When we talk about technological innovation, the dominant language is one of possibilities: automation, efficiency, scalability. Legal liability almost always enters the scene later, as an unforeseen side effect.
The debate on open-source AI agents — such as OpenClaw and similar systems — follows exactly this pattern: great attention to technical capabilities, very little to the foreseeable consequences of their dissemination.
Yet European law and recent Italian case law are drawing an increasingly clear line: when a product is inherently risky, formal neutrality is no longer sufficient.
From “as is” software to acting systems
For years, software has been considered a neutral tool: it executes instructions, it does not decide, it does not act autonomously. In this context, open source and “as is” distribution represented a sort of legal comfort zone.
AI agents break this paradigm. They do not merely process data; they act: they access systems, use credentials, make operational decisions that produce concrete effects on people, data, and assets of often-unaware third parties.
The question, then, is no longer purely technical: can we really continue to consider the distribution of tools whose dangerous use is foreseeable as neutral?
Dangerous product and defective product: two levels, the same logic
European law recognizes two distinct categories:
- Dangerous products, governed by general product safety legislation (now Regulation (EU) 2023/988): a preventive logic, concerning what should not be placed on the market without adequate safeguards.
- Defective products, governed by the Consumer Code (formerly Directive 85/374/EEC): a compensatory logic, which applies once damage has already occurred.
They are not the same, but they share a central criterion: the level of safety that a person is legitimately entitled to expect, taking into account the foreseeable use — including foreseeable misuse — of the product.
The Supreme Court ruling: risk is not the defect, but it is not irrelevant
A recent ruling of the Italian Supreme Court (Corte di Cassazione) on liability for defective products (the vaccines case) clarifies a point that is often misunderstood: a product may be dangerous without being defective, but its dangerousness profoundly affects the producer’s obligations.
The Court states that:
- formal compliance with standards is not enough;
- the inherent risk of a product does not automatically amount to a defect;
- what matters is whether the product meets the legitimate safety expectations of its users.
A decisive point concerns information: generic warnings or boilerplate disclaimers are not sufficient. Information must be specific, comprehensible, and functional to an informed acceptance of risk.
This shifts the center of gravity of liability: not only what is produced, but how it is designed, presented, and distributed.
The parallel with pharmaceuticals: inherently dangerous products
The law has long recognized a category of inherently dangerous products: pharmaceuticals.
They can cause harm, serious side effects, even death. Yet they are not prohibited.
Why?
Because the law does not require the absence of risk, but a prior risk–benefit assessment, controlled distribution, enhanced information obligations, and — not least — a system of continuous monitoring (pharmacovigilance).
The manufacturer is not liable because the drug is risky per se, but because it failed to properly assess, communicate, or manage that risk.
AI agents and drugs: not identical, but legally comparable
AI agents are not drugs, but the legal parallel is far from forced.
Like pharmaceuticals, AI agents:
- are not neutral;
- produce effects on third parties;
- can cause serious harm if used without adequate expertise;
- require ex ante assessments and ex post controls.
The difference is that, while this model is well established for pharmaceuticals, we are only now building it for software. But the underlying logic is the same: when a product is inherently risky, freedom of distribution cannot be absolute.
Cybersecurity as a product safety requirement
This evolution becomes even clearer with the Cyber Resilience Act (CRA), which transforms cybersecurity from a technical option into a legal product safety requirement (secure by design).
In this new framework, a cybersecurity vulnerability is no longer a mere incident, but a potential product defect if it undermines the user’s legitimate expectations of safety.
An AI agent that can be manipulated through prompt injection or foreseeable exploits due to design flaws is not merely “misconfigured”: it fails to meet the expected level of security.
The CRA also introduces monitoring obligations throughout the entire product lifecycle: failure to manage vulnerabilities or inertia in releasing patches becomes a source of liability.
Here, the analogy with pharmacovigilance becomes even stronger: it is not enough to place a product on the market that is “safe at time zero.” Continuous care for security is required.
Open source: the end of the legal safe harbor
A widespread misconception must be clarified: open source is not a legal safe harbor.
European law protects collaborative research and development, but this protection applies as long as the software remains outside the market.
Once an open-source AI agent is integrated into a commercial product, provided as a service, or deployed in a professional operational context, the party distributing or using it assumes full responsibility for compliance, including security.
It is not possible to invoke a permissive license, “as is” release, or the open-source origin of the code to justify harm caused to third parties.
In my view, the neutrality of code ends the moment it impacts users’ rights. Whoever derives economic or operational benefit from an AI agent becomes its guarantor, regardless of who wrote the source code.
Innovation comes of age
AI agents are not merely more advanced software. They are systems that act in complex contexts, often opaque to those who are affected by them.
European law, Italian case law, the Cyber Resilience Act, and the evolving discipline on dangerous products converge on one point: innovation is no longer assessed solely by what it makes possible, but by what it makes foreseeably risky.
As already happened with pharmaceuticals, AI is entering a phase of maturity in which technical freedom and legal responsibility can no longer be separated.
The real challenge is not to stop innovation.
It is to decide how far we are willing to accept the dissemination of powerful tools without taking responsibility for their foreseeable consequences.
Market and Data
_old_Become an author
Wallet
