Is AI a product or a service and why does it matter?

In 1996, the Court of Appeal commented on what must have seemed, at the time, a rather niche point:  could software be defined as “goods” under legislation such as the Supply of Goods and Services Act 1982? In St Albans City and District Council v International Computers Ltd[1] (“ICL”), ICL had supplied a computer system containing a program with an error. The Court of Appeal observed that a computer program supplied on a tangible disc could be “goods”, whereas the same program supplied without a tangible medium was not “goods”.

Nearly thirty years on, similar issues are being considered. This time, it is not just about faulty programs but about artificial intelligence (“AI”) systems – ones that advise doctors, approve loans, flag fraud, draft contracts and steer vehicles. The English courts are once again considering similar issues to those deliberated in 1996, but more specifically now: is AI a product or a service?

Why the distinction matters

That distinction matters because English law treats the two very differently. If you buy defective goods, the law is relatively generous to you. The Sale of Goods Act 1979 implies that goods must be of satisfactory quality and fit for purpose – these are strict obligations, with no need to prove the seller was careless.

Services work differently. If someone provides you with a service, the implied obligation is to carry it out with reasonable care and skill. That is a fault-based standard. You need to show not just that something went wrong, but that the provider failed to meet the standard of a reasonably competent professional. That is a much higher bar for a claimant to clear.

Insurance follows the same logic. Product liability policies are designed for defective goods that have caused personal injury or property damage. Professional indemnity policies cover negligent advice or services by professionals. Tech E&O policies are broader, covering technology companies for financial loss caused by failures in their product or service. For AI, tech E&O is often the more relevant cover. The difficulty is that AI frequently straddles both categories, and neither policy type is routinely drafted to cover the overlap cleanly. If your AI claim falls into that gap, you may find there is no cover at all.

Applying the distinction to AI

So, which box does AI go in? The honest answer is that it depends, and the law has not yet caught up with the technology.

As an example, consider AI software delivered over the internet, with no physical medium involved. This could be a large language model accessed remotely or a SaaS-based AI tool. Under the logic of St Albans, software in this form is not “goods”. The Sale of Goods Act 1979 does not apply and its strict implied terms do not bite. The claimant is left with only the contractual terms agreed or a reasonable care and skill standard – a less certain foundation for a claim than strict product liability would be.

Put that same software on a chip or a device and ship it, and the analysis starts to shift. The physical carrier is goods; however, the question of whether the embedded software takes the whole thing into the ‘goods’ regime is a bit more fluid. Courts and regulators are increasingly inclined to treat the device as a whole. A self-driving car is not sold as a chassis with a service agreement attached. A medical device is not a subscription. When AI is embedded into a physical product, the product framework, and the more claimant-friendly standards that come with it, tends to follow. That is not the only point that will need to be considered – embed AI in physical products at scale and you get a different problem. Who decides when something has gone wrong badly enough to pull it from the market (this is explored further within a subsequent article in this series)?

Then there is the case where AI is not the product at all, but a tool used by a professional in delivering a service. A solicitor using AI for legal research, a radiologist using AI to read scans, a bank using AI to detect fraud. In these cases, the overall supply is a service, and the professional owes the usual duty to exercise reasonable care and skill. The question is not whether the AI was right, but whether the professional used it appropriately: selected a suitable tool, interrogated its outputs, and did not simply take them on trust.

The complexity of modern AI

So far, so manageable. But there is a further layer of complexity, which is that AI itself is not a single thing and the existing legal frameworks were not designed with its more advanced variants in mind.

The software in St Albans was deterministic: it performed a specific calculation, and it got the calculation wrong. It was not difficult, in principle, to say what it should have done. Modern AI is often not like that. Machine learning models are probabilistic: they do not compute a single correct answer, they predict the most likely one. The same input can produce different outputs. The model may be 97% accurate, or 94%, or 82%, and the question of what accuracy a user is “reasonably entitled to expect” is one courts will have to answer without much precedent to guide them.

Generative AI is more complicated still. It produces novel outputs that may be fluent and confident and entirely fabricated. The hallucination problem is not a bug that can be fixed; it is a feature of how these systems work. Courts will need to develop standards that reflect those realities, rather than applying tests designed for a database error in 1996.

Physical harm and product liability

The stakes are highest where physical harm is involved. If a defective AI system injures someone – a self-driving car crashes, a diagnostic AI misses a tumour, a drug dosing system gets it wrong – the product-versus-service question becomes critical.

The Consumer Protection Act 1987 (“CPA”) uses a different statutory concept – “product”, tested by
reference to safety rather than quality or fitness for purpose – but raises the same basic question of
classification. The CPA provides a strict liability route for personal injury or property damage caused by a defective product. The claimant does not need to prove negligence – only that the product was not as safe as persons are generally entitled to expect. That is a deliberately claimant-friendly approach, designed for cases where identifying exactly what went wrong, and who was responsible, is genuinely difficult.

The problem for AI is that the CPA, as it stands in the UK, does not clearly cover software delivered without a physical medium. A claimant injured by a defective AI system delivered as a cloud service cannot straightforwardly invoke the CPA. They will need to rely on negligence instead, and negligence is harder to prove, particularly when the system is complex, the supply chain is long, and the failure is not a simple miscalculation but a probabilistic output that happened to be badly wrong.

Other jurisdictions

Other jurisdictions are approaching the same classification question through different routes – some
through the courts, others through legislation.

In the United States, courts are currently being asked to resolve the same question in relation to ChatGPT. Claimants in a series of lawsuits against OpenAI argue that ChatGPT is a defectively designed product capable of attracting product liability, while OpenAI has argued that “information and ideas are not products” and that ChatGPT is instead an “interactive service”. The outcome of that litigation is awaited with interest, and may offer an early indication of how courts will approach the product-versus-service question for generative AI more broadly.

The EU has already moved to close this liability gap. Its revised Product Liability Directive explicitly treats AI software as a product, regardless of how it is delivered. The UK has not yet followed suit, though the Law Commission is reviewing the position with AI expressly in scope. The UK Jurisdiction Taskforce’s Legal Statement takes the view that existing common law principles – contract and negligence – are capable of handling AI liability claims without specific legislation. That may well be right in most cases; however, for the claimant who has been physically injured by a defective AI system and needs to prove negligence against a developer whose system they do not fully understand, it is of little comfort.

Concluding thoughts

There is no single answer to whether AI is a product or a service. It depends on the form of the AI, how it is delivered, and how it is used. The legal framework for finding that answer already exists, it just needs to be applied carefully. Thirty years ago, the Court of Appeal in St Albans drew a workable line for software contracts of its day: software embodied in a physical medium could count as goods, while software supplied on its own could not. The courts, and perhaps Parliament, will need to redraw that line for a world in which software rarely arrives on a disc at all, and increasingly makes decisions rather than simply following them.

[1] [1996] EWCA Civ 1296