Can I hold the maker of an AI tool liable if the tool makes a mistake in work for a client?

Usually not, and the new product liability rules change that only to a limited extent. Those rules come from EU Directive 2024/2853 and also cover software and AI systems. The Netherlands has to bring them into force by 9 December 2026 at the latest. The directive covers personal injury, damage to property and the destruction or corruption of data. Property you use only for work falls outside it. If you also use something privately, such as your laptop, damage to it can still be compensated. For data the line is stricter. Data you use professionally falls outside the directive, even if you also use it privately. A mistake in a campaign or design for a client mainly costs you revenue or hours of rework. That is pure economic loss, meaning loss that does not result from injury or from damage to property or data, and as such it falls outside the directive. That leaves the tool’s terms of use, which often exclude liability for output. In practice, the risk therefore runs through the arrangements with your client.

Can I force a platform to remove a deepfake of me?

Since 17 February 2024, platforms such as Instagram, TikTok and YouTube have had to offer a notice mechanism for illegal content. That follows from Article 16 of the Digital Services Act (DSA), the EU regulation on digital services. The platform must assess a notice that gives the exact URL and explains why the deepfake is unlawful in a diligent and timely manner, and must give reasons if it refuses. That decision can be challenged through an internal complaint procedure and then before a certified out-of-court dispute settlement body. If that does not work, a Dutch court can, subject to conditions, order the platform in interim injunction proceedings to remove the deepfake. It must then be sufficiently plausible that the publication is unlawful. The mere fact that it is a deepfake is not enough, and interim proceedings also require urgency, meaning a reason why the matter cannot wait. The uploader’s details are subject to a separate test. Since the Dutch Supreme Court’s Lycos v Pessers judgment of 2005, the court must weigh, among other things, the injured party’s interest in pursuing the uploader against that uploader’s privacy. So a platform does not have to hand over those details in every case.

As a photographer or agency, may I enter photos or client data into an AI tool?

That depends mainly on the tool. If the provider only processes the data on your behalf, it is a processor and you need a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR). If the provider also uses your input to train its own model, it is more than a processor and you need a separate legal basis for passing the data on. Many tools offer a business version in which training on input is switched off. If people appear in the photos, their image rights also come into play. If the provider runs on servers in the United States, check whether it is certified under the EU-US Data Privacy Framework.

Practice areas

Artificial intelligence law

Artificial intelligence is changing how creative work is made, distributed and protected. Creators use AI to write, compose and design. At the same time, AI models are trained on existing work, sometimes without the authors knowing. And with deepfakes, someone’s face or voice can be imitated in a way that has a serious impact on the person concerned.

Liaise advises authors, producers, publishers and creative entrepreneurs on the legal side of AI. We know the sector and know where the questions lie the moment AI becomes part of how you work, or of what others do with your work.

Do you need legal advice straight away? Call 020 675 88 21.

Rights in your work when AI helps create it or trains on it

An illustrator who lets Midjourney sketch and then decides on the composition and colours makes something different from someone who types one prompt and publishes the first result. Dutch copyright law only protects what a human has creatively chosen. The more of those choices are yours, the stronger your position. So keep your sketches, interim versions and prompts.

It works the other way round too. AI models are trained on existing work, from song lyrics to photo archives. Article 15o of the Dutch Copyright Act (Auteurswet) allows this under the text and data mining exception, unless the author has reserved that use. The reservation does not happen by itself. How a German court dealt with this kind of training is covered in our article on the GEMA judgment.

More about AI and copyright →

Having a deepfake or imitated voice of yourself removed

A face in an advertisement you never posed for. A voice saying something you never said. Anyone imitated in this way can rely on image rights, privacy law and the rules on unlawful publication. Which ground is strongest depends on the use. A deepfake in an advertisement affects your commercial interest, a fake video in a group chat mainly your reputation.

Often the hardest question is who is behind it. An anonymous uploader can only be identified through the court. And a deepfake that is already circulating rarely sits in one place. We start the removal process and, where needed, bring interim injunction proceedings.

See also image rights and unlawful publication. If you are making a production with a digital double yourself, read deepfakes in film.

As soon as an AI system processes personal data, the GDPR applies. A model that learns from client photos falls under it, as does a tool that ranks job applicants. For the latter, Article 22 GDPR adds extra protection. People have the right not to be subject to a decision based solely on automated processing if that decision significantly affects them. We advise on this together with our data protection practice.

Who pays for a mistake in generated output

Many AI tools exclude all liability for their output in their terms of use. The risk then passes to whoever uses the output, and from there to the client. You can arrange that differently in advance. An indemnity against third-party claims, a cap on liability and an agreement on who checks the output together determine where the risk ends up. We draft or review those arrangements, whichever part of the chain you are in. See also IT law and contract law.

Which AI Act obligations already apply

The European AI Act has applied since 1 August 2024 and takes effect in phases. Since 2 February 2025 the most harmful applications have been prohibited, such as systems that give people a social score. The rules for providers of large AI models have applied since 2 August 2025. Among other things, they must publish a summary of the material they train on. That gives authors something to go on when enforcing their copyright.

For the creative sector, 2 August 2026 is the date that counts. Since then, the public must be able to recognise a deepfake as such, and providers of AI systems must mark generated content. For clearly artistic or fictional work, that obligation is lighter.

When you have to label AI content →

The heaviest requirements apply to high-risk systems, for example in recruitment or credit scoring. They were due to apply from 2 August 2026, but the Digital Omnibus, Regulation (EU) 2026/1744, has postponed them to 2 December 2027. For AI built into regulated products the date becomes 2 August 2028. Creative applications rarely fall into that category.

Anyone who provides or uses AI has also had to make sure since 2 February 2025 that staff know enough about it. Since 27 July 2026 that has been a best-efforts obligation. You take measures and can show them, but you do not have to guarantee a particular level of knowledge.

Which rules apply to you depends mainly on your role. If you build or offer an AI system, you carry more obligations than if you only use one.

AI lawyers for the creative and media industries

AI law is not a separate statute book. Copyright, image rights, the GDPR and contract law still apply when AI is involved. Only the AI Act is new. Liaise works for producers, publishers, labels, broadcasters and creators, and their AI questions differ depending on where they sit in the chain. A producer wants to know whether AI footage in the edit affects the chain of title, and whether the errors and omissions insurer will still provide cover. A publisher or label is looking for a contract clause that rules out training on its catalogue. For a creator, the question is more often who owns a generated work, or how to get a fake likeness taken offline. AI questions go to Charissa Koster and Merel Teunissen.

Do you have a question about AI and your work, or are you faced with a deepfake or unauthorised use of what you have made? Get in touch and you will have a reply within one working day.

All practice areas

Charissa Koster

Lawyer

Charissa advises and litigates in the fields of media law, intellectual property, IT and AI law, privacy, e-commerce and corporate law. Press-related and journalistic matters, copyright, freedom of expression versus privacy and cross-border issues often play a central role in her work.

Merel Teunissen

Lawyer

Merel advises and litigates in the fields of media law, film law, copyright, privacy law, contract law and intellectual property law. She acts for established and emerging media personalities, producers in film, television and podcasts, victims of unlawful publications and creative entrepreneurs.

Frequently asked questions about AI law

Usually not, and the new product liability rules change that only to a limited extent. Those rules come from EU Directive 2024/2853 and also cover software and AI systems. The Netherlands has to bring them into force by 9 December 2026 at the latest. The directive covers personal injury, damage to property and the destruction or corruption of data. Property you use only for work falls outside it. If you also use something privately, such as your laptop, damage to it can still be compensated. For data the line is stricter. Data you use professionally falls outside the directive, even if you also use it privately. A mistake in a campaign or design for a client mainly costs you revenue or hours of rework. That is pure economic loss, meaning loss that does not result from injury or from damage to property or data, and as such it falls outside the directive. That leaves the tool’s terms of use, which often exclude liability for output. In practice, the risk therefore runs through the arrangements with your client.
Since 17 February 2024, platforms such as Instagram, TikTok and YouTube have had to offer a notice mechanism for illegal content. That follows from Article 16 of the Digital Services Act (DSA), the EU regulation on digital services. The platform must assess a notice that gives the exact URL and explains why the deepfake is unlawful in a diligent and timely manner, and must give reasons if it refuses. That decision can be challenged through an internal complaint procedure and then before a certified out-of-court dispute settlement body. If that does not work, a Dutch court can, subject to conditions, order the platform in interim injunction proceedings to remove the deepfake. It must then be sufficiently plausible that the publication is unlawful. The mere fact that it is a deepfake is not enough, and interim proceedings also require urgency, meaning a reason why the matter cannot wait. The uploader’s details are subject to a separate test. Since the Dutch Supreme Court’s Lycos v Pessers judgment of 2005, the court must weigh, among other things, the injured party’s interest in pursuing the uploader against that uploader’s privacy. So a platform does not have to hand over those details in every case.
That depends mainly on the tool. If the provider only processes the data on your behalf, it is a processor and you need a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR). If the provider also uses your input to train its own model, it is more than a processor and you need a separate legal basis for passing the data on. Many tools offer a business version in which training on input is switched off. If people appear in the photos, their image rights also come into play. If the provider runs on servers in the United States, check whether it is certified under the EU-US Data Privacy Framework.