AI Risk Disclosure Claims in Europe

1. Meaning of AI Risk Disclosure Claims

AI risk disclosure claims arise where a developer, provider, deployer, manufacturer, employer, financial institution, public authority, professional or other organization uses an AI system but fails to adequately disclose material risks associated with that system.

The risk may concern:

known limitations of an AI model;

hallucinations or inaccurate outputs;

bias and discriminatory effects;

cybersecurity vulnerabilities;

privacy risks;

automated decision-making;

biometric identification;

safety risks;

lack of human oversight;

foreseeable misuse;

training-data limitations;

reliability problems;

material changes to an AI system;

risks associated with autonomous operation.

There is no single European cause of action called “AI risk disclosure liability.” Instead, claims may arise under:

EU AI regulation;

GDPR;

product liability;

consumer protection;

financial-services regulation;

securities/investor protection;

contract law;

professional negligence;

tort/delict law;

employment law;

administrative law;

fundamental-rights law.

The central legal question is:

Did the responsible actor provide sufficient, accurate and timely information about reasonably foreseeable AI risks so that users, consumers, employees, authorities or other affected persons could make an informed decision and protect themselves?

2. Why Risk Disclosure Is Particularly Important for AI

Traditional products generally have relatively identifiable characteristics.

AI systems can behave differently because of:

probabilistic outputs;

changing models;

continuous learning;

uncertain predictions;

context-sensitive performance;

training-data limitations;

emergent behaviour;

model updates;

interaction with other systems.

Consequently, an AI provider may have a duty to disclose not only what the system does, but also where it can fail.

For example:

“This system provides automated medical recommendations.”

may be insufficient where users reasonably need to know:

“The system has not been validated for this patient population and its recommendations require independent professional verification.”

3. Main Types of AI Risk Disclosure Claims

A. Failure to Disclose Safety Risks

An AI-enabled product may cause physical injury because the manufacturer failed to warn about:

unsafe autonomous behaviour;

sensor limitations;

model failure;

cybersecurity vulnerabilities;

unsafe operating conditions.

This may produce product-liability or negligence claims.

B. Failure to Disclose Accuracy Limitations

AI systems can have different error rates among different populations.

For example, an identification system might be less accurate for particular demographic groups.

A failure to disclose significant limitations may become relevant to:

consumer claims;

discrimination claims;

professional negligence;

product liability;

regulatory liability.

C. Failure to Disclose Automated Decision-Making

Where AI makes or materially influences decisions about individuals, the affected person may need information concerning:

existence of automated decision-making;

logic or significance involved;

consequences;

available safeguards;

human intervention;

challenge mechanisms.

GDPR requirements become particularly important here.

4. GDPR and AI Risk Disclosure

The GDPR is one of the most important legal frameworks for AI disclosure claims.

Relevant provisions include:

Articles 12–14 — transparency and information;

Article 15 — access;

Article 22 — automated individual decision-making;

Article 35 — data protection impact assessment;

Article 82 — compensation.

AI systems using personal data therefore cannot necessarily be treated as opaque technological “black boxes” where the law requires meaningful information.

5. Google Spain — C-131/12

Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, C-131/12 (13 May 2014)

Importance

The CJEU recognized important responsibilities associated with large-scale processing of personal information by search engines.

AI relevance

Modern AI systems can process and infer enormous quantities of personal information.

Risk disclosure issues may therefore concern:

what personal information is processed;

how it is used;

whether information is combined;

what consequences may result;

how individuals can exercise their rights.

Google Spain is not an AI-risk-disclosure case in the narrow sense, but it provides an important foundation for understanding accountability for technologically complex data processing.

6. SCHUFA — C-634/21

SCHUFA Holding AG (Scoring), C-634/21 (7 December 2023)

This is one of the most important modern authorities for AI-related disclosure.

The CJEU considered automated scoring under Article 22 GDPR.

The Court held, in substance, that a score may fall within Article 22 where the recipient of the score gives it a decisive role in making the final decision.

AI risk-disclosure significance

An organization cannot necessarily avoid automated-decision rules simply by inserting a human somewhere in the process.

For example:

AI score → official receives score → official routinely accepts score → person denied service

may raise Article 22 concerns.

Risk disclosure may therefore need to address:

existence of automated scoring;

significance of the score;

role of human decision-makers;

consequences for the individual;

available challenge mechanisms.

7. Meta Platforms — C-252/21

Meta Platforms Ireland Ltd v Bundeskartellamt, C-252/21 (4 July 2023)

The CJEU considered the interaction between competition law and GDPR.

The case demonstrates that data protection cannot necessarily be treated as an isolated compliance issue.

AI relevance

AI businesses frequently rely on enormous datasets.

The legal risks associated with:

data collection;

profiling;

combining datasets;

targeted services;

behavioural analysis

may therefore intersect with competition and consumer law.

An organization's statement that:

“Users agreed to the data processing”

does not automatically resolve all legal questions.

8. Österreichische Post — C-300/21

Österreichische Post AG v UI, C-300/21 (4 May 2023)

This case concerns compensation under Article 82 GDPR.

The CJEU clarified that:

infringement of GDPR alone does not automatically establish compensable damage;

damage and causation are necessary;

non-material damage does not require an additional threshold of seriousness.

AI disclosure significance

Suppose an AI system unlawfully processes personal data because individuals were inadequately informed.

The claimant may potentially seek compensation where the disclosure failure results in legally recognizable damage and the necessary causal connection is established.

Thus:

Disclosure duties can have financial consequences when their breach causes compensable harm.

9. NAP v VB — C-340/21

VB v NAP, C-340/21 (14 December 2023)

The CJEU addressed non-material damage in the context of personal-data security.

The Court recognized that a well-founded fear concerning misuse of personal data can, in appropriate circumstances, constitute compensable non-material damage.

AI relevance

AI systems may contain:

biometric information;

behavioural profiles;

employment information;

financial information;

health information;

identity information.

Failure to disclose material cybersecurity or data-processing risks may therefore have consequences beyond regulatory penalties.

10. Product Liability and AI Risk Warnings

AI-enabled products create another major category of risk disclosure.

Examples include:

autonomous vehicles;

AI medical devices;

robots;

AI-controlled industrial equipment;

smart appliances;

autonomous drones.

A product can potentially be defective because of inadequate warnings or instructions, not merely because its software contains an error.

The relevant question is essentially:

Did the product provide the level of safety that persons were entitled to expect?

11. Boston Scientific — C-503/13 and C-504/13

Boston Scientific Medizintechnik GmbH and Others v AOK Sachsen-Anhalt and Betriebskrankenkasse RWE, Joined Cases C-503/13 and C-504/13 (5 March 2015)

This important product-liability decision concerned medical devices.

The CJEU accepted that products can be considered defective where they present an abnormal potential for damage even if the specific product involved has not yet actually malfunctioned.

AI significance

The principle is highly relevant to AI-enabled medical devices.

Suppose an AI medical device has a known elevated risk of erroneous recommendations.

If the manufacturer knows about the risk but fails to:

warn users;

issue appropriate instructions;

update the system;

provide appropriate monitoring,

product-liability arguments may become stronger.

The case is not about AI, but it provides an important safety-expectations framework.

12. Sanofi Pasteur — C-621/15

W and Others v Sanofi Pasteur MSD SNC and Others, C-621/15 (21 June 2017)

The CJEU considered evidentiary questions concerning product liability and causation.

AI relevance

AI cases often involve complicated causal chains.

For example:

AI design limitation → inadequate warning → user reliance → injury

The claimant may need to establish the relationship between the alleged defect, inadequate disclosure and damage.

The case demonstrates the importance of evidence in technically complex product-liability litigation.

13. Consumer Protection and AI Risk Disclosure

AI services supplied to consumers may be subject to consumer-protection rules concerning:

misleading omissions;

unfair commercial practices;

material information;

contractual transparency;

digital services;

product characteristics;

foreseeable risks.

A company may therefore face liability if marketing creates the impression that an AI product is:

completely accurate;

autonomous;

unbiased;

safe;

professionally equivalent;

incapable of making significant errors,

when those claims are materially misleading.

14. Failing to Disclose AI Limitations as a Misleading Omission

Consider an AI financial service advertised as:

“Our AI identifies the best investments.”

But the provider knows that:

the system frequently hallucinates financial information;

outputs are not independently verified;

the system is unsuitable for particular markets.

Failure to disclose those limitations could potentially support consumer or professional-liability claims.

The key question is whether the omitted information was material to the decision of the consumer or other user.

15. AI Risk Disclosure and Professional Liability

AI is increasingly used by:

doctors;

lawyers;

accountants;

financial advisers;

engineers;

architects;

public officials.

A professional who relies on AI may have obligations to disclose:

AI involvement;

material limitations;

need for human verification;

uncertainty;

relevant conflicts;

known error risks.

For example, a lawyer cannot necessarily avoid professional responsibility by saying:

“The AI generated the legal analysis.”

The professional remains responsible for the exercise of professional judgment.

16. AI Medical Risk Disclosure

Healthcare is one of the most sensitive fields.

An AI medical system may have limitations concerning:

patient population;

disease type;

imaging conditions;

training data;

false-positive rates;

false-negative rates;

clinical validation.

Failure to disclose such limitations can potentially produce:

medical negligence;

product liability;

informed-consent disputes;

data-protection claims;

contractual claims.

The risk becomes especially serious where a clinician reasonably relies upon the AI because the provider represented it as highly reliable.

17. AI Employment Risk Disclosure

Employers using AI systems for:

recruitment;

promotion;

dismissal;

performance evaluation;

workplace monitoring

may need to address transparency issues.

An employee may challenge:

undisclosed automated evaluation;

hidden profiling;

discriminatory algorithms;

covert monitoring;

unexplained employment decisions.

López Ribalda v Spain

López Ribalda and Others v Spain, Applications Nos. 1874/13 and 8567/13, Grand Chamber (17 October 2019)

The ECtHR considered covert workplace surveillance.

Although the case involved video surveillance rather than AI, its proportionality analysis is highly relevant to AI employee-monitoring systems.

The more intrusive the technology, the greater the need for adequate legal justification and safeguards.

18. AI Facial Recognition and Risk Disclosure

AI facial recognition creates special disclosure problems.

Individuals may not know:

that they are being scanned;

where their biometric information is stored;

how long it is retained;

whether it is shared;

whether automated identification is occurring;

whether the system has significant error rates.

Glukhin v Russia

Glukhin v Russia, Application No. 11519/20 (ECtHR, 4 July 2023)

The ECtHR examined the use of facial-recognition technology by public authorities.

The case demonstrates that AI biometric identification can engage Article 8 ECHR.

For public authorities, disclosure is therefore connected with broader requirements of:

legality;

necessity;

proportionality;

safeguards.

19. AI Risk Disclosure and Discrimination

Risk disclosure cannot be separated entirely from equality.

Suppose a company knows that an AI recruitment system produces substantially different outcomes for different demographic groups but does not disclose or investigate this risk.

Potential consequences include:

discrimination claims;

negligence;

regulatory enforcement;

employment claims;

consumer claims.

CHEZ — C-83/14

CHEZ Razpredelenie Bulgaria AD v Komisia za zashtita ot diskriminatsia, C-83/14 (16 July 2015)

The CJEU's treatment of indirect discrimination is highly relevant to algorithmic systems.

A system can create discriminatory effects even when the algorithm does not explicitly state:

“Treat group X differently.”

This means risk assessments should examine outcomes, not merely the formal variables used by the algorithm.

20. AI Surveillance and Disclosure

Big Brother Watch v United Kingdom

Big Brother Watch and Others v United Kingdom, Applications Nos. 58170/13, 62322/14 and 24960/15, Grand Chamber (25 May 2021)

The case concerned large-scale governmental surveillance.

It is relevant to AI because AI can transform large-scale surveillance data into:

facial matches;

behavioural profiles;

predictive assessments;

relationship maps;

automated alerts.

The case emphasizes the importance of safeguards around governmental surveillance.

21. AI Biometric Risk Disclosure

S. and Marper v United Kingdom

S. and Marper v United Kingdom, Applications Nos. 30562/04 and 30566/04, Grand Chamber (4 December 2008)

The ECtHR addressed retention of biometric and genetic information.

The case supports the principle that sensitive personal information requires strong safeguards.

AI systems that use biometric information therefore raise disclosure questions concerning:

collection;

retention;

purpose;

access;

sharing;

deletion;

automated analysis.

22. What Counts as a Material AI Risk?

Not every technical limitation must necessarily be disclosed.

A useful distinction is:

Minor technical limitation

Usually unlikely to generate liability by itself.

Material operational limitation

Potentially requires disclosure.

Significant safety limitation

Strong disclosure concern.

Known serious defect

Failure to disclose may significantly increase liability exposure.

Risk that defeats the main purpose of the product

Very strong disclosure concern.

Examples of potentially material information:

high error rates;

known bias;

inability to operate reliably in particular conditions;

significant hallucination risk;

lack of validation;

cybersecurity vulnerability;

inability to explain decisions where explanation is legally necessary;

need for professional verification;

known limitations affecting vulnerable populations.

23. Who Owes the Disclosure Duty?

Potentially responsible actors include:

AI developer

Must address known system limitations and technical risks.

AI provider

May have duties concerning instructions, system capabilities and limitations.

Manufacturer

May have product-safety and warning obligations.

Deployer

Must understand the risks of the system it chooses to use.

Employer

May have employee-information and privacy obligations.

Public authority

May have administrative-law and fundamental-rights obligations.

Professional

May have professional duties to verify AI output and inform clients/patients where appropriate.

24. AI Risk Disclosure and the AI Act

The EU AI Act strengthens the regulatory framework surrounding AI transparency and risk management.

Relevant concepts include:

risk management;

technical documentation;

instructions for use;

transparency;

human oversight;

accuracy;

robustness;

cybersecurity;

monitoring;

incident reporting.

For high-risk systems, the information provided to deployers and users becomes particularly important.

However:

AI Act compliance does not automatically provide immunity from civil liability.

Likewise:

An AI Act violation does not automatically establish every element of a private damages claim.

The claimant must still identify the relevant cause of action and satisfy its legal requirements.

25. Failure to Disclose Versus False Disclosure

There are two principal forms of liability.

1. Misrepresentation

The organization gives incorrect information.

Example:

“Our AI has a 99.9% accuracy rate.”

when the provider knows the figure is materially misleading.

2. Material omission

The organization says something technically true but fails to disclose a significant limitation.

Example:

“The system has 95% accuracy.”

while failing to disclose that its accuracy falls dramatically for a particular population.

The second category is especially important for AI.

26. Causation

Disclosure claims require careful causation analysis.

A claimant may need to demonstrate:

Failure to disclose → reliance or inability to protect oneself → harmful event → damage.

For example:

Provider knew of an important AI safety limitation.

Provider failed to disclose it.

User reasonably relied on the system.

User would have acted differently if informed.

AI malfunction occurred.

Damage resulted.

The absence of disclosure becomes legally important because it changed the claimant's opportunity to avoid the harm.

27. Defences Available to AI Providers

Potential defences include:

Adequate disclosure

The relevant risk was clearly communicated.

User sophistication

The claimant was a professional who understood the limitations.

No reliance

The claimant did not rely on the allegedly misleading information.

No causation

The harm would have occurred regardless of disclosure.

Unforeseeable risk

The risk could not reasonably have been known.

Regulatory compliance

The provider complied with applicable regulatory requirements.

However, regulatory compliance is generally not automatically a complete defence to all private claims.

28. Evidence in AI Risk Disclosure Litigation

Important evidence may include:

technical documentation;

model cards;

system cards;

risk assessments;

impact assessments;

testing results;

validation studies;

incident reports;

internal emails;

safety reports;

cybersecurity assessments;

bias testing;

user manuals;

warnings;

terms of service;

marketing material;

training records;

audit reports;

AI Act compliance documentation.

Internal documents are particularly significant if they demonstrate:

The organization knew about the risk but failed to warn users.

29. European Case-Law Table

30. Six Most Important Authorities

If only six cases need to be cited in an AI risk-disclosure argument, a strong selection would be:

1. SCHUFA — C-634/21

Automated scoring and meaningful human decision-making.

2. Österreichische Post — C-300/21

GDPR damage and compensation.

3. Google Spain — C-131/12

Accountability for technologically sophisticated personal-data processing.

4. Boston Scientific — C-503/13 & C-504/13

Safety expectations and product defects.

5. Glukhin v Russia — App. 11519/20

AI facial recognition and privacy.

6. Big Brother Watch v UK — Apps. 58170/13, 62322/14 & 24960/15

Governmental technological surveillance and safeguards.

CHEZ, NAP v VB, S. and Marper and López Ribalda provide additional strong authorities.

31. Practical Legal Test

A European AI risk-disclosure claim can be organized around the following questions:

1. What AI system was used?

Identify the model, product, service or automated process.

2. What risk existed?

Identify the technical, legal, safety, privacy, discrimination or cybersecurity risk.

3. Was the risk reasonably foreseeable?

Was it known, discoverable through testing, or reasonably predictable?

4. Was it material?

Would reasonable users or affected persons consider it important?

5. Was adequate information provided?

Examine warnings, notices, terms, instructions and explanations.

6. Was the information accurate?

Misleading claims can be more serious than simple incompleteness.

7. Did the claimant reasonably rely on the information?

Reliance is particularly important in consumer, contract and negligence claims.

8. Did the failure cause harm?

Establish the causal connection.

9. What type of harm occurred?

Financial, physical, privacy, discrimination, reputational or non-material harm.

10. What remedy is available?

Potential remedies include:

damages;

injunction;

correction;

cessation;

deletion;

reconsideration;

contractual remedies;

regulatory enforcement.

32. Conclusion

AI risk disclosure claims in Europe are an emerging but increasingly important area of liability. There is not yet a single autonomous European cause of action for “failure to disclose AI risk.” Instead, liability is assembled from GDPR, consumer law, product liability, negligence, contract, equality law, administrative law and fundamental-rights principles.

The strongest recurring principle is:

The greater the foreseeable consequences of relying upon an AI system, the greater the importance of accurate information about its capabilities, limitations and risks.

The SCHUFA judgment is particularly important for automated decision-making; Österreichische Post and NAP v VB clarify compensation for data-related harm; Boston Scientific provides a useful product-safety framework; while Glukhin, Big Brother Watch, S. and Marper, and López Ribalda demonstrate the importance of transparency, safeguards and proportionality when AI-like technologies affect privacy and fundamental rights.

Accordingly, an AI risk-disclosure claim will generally become strongest where there is a combination of:

known or foreseeable AI risk + material omission/misrepresentation + inadequate warning or transparency + reasonable reliance or affected rights + causation + legally recognized damage.

Available next action: Create a downloadable PDF file here in this chat containing the findings and recommendations above