A major problem with LLM's is that they don't reason in a way humans are used to thinking of reason. If we tried to give them something like Asimov's laws of robotics, they likely wouldn't be able to apply them reliably. This is a challenge for AI companies working on the bleeding edge, and it's fairly obvious those companies should be held accountable for mistakes, whether caused by carelessness or not. It's no different than an oil spill. They may or may not be subject to charges based on what happened but, regardless, they are responsible for cleanup costs.

What's less obvious is who should be held accountable when a customer of one of these corporations uses their product and it unexpectedly does bad things. e.g. A fellow asks his AI assistant to book him into a high-demand class at the local gym, so the LLM probes the gym's website for vulnerabilities, books him into a date that is farther into the future than the system is supposed to permit, and then drops other people from earlier classes until he's bumped into the one he wanted. If the gym decides to press charges, who should they be applied to?

This sort of case is more difficult to answer. The company that provided the AI certainly bears some responsibility. Perhaps most of it. Possibly even all of it if they represented their AI as reliably law abiding. If a user knowingly uses an AI that is not guaranteed to abide by the law, is that user partially liable for what the AI does too?

IANAL. I'd love to hear perspectives on this question.