Tumbler Ridge attack and legal liability of artificial intelligence companies

Ankara Hacı Bayram Veli University Faculty Member and SETA researcher Prof. Dr. Erman Smart wrote about the legal liability, user privacy and security obligations of artificial intelligence companies regarding the Tumbler Ridge attack for AA Analytics.

Following the attack in Tumbler Ridge, Canada, the number of lawsuits filed against OpenAI and the company's CEO Sam Altman reached 37 in September. The plaintiffs allege that the company detected the attacker's violent speeches months in advance, failed to warn Canadian authorities despite the concerns of its security team, and failed to prevent the user in question from re-opening an account. The allegations have not yet been judicially proven. However, the official letter sent by OpenAI to the Canadian government confirms that the relevant account was closed in June 2025 and was not reported to law enforcement authorities in accordance with the filtering protocol implemented at that time. The company's acceptance that it will report the same account within the scope of today's protocol brings the case to a critical level in terms of public liability.

Limits of liability

This incident shows that platform neutrality, one of the founding myths of the internet, has collapsed in the age of productive artificial intelligence. The argument that technology companies are simply intermediaries who are not responsible for the content passing through their systems does not explain the models that produce, format and direct content to the user. Responsibility therefore shifts from content to architecture. As important as who wrote a single malicious answer, the purposes for which the system was designed, what behaviors it encouraged, what risks it could foresee, and what security choices it made for growth are also important. A company that generates commercial value from user interaction and engagement cannot impose on society the cost of foreseeable damages arising from its system architecture.

Accountability must also extend across the entire AI value chain. The company that developed the basic model, the provider that uses it in a particular service, and the distributor that delivers it to the user cannot be held equally responsible; but none of them can make their own role invisible. There is an epistemic responsibility here that goes beyond safety and consumer harm. Artificial intelligence systems produce information, provide visibility, and shape the cognitive basis on which people make sense of reality. An artificial intelligence system that shapes what information people access and how they make sense of the world cannot be viewed as neutral, like a telephone cable that merely carries information from one point to another. Unfortunately, platform neutrality, as interpreted today, has become a corporate strategy to avoid responsibility rather than an objective reality that defines technology.

A company's concrete responsibility must begin with its knowledge, control and response capacity over foreseeable risk. Of course, technology companies cannot be considered the absolute guarantors of every harmful action. However, the actor who can establish security protocols, detect dangerous patterns, and stop the threatening account must exercise reasonable care. Because the independent action of the user does not eliminate the liability of the company. Criminal responsibility belongs to the person who committed the action; Legal liability can be shared among more than one actor. Just as the user being the perpetrator does not automatically make the company innocent, the company's negligence does not turn the perpetrator into an unwilling tool. The issue that needs to be considered is whether the loss incurred coincides with the risk that the company has identified or should have foreseen.

Privacy protection

The privacy debate is the other side of this case. In a statement he made in 2025, Sam Altman stated that the sensitive information shared by users with ChatGPT does not have legal confidentiality protection similar to conversations with a lawyer, doctor or therapist. In other words, these conversations, which users think will remain confidential, can be requested from OpenAI in the event of a lawsuit and can be used as evidence in court.

People share a lot of information with artificial intelligence, from their mental problems to their family lives, from their legal concerns to their most private thoughts. However, these shares may turn into evidence that can be used against users in the future. In this regard, the risk is even more sensitive for lawyers. Because transferring client information to these systems may damage professional secrecy and the legal protection of works created within the scope of case preparation. Companies encourage users to communicate with artificial intelligence as if they were talking to a personal confidant, but this relationship lacks the legal confidentiality guarantees of conversations with a lawyer, doctor or therapist.

When public security and user privacy conflict, the main principle should be the protection of privacy, and notification to the competent authorities should only be made in case of a concrete, serious and imminent danger. Reporting every violent plot or expression of anger directly to the police could turn artificial intelligence systems into a mass surveillance tool. On the other hand, when a real and imminent threat to life safety is detected against a specific person or group, the right to life must take precedence over everything else.

How should the process be managed?

The warnings produced by the software should not be considered sufficient on their own, the data should be examined by experts, and the official notification decision should be made only after this second evaluation. Only enough information to eliminate the threat should be shared with law enforcement units. The retention period of user data should be limited from the beginning, access requests for these records must be subject to the approval of the judge, and the user must be informed about the process as long as it does not jeopardize the investigation. As a matter of fact, for conversations with artificial intelligence, a legal guarantee of confidentiality should be provided, just like in meetings with a lawyer, doctor or psychologist, except for very exceptional cases that threaten public security. Thus, the task of ensuring life safety can be fulfilled without turning artificial intelligence into an uninterrupted surveillance mechanism.

It is unacceptable to leave these limits to the closed protocols of companies. Courts can fill legal gaps by adapting the principles of negligence, foreseeability, product liability and causation to new technology. However, the standards developed through jurisprudence remain fragmented and often come into play after the damage occurs. A comprehensive and clear legal framework; It should require risk assessment before the product is put on the market, independent auditing, keeping records, detection of repeated violations, special protection mechanisms for children, internal whistleblower assurance, and reporting serious cases to the competent public body. Direct notification to law enforcement units can be limited to imminent and credible threats, while borderline ambiguous cases can be handed over to an independent panel consisting of security, mental health, privacy and legal experts.

The jurisprudence created by the Tumbler Ridge cases will be legally decisive on several fundamental points. A critical threshold is whether the court will treat generative AI as a platform that merely hosts user content or as an interactive system subject to product liability due to its design and outputs. In this process, it will also become clear at what point the company's actual knowledge of the danger will give rise to a special duty of care, whether the independent criminal act of the user will cut the causal link, and whether managers who disable the recommendations of security units can be held personally responsible. As a matter of fact, the fact that the federal court ruled in the Garcia case about Character AI that chatbot outputs cannot directly be disguised as freedom of expression shows that the judiciary will no longer apply classical platform doctrines unquestioningly. The decisions that will arise are; It can transform the industry's design, recordkeeping, privacy and reporting standards on a global scale.

Where there is power, responsibility should also be sought equally. Technological innovation does not grant any company immunity from social responsibility; As algorithmic power expands, public accountability must also deepen.