Who is Responsible When AI Fails? Mapping Causes, Entities, and Consequences of AI Privacy and Ethical Incidents

Accountability gaps are widespread: The study found that "limited corrective interventions" occur after AI incidents and "rare reporting from AI developers and adopting entities," suggesting that organizations deploying AI systems often fail to take responsibility or disclose problems to affected users.

Poor organizational decisions cause more harm than technical failures: The research reveals that "widespread harms" stem from "poor organizational decisions and legal non-compliance" rather than inherent AI technical limitations, indicating that governance and ethics failures are the primary problem, not the technology itself.

Current AI governance frameworks are inadequate: The taxonomy developed from 202 real-world incidents "emphasizes the weaknesses of current AI governance frameworks," suggesting that existing rules and guidelines are insufficient to prevent privacy and ethical violations in practice.

Specific sectors need targeted protection: The findings highlight particular concern for "social media and child protection" contexts, indicating that certain high-risk applications require specialized policies and oversight beyond general AI governance approaches.

Systematic incident reporting is lacking: The study demonstrates the need for "systematic incident reporting" practices, suggesting that without structured documentation of what goes wrong with AI systems, organizations and policymakers cannot learn from failures or implement effective prevention strategies.