“The AI did it” is not an explanation of responsibility. It is sometimes a description of the last visible step in a long chain: software ranked a person, generated a false allegation, denied a benefit, or acted on a physical environment. But the last step is not necessarily the decisive moral step. Before a system acts, someone chooses its purpose, its data, its permissions, its threshold, its market, and the people who must live with its errors. After it acts, someone decides whether to investigate, disclose, repair, and change course.
The question “Who sinned?” should not become a search for one guilty programmer. Catholic moral analysis must distinguish an objectively wrongful act from personal sin, and personal sin from the degree of culpability that can justly be imputed. Knowledge, freedom, intention, circumstances, and the gravity of the matter all bear on that judgment; incomplete knowledge or consent may diminish culpability without making the underlying harm unreal. An institution is not a soul in the same way a human being is, but it can organize human choices and produce structural injustice. A company or public agency can therefore have duties of truth, care, justice, and repair even when culpability is distributed.
Artificial intelligence can be a cause in the chain. It cannot, on current evidence, be the moral subject who sins. It has no conscience, no responsibility before God in the sense attributed to a human act, and no capacity to make restitution because it understands that a neighbor was wronged. The interesting moral work therefore lies in tracing the human acts and omissions around the system without pretending that every harmful output was intentionally chosen.
This is therefore an inquiry into personal acts and imputability, not a complete theory of institutional governance. It asks what particular people knew, intended, authorized, neglected, or attempted to repair. An organization may still bear public and legal duties when no single person is fully culpable; that broader problem of bureaucratic moral distance should not be collapsed into a verdict about personal sin.
The Chain Between Choice and Harm
A useful investigation starts with several distinct questions. Who caused the immediate event? Who had authority to make the relevant decision? Who intended the end? What risk was foreseeable? Who had a duty to prevent or correct it? Who benefited from the arrangement? These questions overlap, but none can replace the others.
Suppose an employment model downgrades qualified applicants from a particular neighborhood. The model is a causal contributor: its score changes which applications receive attention. The hiring manager may be the immediate decision-maker if the score is adopted. The company is the deploying institution. A vendor may have designed and marketed the model. Executives may have required a speed target that made review impossible. A data team may have seen evidence of disparate error and said nothing. The harm can be real even if no actor intended to exclude a neighbor.
Foreseeability and the duty of care
Foreseeability is not a demand that someone predict the exact future. It asks whether a reasonable person in a relevant role could recognize a kind of danger and take proportionate precautions. A hospital cannot foresee every malfunction in a triage system, but it can foresee that missing data, unusual patients, and automation bias may cause delay. A lender cannot know every circumstance of a borrower's life, but it can foresee that an opaque denial may block housing and that an error will be expensive for the applicant to correct.
When a danger is foreseeable and a person has the authority to reduce it, omission can become morally significant. Failure to monitor a safety-critical model, failure to warn users about material limits, and failure to provide an appeal are not neutral absences. They can shift the cost of a known risk onto people with the least power to resist it. Conversely, care taken in good faith can reduce personal culpability even when a bad result still requires remedy.
The Catechism's treatment of imputability recognizes that responsibility can be diminished by ignorance, fear, coercion, habit, and other factors, while also warning that culpable ignorance and avoidable negligence do not provide an easy escape (CCC 1735–1736). Applied carefully, this offers neither a formula nor a verdict for algorithmic incidents. It does provide a guardrail: ignorance must be examined. Was the limitation unknowable, or did an organization choose not to know because knowledge would have slowed deployment?
No Intention Does Not Mean No Wrong
A person can cause serious harm without intending the harm. If a manager deploys a model to reduce fraud and the system wrongly suspends thousands of accounts, the good stated purpose does not automatically justify the means. The object of the act includes what is actually done, not only the aspiration attached to it. Circumstances such as urgency, uncertainty, and the vulnerability of those affected matter as well. A stated goal of efficiency cannot sanctify a process that predictably strips people of a chance to be heard.
Nor does a bad outcome prove that the original act was sinful. A doctor may use a well-tested diagnostic aid and still encounter an unforeseeable failure. A public servant may follow a carefully designed process and discover that an input was fraudulent. The duty after harm remains: seek the truth, stop further injury, tell those affected, and make reasonable repair. Accountability is not confined to the moment of launch.
The most troubling cases involve a mismatch between a respectable intention and an institution's actual incentives. A company may say it wants safer content moderation while measuring staff only by throughput. A government may announce fair access while celebrating the number of applications automatically rejected. In such cases, formal intention can coexist with practical choices that make harm predictable. Institutions reveal what they intend not only in mission statements but in budgets, permissions, deadlines, and responses to warnings.
Hard Cases and Distributed Culpability
Consider a generative system that invents a legal citation in a brief. The model produced the text, but it did not swear an oath, understand the authority of the court, or choose to deceive. The lawyer who filed the brief remains responsible for failing to verify a consequential claim. If the firm trained attorneys to treat generated text as authoritative and removed review time, institutional responsibility enters the picture. If the vendor advertised reliable legal research while concealing known failure modes, that fact may bear on its responsibility too. The system's opacity complicates the inquiry; it does not close it.
Consider a military or policing system that recommends a target. The moral stakes are unusually high because the recommendation concerns life, force, and the distinction between combatant and noncombatant. A chain of command may include the developer, intelligence analyst, commander, operator, and political authority. “The confidence score was high” cannot answer whether the data were lawful, the objective was legitimate, the rule of distinction was respected, or the use of force was proportionate. Delegating a step in a decision does not delegate the duty to judge whether the whole action is permissible.
There are also cases in which a user deliberately manipulates a model to harm someone. The user may bear direct responsibility, while a provider may bear a separate responsibility if it made dangerous capabilities available without proportionate controls. A platform cannot be blamed for every malicious prompt, but neither can it call every foreseeable abuse unforeseeable merely because the final string was typed by a stranger. Allocation must be evidence-based and proportionate.
The Strongest Objection
The strongest objection says that if an AI system is genuinely autonomous, human responsibility becomes a category mistake. The objection points to models that are too complex for anyone to inspect line by line, whose outputs vary with context, and whose failures emerge from interactions no one specifically designed. Holding a developer responsible for every output, it argues, would be like holding a parent responsible for every adult decision made by a child. The only honest solution may be to recognize the system as an independent bearer of responsibility or to accept that some harms are ownerless accidents.
The objection is strongest where ordinary control has genuinely been exhausted. An organization that tests honestly, limits a system's scope, monitors it, retains qualified reviewers, and responds quickly to new evidence may not be personally culpable for every novel failure. A just society should not punish people merely for being unlucky, and it should not turn moral language into unlimited strict liability.
Yet complexity does not create a new moral subject by itself. A child is a human person with a developing capacity for responsibility; a model is a designed artifact whose operation depends on human infrastructure, authorization, and maintenance. Even when no one intended the exact result, someone decided to expose particular people to a class of risks, and someone retains power over warnings, limits, insurance, correction, and withdrawal. If a system is too opaque to govern responsibly, opacity is an argument against that deployment, not evidence that the system has accepted the burden of responsibility.
The answer to distributed responsibility is not to invent a scapegoat and not to declare a moral vacuum. It is to distinguish degrees and kinds of responsibility. Criminal guilt, civil liability, professional discipline, institutional repair, and public accountability are related but different. A court may need one legal defendant; an ethical inquiry may need to identify a network of decisions, incentives, omissions, and beneficiaries.
What Accountability Requires
Two Different Endings to an Incident
Consider two incidents with the same harmful output. In the first, a team documents its operating limits, tests in good faith, monitors results, and discovers a genuinely novel interaction that no reasonable test exposed. No individual may be culpable, yet the institution may still owe prompt notice, compensation where appropriate, and withdrawal or redesign of the system. In the second, a vendor has evidence of the failure, conceals it, and pressures a customer to continue deployment. The same injury now includes a different question of knowledge and choice; concealment can make personal and institutional culpability more serious.
A responsibility matrix should keep these conclusions separate. It should record the purpose and benefit, legal duty, control over the relevant choice, evidence of foreseeability, intent or negligence, enterprise liability, and post-incident repair. The matrix is not a machine for assigning sin, and a regulator or court may use different categories. Its value is to prevent a compensation duty from being mistaken for personal guilt, and to prevent distributed roles from becoming an excuse not to repair.
Accountability begins before deployment. Teams should write down the purpose of a system in terms that can be morally examined, not merely the metric it optimizes. They should identify affected groups, likely failure modes, and the severity of error. Testing should include conditions that resemble actual use, including missing information, adversarial behavior, unusual cases, and the social costs of false decisions. A benchmark is evidence about performance; it is not a certificate of justice.
Authority must be visible. Every consequential system needs a named owner with power to pause it, an escalation route, and a record of material changes. Operators need training that includes the system's limits rather than only its successful demonstrations. A human review step must be genuine: reviewers need enough time, evidence, and independence to reject an output. Otherwise “human oversight” becomes a ritual that transfers blame to the least powerful person in the chain.
After deployment, organizations should monitor outcomes and near misses, preserve an audit trail, and publish enough information for affected people to understand and challenge a decision. High-impact actions should be reversible where possible. There must be a route to correct a record, restore access, compensate a loss, and apologize without forcing an injured person to prove that a statistical system was wrong in every internal detail. Repair is not an optional public relations exercise; it is part of taking responsibility for a system one has chosen to operate.
Governance should also resist the temptation to treat responsibility as a private matter between a vendor and a customer. Suppliers need contracts that allocate duties for testing, incident reporting, security, updates, and cooperation with investigation. Public institutions need procurement rules that consider rights and remedy, not just price and accuracy. Boards and senior leaders need reports that describe concentrated harms and unresolved complaints, not only aggregate performance. The common good is served when institutions make their power answerable to the people who depend on them.
When the System Is at Fault
It is ordinary to say that a system is at fault. The phrase can be useful if it means that a defect lies in the system and must be fixed. It becomes evasive if “the system” is treated as a final subject that ends the inquiry. A system can be defective; a person or institution must still decide whether to disclose the defect, suspend use, help those harmed, and prevent recurrence.
So who sinned when the AI did it? Sometimes a person intentionally designed a harmful use. Sometimes a manager accepted an unjust risk. Sometimes a vendor concealed a limitation, an operator ignored a warning, or an institution failed to repair a known injury. Sometimes careful people encountered a genuinely unforeseeable failure and must still provide a remedy without deserving blame. The answer is found by tracing intention, authority, negligence, foreseeability, and response rather than by assigning a soul to the machine.
Automation can make action faster and coordination broader. It cannot make accountability disappear. The morally serious response is not to reject every automated tool, but to build arrangements in which power remains legible, judgment remains humanly answerable, and the person harmed by a system can reach someone capable of truth, mercy, and repair. The machine may be in the causal chain. Responsibility remains with the people and institutions that chose to place it there.
Sources and Qualifications
The discussion draws on the Catechism §§1731–1736 for freedom and imputability and §§1750–1756 for the object, intention, and circumstances of moral acts, with Gaudium et Spes 26–29 on the common good and human dignity. These sources do not describe AI or provide a compliance checklist. Their principles are applied by analogy, distinguishing moral culpability, civil liability, institutional duty, and technical causation.
Source Notes
The Church’s account of moral acts, cooperation, omission, responsibility, and factors that can diminish personal culpability.
The council’s teaching on moral conscience, social responsibility, justice, solidarity, and the dignity of persons affected by institutions.
The European Union’s risk-based legal framework assigning duties to providers, deployers, importers, distributors, and other actors in an AI system’s lifecycle.
A governance framework for documenting and managing AI risks across design, deployment, monitoring, and organizational decision-making.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.