On a reporting list in an English hospital, a scan is read with an AI triage tool and a small tumour is missed. The patient's lawyer, the hospital Trust, the radiologist and the company that built the model will each want to know who pays. Existing doctrine already pointed toward answers, but almost no AI case had reached an English court. In July 2026 a taskforce of senior judges and practitioners set out how that doctrine applies, and its analysis puts the hospital first in line.
Practical takeaway. The UK Jurisdiction Taskforce's Legal Statement on Liability for AI Harms says English law already covers AI harms. On the statement's analysis as practitioners summarize it, a hospital Trust carries a non-delegable duty to its patients and cannot shift it to the AI developer; if the developer is also liable for the same damage, the Trust may seek a contribution, and any contractual indemnity works alongside that claim. A clinician can also be liable for not using an effective AI tool. The statement is not binding on courts.
Who wrote the July 2026 statement, and how much weight does it carry?
The UK Jurisdiction Taskforce was set up in 2020 under the chairmanship of the Master of the Rolls, Sir Geoffrey Vos, to state how English private law applies to new technology. Its earlier statement on cryptoassets and smart contracts was cited by courts within months. The new statement runs to about 130 pages, according to the Law Society Gazette's report of 9 July 2026, and followed a public consultation on a draft earlier in the year. Vos said commentators had expressed "genuine uncertainty about how common law concepts can be applied in the AI age" and that the statement would provide "much needed certainty and predictability in an area where few cases have reached the courts".
The scope is deliberately narrow. It covers non-deliberate harm under the private law of England and Wales and leaves out criminal law, public law, intellectual property and regulatory duties. It describes the law as its authors find it and makes no reform proposals. That restraint is the source of its authority: a judge who meets an AI claim for the first time can treat the statement as a careful reading of existing doctrine, without having to adopt a policy position.
Can a Trust point at the developer when a diagnostic tool fails?
No, on the statement's analysis. The first principle is simple: AI has no legal personality, so the system itself can never be the defendant. Liability attaches to a person, whether developer, system provider, deploying organisation or individual user. Our reading of Delaware's draft AI Company Act, which would let an AI agent manage a firm, showed how far corporate law can stretch to give an agent a role; English private law, on this statement, keeps the human or corporate actor answerable for whatever the agent does.
The second principle decides the hospital case. The official LawtechUK page was not retrievable when this post was prepared, so the passages below follow practitioner readings, with paragraph numbers as Clyde & Co's Adam Hudson reported them on 23 July 2026. Clyde & Co places the point at paragraph 36: a Trust deploying AI diagnostic tools "continues to hold a non-delegable duty of care to patients". As Browne Jacobson's Naiomh O'Reilly and David Hill summarize it on 30 October 2026, an organisation such as an NHS Trust "cannot escape liability for harm caused by a defective AI diagnostic tool simply by pointing to the developer's fault", because the duty to provide competent care is non-delegable. The patient sues the Trust. If the developer is also liable for the same damage, the Trust may claim a contribution under the Civil Liability (Contribution) Act 1978, which a court assesses as just and equitable having regard to each party's responsibility. That statutory route is separate from any contractual indemnity in the procurement agreement, which can add to the Trust's recovery or, through caps and exclusions, shape what the developer will pay in practice.
The statement treats contract as the primary tool for allocating risk along an AI supply chain, with negligence covering parties who have no contract with each other. The path that many claimants would prefer, strict product liability, is largely closed. Burges Salmon's summary of 7 July 2026 reports the statement's view that pure-software AI is unlikely to count as "goods" under the Consumer Protection Act 1987, and that the Law Commission plans to review the Act, including the status of software.
When does not using AI become negligence?
This is the finding practitioners keep quoting. The statement says a professional can be liable for failing to use AI where a competent practitioner would have done so. Its clinical example, at paragraph 67 on Clyde & Co's reading, is the radiologist who does not use an effective AI tumour-detection tool available at reasonable cost, as Browne Jacobson describes it. The Gazette reports a parallel example for lawyers: a solicitor who does not advise that AI-assisted review could handle a large volume of disclosure documents.
The test is the ordinary one for professional negligence, applied to a moving target. In clinical negligence the standard of care has long been set by what a responsible body of practitioners would do, and that standard shifts as practice changes. As effective tools become cheap and widespread, the threshold rises. A hospital that has bought an AI tool and leaves it switched off, or a clinician who overrides it without a reason, will find that choice examined. Browne Jacobson adds that, on the statement's analysis, AI does not lower the standard of care, so clinicians remain answerable for how they oversee AI outputs.
Causation is the hardest part, and the statement says so. The usual "but for" test applies, but an opaque model can make the counterfactual hard to prove. Clyde & Co quotes paragraph 107 as seeing "no reason in principle" why the material-contribution approach cannot apply to AI-caused harm. Browne Jacobson and Burges Salmon both report that the statement also treats the Fairchild exception for material increase in risk as a possible route where the autonomy of a system makes the conventional counterfactual impossible to establish. Expert evidence, including simulated runs of the model under different inputs, will carry these cases.
What the MHRA Commission adds, and where the European Union differs
The UKJT statement deals with redress after harm. The MHRA National Commission's recommendations for a future regulatory framework, published on 10 September 2026 in a 119-page report, deal with which systems should reach patients in the first place. Browne Jacobson reports that the Commission drew on more than 760 responses and recommends lifecycle regulation, post-market surveillance, meaningful human oversight, transparency in procurement and patient communication, and better incident reporting. The MHRA says a cross-government response will follow separately.
The two documents interlock in practice. Post-market surveillance and incident reports become the material from which a court will decide what a competent Trust knew about a tool's error rate, and procurement transparency shapes the indemnities and caps that sit beside the Trust's statutory contribution claim against the developer.
The European Union has taken a different path on software. The new EU Product Liability Directive, (EU) 2024/2853, expressly treats software, including AI systems, as a product, and member states must apply it to products placed on the market after 9 December 2026. A patient harmed by the same diagnostic model in Dublin or Rotterdam may therefore have a strict-liability claim against the manufacturer that, on the UKJT's reading of the 1987 Act, a patient in Leeds would not. For vendors selling into both markets, the English route runs through negligence and contract, and the EU route also runs through defect, without proof of fault.
How Quentir Reads It
The statement moves the practical question in English healthcare from "who is at fault inside the model" to "what did the deploying organisation know, and what did its contracts say". That puts the weight on governance documents that hospitals already produce: procurement terms, clinical safety cases, incident logs and committee minutes. It also means the standard of care will be set by practice, tool by tool, as effective systems spread.
The same logic may reach past diagnostic AI, though no court or regulator has applied it there. A court could ask whether a Trust's non-delegable duty extends to the systems through which care is delivered, including the cryptography protecting patient records; nothing in the statement, as summarized, decides that. Our Medicine Monitor's reading of Forescout's October 2026 healthcare report found post-quantum-capable protocols still rare among connected medical devices. If a recognised standard such as NIST's post-quantum transition schedule makes migration a step that a competent organisation would take, the "failing to use" reasoning applied to a tumour detector could later be argued against a Trust that left patient records on deprecated encryption. That is our inference from the structure of the statement, and it is untested.
For directors who want that argument in decision form, Signature Brief 2026.10, What the Minutes Show, sets out the cryptographic-oversight evidence a board should be able to produce, with refresh triggers and oversight questions; this post gives only the liability reasoning behind it. The next test will come from the first English AI clinical-negligence judgment, and from whether the Law Commission's review recommends bringing pure software inside the Consumer Protection Act, a change that would still need legislation, while the EU directive starts to apply to products placed on the market after 9 December 2026.
Sources: UK Jurisdiction Taskforce, Legal Statement on Liability for AI Harms under the Private Law of England and Wales, LawtechUK, July 2026; Michael Cross, Common law can cope with AI harms, say experts, Law Society Gazette, 9 July 2026; Tom Whittaker, Who is liable if AI goes wrong? UKJT statement on AI and civil liability published, Burges Salmon, 7 July 2026; Naiomh O'Reilly and David Hill, AI liability in healthcare: where the law now stands, Browne Jacobson, 30 October 2026; Adam Hudson, UK Jurisdiction Taskforce Statement on Liability for AI Harms: the clinical negligence perspective, Clyde & Co, 23 July 2026; Medicines and Healthcare products Regulatory Agency, National Commission into the Regulation of AI in Healthcare: Recommendations for a future regulatory framework, 10 September 2026; Consumer Protection Act 1987; Civil Liability (Contribution) Act 1978; Directive (EU) 2024/2853 on liability for defective products. Links checked 31 October 2026; the LawtechUK statement page did not load for automated retrieval that day, and statement paragraph numbers follow Clyde & Co.
Published intelligence, built to inform your own decisions. Published: October 31, 2026.