a higher number is Congress's 25-year failure to legislate tech liability.

Sources: Congress.gov API (bills S.2937, S.1829, S.3062, S.4199); Senate Commerce markup amendment PDFs (5 Aug 2026); Pillsbury and Tech Policy Press on the KIDS Act (30 Jun); hawley.senate.gov (1 Oct); trahan.house.gov (7 Oct); Spokesman/Reuters (11 Sep) and Nextgov (Sep) on the Thune-Cruz-Klobuchar bill; FedScoop (Sep) on Bessent; TNW on Sacks; Lawfare (10 Apr) on the White House framework; Polymarket gamma API; Kalshi API; Newsweek/Silver Bulletin (Oct); Transformer (10 Oct).

Question. By the last day of each quarter, has the US Congress enacted a law making AI developers or deployers civilly liable for harm caused by their AI models or agents, beyond the law in place when this question opened?

Definitions.

• Enacted law: a US federal statute that has become law through presidential signature, veto override, or the constitutional process without signature. A later commencement date does not prevent qualification. A qualifying provision may be one part of a larger law.
• Developer: an entity that develops or commissions development of a model and supplies it under its name, including an entity legally treated as the model's manufacturer or producer. This question is not limited to covered developers.
• Deployer: a person or entity that operates an AI model or agent, directs one to act, or makes one available to others, including a business using a third-party model to act or communicate on its behalf. The law's own definitions of developers, deployers, operators, or providers of AI apply. Liability imposed solely on persons who only submit inputs to someone else's model or agent does not count.
• AI models or agents: any system within the law's own definition of artificial intelligence or, absent one, 15 U.S.C. 9401(3), including chatbots and systems that act in software or control a device.
• Civilly liable: subject to an obligation, enforceable in a civil action by the harmed person, their representative or estate, or a class of harmed persons, to pay damages or other monetary compensation. Fault-based and no-fault liability both count.
• Harm caused by their AI models or agents: injury to a person's life, body, mental health, property, finances, privacy, or other legally protected interests from content, decisions, or recommendations the developer's or deployer's AI generates, or from actions its agent takes. Human prompting, misuse, or intervening action does not disqualify a claim.
• Beyond the law in place: creating or expanding liability compared with federal law enacted before the opening date, including provisions with deferred application dates, by: adding a federal cause of action, even if state law already allows similar claims; extending an existing federal one to AI developers or deployers, additional harmed persons, or categories of AI-caused harm, such as the civil action in 18 U.S.C. 1030(g); removing or narrowing an immunity or defence that bars harmed persons' claims, such as 47 U.S.C. 230 for claims arising from AI outputs or a defence that the AI acted autonomously, whether or not courts had already applied it to such claims; or removing or raising a statutory cap on compensation. The provision must expressly address AI or its outputs, or, in a general software or product-liability law, expressly include AI or software; a general repeal or sunset of 47 U.S.C. 230 does not count.

Resolves YES if a new enactment on or after the opening date contains at least one operative provision meeting all the definitions above. The enacted text must itself establish the liability, not authorize a future decision on it. Sections 101 and 301 of the AI LEAD Act (S.2937) as introduced would qualify.

Resolves NO / Exclusions.

• Remedies that only an attorney general or agency can obtain, such as fines and civil penalties.
• Criminal liability, insurance mandates, and compensation funds without developer or deployer liability.
• Procedural or evidentiary changes alone, including disclosure duties, presumptions of causation or fault, and collective-action procedures.
• Liability shields that bar or preempt claims for AI-caused harm and leave a narrower claim, such as one limited to willful misconduct, as the exclusive remedy.
• Liability only on auditors, evaluators, or other third parties, or on whoever produces, solicits, or distributes content regardless of whether they developed or deployed the AI that generated it, as under the DEFIANCE Act.
• Intellectual-property and voice or likeness claims; claims about training, training data, or data collection; and claims based only on failing to obtain consent, give notice, disclose, label content, verify age, or protect data.

Resolving source. Enactment status and operative text: Congress.gov's bill Actions and Public Law records, with the authenticated public-law text on GovInfo controlling discrepancies; these, not Public confirmation (A2), control. Apply the Resolution window and Resolution date (A3), using the first official publication documenting completed enactment and the operative provisions.