Who Is Accountable When AI Writes the Code?

Why does accountability need a fresh look?

AI tools can now write most of the code in a project, and in ours they do. That changes who types the code, but not who answers for it. The question comes up in procurement, in security questionnaires and after incidents, and it is easier to settle before a contract is signed than after something goes wrong.

This guide covers accountability: who answers for defects, security and data when AI tools wrote the code. Ownership of the code is a related but separate question, which our article on who owns AI-written code covers.

Is the AI tool vendor accountable for the code?

No. AI vendors are accountable for their own service under their terms, and those terms are clear that they do not stand behind the quality of what the tool produces.

What Anthropic’s terms say

Anthropic’s Commercial Terms, effective 17 June 2025, apply to Claude Team, Claude Enterprise and the API. They say the customer ‘owns its Outputs’, and that Anthropic ‘may not train models on Customer Content from Services’. They also say the services and outputs are provided ‘as is’ and that Anthropic does not warrant that they are ‘accurate, complete or error-free’.

The terms include an indemnity: Anthropic will defend the customer against third-party claims that its paid use of the services, or the outputs, ‘violates any third-party intellectual property right’. The exclusions matter for software. They include claims arising from:

• ‘modifications made by Customer to the Services or Outputs’
• ‘the combination of the Services or Outputs with technology or content not provided by Anthropic’
• ‘the practice of a patented invention contained in an Output’

Code generated by an AI tool is usually edited, and it is almost always combined with other code. Check how far the cover reaches for the way you work, rather than assuming it applies.

What Microsoft offers for GitHub Copilot

Microsoft’s Customer Copyright Commitment describes its obligation ‘to defend customers against certain third-party intellectual property claims relating to Output Content’. For GitHub offerings, Microsoft says that as of 3 April 2026 there are no additional required mitigations, and the Duplicate Detection filter is no longer required for coverage.

Like Anthropic’s indemnity, this is about intellectual property claims. Neither covers bugs, security vulnerabilities, data breaches or the business consequences of software that does the wrong thing.

Who the indemnity protects

An indemnity protects the vendor’s own customer. If your supplier used an AI tool to build your software, the vendor’s customer is your supplier, not you. Your protection comes from your contract with the supplier.

Is your supplier accountable?

Yes, for what it delivers, under your contract. In England, Wales and Northern Ireland, section 13 of the Supply of Goods and Services Act 1982 applies to services supplied in the course of a business. It implies a term that the supplier ‘will carry out the service with reasonable care and skill’. Nothing in that test depends on how the work was produced, so it is the same whether a person or an AI tool wrote the code.

Most bespoke software contracts also set their own standard, warranties and liability caps. Our guide to software development contracts explains the duty of care and AI clauses, and our guide to liability caps and indemnities explains how financial risk is shared.

What to put in the contract

These terms make accountability explicit when AI tools are part of delivery:

• One quality standard for all deliverables, however they were produced
• Disclosure of the AI tools used, and how their output is reviewed before delivery
• Human review of every change, by someone other than its author
• IP warranties and an indemnity from the supplier for its deliverables, rather than reliance on the AI vendor’s terms
• Assignment of all rights in the deliverables to you, however they were produced
• Records of which tools produced which code; our guide to AI code attribution covers a practical approach
• Support terms that say who fixes defects after launch, and how quickly

Questions to ask a supplier

Before you sign, ask:

1. Which AI tools do you use, and on which plans and terms?
2. Who reviews AI-generated code before it reaches us, and how is that recorded?
3. Does your warranty and liability cover apply to AI-generated code in the same way as other code?
4. What IP warranties and indemnities do you give us for the deliverables?
5. If a vendor’s AI tool becomes unavailable, what happens to our timeline and price?

What if you built it yourself?

Then the accountability is yours, because there is no supplier to hold to a contract. That applies to software your engineers build with AI coding assistants, and to tools your staff build with AI app builders.

The controls have to come from inside: review, testing, ownership and support. Our guide to governing software your staff build with AI covers a proportionate policy, and our guide to security checks for vibe-coded apps covers the checks for apps built by prompting.

What is your organisation always accountable for?

Some accountability cannot be passed to a supplier or a vendor, whoever wrote the code.

• Personal data. Under Article 5(2) of the UK GDPR, ‘the controller shall be responsible for, and be able to demonstrate compliance with’ the data protection principles. A supplier that processes personal data for you does so as your processor, under a written contract.
• AI features inside the product. If the software itself uses AI, the EU AI Act may apply, and it divides obligations between providers and deployers. Our guide to the EU AI Act for UK businesses commissioning AI explains who carries which obligations.
• Your customers. Enterprise buyers hold you to their security requirements, not your supplier. Our guide to answering a security questionnaire when AI built your product covers how to evidence the controls.

Who does what in practice?

The table shows where accountability usually sits in three common situations. Your contracts decide the details.

The last column is where accountability most often goes missing. A tool can become business-critical without anyone agreeing to answer for it.

How do we handle accountability?

We treat AI tools as a way to write code faster, not as a party to the work. 91.6% of our code is AI-authored, and 100% of it is reviewed by senior engineers and validated by ISTQB-qualified QA. On our own code, the reviewer is never the person who wrote the change, whoever or whatever that was.

On ownership, fully custom builds transfer all IP to the client. Where we use our accelerators, clients receive a perpetual source code licence to those components and full ownership of all project-specific code. We develop software under an ISO 27001:2022-certified information security management system, which governs our secure development lifecycle, change control and supplier management.

If you run software that nobody is accountable for, our Production Readiness Review is the starting point: £5,500, fixed, over two weeks, with an evidence pack and a prioritised plan. Our managed support for AI-built software starts from £2,450 a month. This service covers AI-generated codebases we did not build.