Private Law Theory

ABSTRACT
Four companion articles by this author examined how private international law should treat cross-border contracts negotiated and concluded entirely by autonomous AI agents, addressing choice of law, jurisdiction, breach of an implied duty of care, and enforcement of arbitral awards. All four operated within the contractual branch of private international law, where a relationship of privity between the parties structures the applicable doctrine at every stage. This article turns to the non-contractual branch, asking what happens when an autonomous AI agent’s decision causes financial harm to a person with whom its deployer has no contractual relationship at all a stranger who never negotiated with, or consented to interact with, the agent in any sense. It argues that the party-autonomy difficulties addressed at length in the first companion article barely arise here, because the Rome II Regulation already restricts choice of the applicable law in non-contractual matters to narrow, largely post-event circumstances; the harder and more current problem lies instead in locating where purely financial damage occurs, a question on which the Court of Justice of the European Union’s own case law remains, by the European Commission’s own recent admission, inconsistent, and on which the French Cour de cassation has just developed a new ‘unitary’ doctrine locating an investor’s loss at the investor’s own bank account. Applying and extending that doctrine, this article argues that damage caused by an autonomous AI agent to a victim’s financial holdings should be located at the victim’s own bank account or domicile, restoring a stable, victim-protective connecting factor precisely where autonomous causation makes the alternative tracing the agent’s own decisional process unworkable. The article further argues that, absent the contractual privity that grounded presumptive deployer liability in the third companion article, the underlying model’s developer re-enters as a direct, independent target of liability under a product-liability-style analysis, alongside the deployer, rather than only as an indemnifying party standing behind the deployer. The argument is illustrated by the case of an Uzbekistani citizen whose bank account is depleted by a foreign-deployed autonomous agent’s decision, and situates Uzbekistan not only as a source of comparative doctrine, as in the companion articles, but as a jurisdiction with a direct interest in protecting its own citizens as victims of cross-border, autonomously caused harm.

Abdugaffarov, Davronbek, Locating Non-Contractual Harm and Liability for Cross-Border Damage Caused by Autonomous AI Agents (September 14, 2026).