Is ChatGPT a *product* or a *service*? US lawsuits test who carries the burden of proof

The classification fight

A string of lawsuits in the United States is testing a simple-sounding question with profound consequences: is ChatGPT a product or a service? ^[1]

OpenAI has argued in court filings that ChatGPT is a service. The plaintiffs say it is a product. The distinction matters because product liability law in most US states is strict: if a product is defective and causes harm, the manufacturer is liable, even if it did nothing wrong. ^[1] For a service, the claimant has to show negligence, which is a much higher bar.

It's a bit like the difference between buying a faulty toaster and hiring someone to fix your roof. If the toaster catches fire, the maker is liable whether or not it was careless. If the roofer makes a mistake, you have to show they didn't do their job properly. One hinges on the thing; the other on what the person did.

The cases involve claims that ChatGPT generated false information that harmed people's reputations. ^[1] OpenAI's position is that ChatGPT provides a service by responding to prompts, and that strict liability doesn't apply. The courts have not yet settled the question, but the outcomes will shape how AI liability works in practice.

What the EU rules say

In the EU, the new Product Liability Directive has answered the classification question for software. ^[2] Products placed on the market after 9 December 2026 fall under strict liability rules, and software is explicitly one of them. That includes AI systems. ^[2]

The directive covers death and personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes. ^[2] It also gives courts the power to order defendants to hand over relevant evidence under certain conditions, and it allows for a reversal of the burden of proof when evidence is hard to get. ^[2]

In Sweden, the government has proposed that a new Product Liability Act implementing the directive enter into force on 9 December 2026. ^[3]

So in the EU, the question is not whether an AI system like ChatGPT is a product. It is. The question is what you can show about what it did.

The burden of proof

Under traditional negligence rules, the person who claims harm has to prove that the other side did something wrong. That means showing what happened, why it was wrong and that it caused the damage.

Strict product liability flips part of that. The claimant still has to show that the product was defective and that the defect caused harm, but they do not have to prove negligence. ^[1] The maker is liable if the product does not perform as safely as a person is entitled to expect. ^[2]

That shift puts pressure on the organisation that made or sold the product. If someone claims your software caused harm, the question is not just whether you were careful. It is whether the software did what it should have done, and whether you can show what it actually did on the day in question.

For AI systems, that is harder than it sounds. A model's output can vary based on the input, the version, the context and even randomness in the generation process. If a customer claims the system gave harmful advice six months ago, and you have no sealed record of the conversation, their screenshot may be the only evidence on the table.

What this means for you

If your organisation builds, sells or runs AI systems that interact with people, these questions are worth asking now:

• Could you show which version of the system was running on a given day, and what it actually output?
• If a customer or a claimant turned up with a screenshot, do you have your own record to compare it with?
• When the law treats your software as a product, who in your organisation is responsible for showing what it did?

The US cases have not been decided, and the legal landscape is still forming. But the direction is fairly clear: software is being treated more like a physical product, and the burden of proof is shifting.

In the EU, that shift happens on 9 December 2026. It is worth having an answer ready before then.

How a digital witness fits here

This is a case where a digital witness fits well, because the core problem is showing what an AI system said or did at a particular time.

Here is how it would work. Each time the AI generates an answer, your system seals a record: the input reference, the output, the model version and a timestamp. Sealing takes a fingerprint of that record, not the record itself, so the conversation never leaves your systems. The fingerprint goes to WitniumChain, and you get a witness ID back.

Later, if someone questions what the system said, you can share the sealed record with them. They calculate the fingerprint again and check it against the sealed one. If it matches, the record has not changed since it was sealed. Change a single character and it will not match.

Who can check it? The customer, their legal team, an ombudsman, a court, or anyone you choose to share the record with.

What it shows: that the record of what your AI said, and when, has not been altered since it was sealed.

What it does not show: that the answer was correct, lawful or safe, or that the company is bound by what the AI said. Those are separate questions. A digital witness gives you a stable record to work from, rather than having to argue about whether someone has edited a log after the fact.

How it would work

1. Seal each answer or conversation as it happens, through the REST API, the SDK or the MCP server.
2. Store the witness ID with your internal record of the conversation.
3. When questioned, share the record and the witness ID. The other party can verify it in seconds.

You can read more in the documentation. The first 2,000 witnesses a month are free.

What to watch

The US court decisions in the pending ChatGPT cases will give a clearer picture of how American judges are thinking about AI and product liability. Those rulings are expected in the coming months. ^[1]

In the EU, the implementation date for the Product Liability Directive is 9 December 2026. ^[2] National laws, including Sweden's proposed Product Liability Act, are expected to enter into force on the same day. ^[3]

For anyone running AI systems that talk to customers, make decisions or generate content, the practical question is the same on both sides of the Atlantic: when something is challenged, can you show what your system actually did?