Essay · October 30, 2026

Dog, cow or lion?

Who is liable when an AI agent bites? German animal-keeper liability offers a surprisingly precise lens on AI — and suggests why agents may not stay domestic for long.

OD By Dr. Oliver M. Duschka · Munich · Filed under AI Governance

A recent internal discussion turned on a deceptively simple question: when a company’s AI system causes harm, is the company liable like a dog owner or like a farmer with a cow?

The question is better than it sounds. Under German law, if I walk my dog properly on a leash and it still bites a passer-by, I am fully liable, even though I did everything right. If I fence in my cow properly and it still causes damage, I am not.

Two animals, two liability regimes. Which one applies to AI? The analogy goes a long way, just not where one first expects. And for AI agents, it leads to a third animal.

It is not about dogs or cows

Section 833 of the German Civil Code (BGB) does not distinguish by species, but by purpose. Its first sentence makes anyone who keeps an animal liable without fault, the only strict liability rule in the entire Code. Its second sentence exempts only domestic animals that serve the keeper’s profession, business or livelihood. And even then only if the keeper proves that they exercised due care.

The farmyard guard dog is therefore, legally speaking, a cow. The daughter’s riding pony is a dog. All that matters is whether the animal serves an economic purpose.

Two details are telling for the AI debate. First, the original Civil Code of 1900 had no such privilege. The second sentence was inserted in 1908, at the urging of agricultural interests. Many legal scholars consider it outdated, yet the Federal Court of Justice upheld it as constitutional in 2009. The cow’s privilege is a political choice, not a law of nature.

Second, even the dog owner is liable only for death, personal injury and damage to property. Section 833 does not cover pure economic loss. We will return to that.

What applies to AI today

Section 833 does not apply to AI, not even by analogy. German law recognises strict liability only where the legislature expressly provides for it, and the prevailing view rejects extending it by analogy.

What remains is fault-based liability, and structurally it looks like the cow. In contract, fault is presumed and the company must exonerate itself (Section 280(1) BGB). Outside contract, under tort law, duties of care are what count: whoever deploys AI must select it carefully, monitor it and be able to intervene. For data protection breaches, the controller must prove that it is not in any way responsible (Article 82(3) GDPR).

A company that deploys AI in its business is thus, functionally, the keeper of a working animal. It is liable if the fence is missing. It is not liable if it can prove the fence was there.

One caveat applies to a company’s core obligations. If an insurer’s AI system rejects a valid claim, no exoneration helps. The benefit is owed, with or without AI.

The fence is a matter of proof

The cow’s privilege is only worth as much as the proof of the fence. The keeper must prove due care; the injured party need not prove its absence. A fence that nobody documented does not exist in court.

What the fence must look like for AI is increasingly set out in the AI Act. For high-risk systems, Article 26 requires deployers to assign human oversight to competent persons, use the system as instructed, monitor its operation and retain its logs. In insurance, high-risk means risk assessment and pricing in life and health insurance (Annex III, point 5(c)).

The AI Act is not a liability rule. In practice, however, it describes what courts will come to treat as the standard of care. Treating deployer obligations as a mere compliance exercise forfeits the defence — one more reason to build governance in at the start of an AI project rather than at its end.

Governance documentation is evidence in waiting. The fence, in one line · October 2026

Where the dog already barks: the manufacturer

Liability without fault for AI is coming nonetheless, but it falls on the manufacturer. The revised EU Product Liability Directive treats software, including AI systems, as a product. Member States must transpose it by 9 December 2026; the German Bundestag adopted its implementing act on 8 October 2026.

Even this is only partly a dog. The manufacturer is liable without fault, but only for defects. Protection covers life, body, health, privately used property and, for the first time, data not used for professional purposes. Pure economic loss stays outside: the wrongly rejected claim, the flawed advice, the skewed premium.

One point matters particularly for deployers. Whoever substantially modifies a product will be liable as its manufacturer. A company that deeply adapts a third-party AI system should check whether it has thereby changed roles.

The lion: when an AI agent stops being a domestic animal

The most interesting part of Section 833 is an inconspicuous word: domestic. The privilege applies only to domesticated animals, made predictable over generations and accustomed to obedience. The keeper of a lion in a zoo is always strictly liable, even when keeping it commercially, and however secure the cage.

German courts describe the specific danger of animals as unpredictable, autonomous behaviour. That is precisely the difference between an AI assistant and an AI agent. The assistant proposes; a human decides. The agent plans several steps, calls tools, delegates to other agents and acts, often faster than a human can intervene.

An agent with write access to customer data, payment authority and an open action space bears the marks of a wild animal. It is domesticated not by breeding but by architecture: limited permissions, tight budgets, approval thresholds, complete logs, a working kill switch. That is also the argument of my talk at KI KONNEX next week: autonomy is granted per action, not per agent.

This is where the liability debate will be decided. In 2020, the European Parliament proposed exactly this logic: strict liability with mandatory insurance for operators of high-risk AI, presumed fault for everything else. It did not prevail. Even the far milder AI Liability Directive, which offered only evidential relief, was dropped when the Commission decided in February 2025 to withdraw it. The first major loss caused by an autonomously acting AI agent will bring the question back.

LIABILITY EXONERATION? PET WORKING ANIMAL WILD ANIMAL Dog Cow Lion Without fault Presumed fault Without fault No Yes, if fenced Never NOT EVEN ON A LEASH FOR AI: THE AI ACT NOT EVEN IN A CAGE
Section 833 lets a keeper escape liability only for an animal that is both working and domesticated, and only with proof of a fence. AI deployed in business is a working animal today; whether agents still count as domesticated is the open question.

What follows

For companies deploying AI agents, three practical consequences follow.

First, classify agents by their degree of domestication, not only by the risk of the use case. What matters is the action space, tool access and the ability to intervene in time. An agent register is the foundation.

Second, build the fence as evidence. Logs, approvals and monitoring must be designed to hold up in court years from now, not merely at the next audit.

Third, price the residual risk. Where no fence suffices, insurance remains. For insurers, this matters twice over: they are keepers themselves, and they will carry their customers’ keeper risk.

Dog, cow or lion?

So the answer to the question from our discussion is this: today, an AI system in a company is a cow, as long as the fence can be proven. For agents with an open action space, the legislature may tomorrow reach for the lion regime. Animal-keeper liability shows that both are possible — and that the line is drawn politically.

Which AI agents in your organisation are still working animals, and which are already wild?

Sources & further reading

Read next