I’m pretty sure that this is a solved problem. For “classical” machine learning, it worked like this in my neck of the woods:

The model’s operator is directly liable for any undue harm caused in the course of the model’s operation. This includes models acquired from third-party vendors. The operator is responsible for ascertaining the model’s fitness for purpose prior to deployment, and for ongoing monitoring of its operation.

If the model came from a vendor, and the operator conducted due diligence but it turns out that the vendor materially misrepresented the model’s capabilities in a way that contributed to the harm, then the vendor can also be held liable.

If that happens then it’s up to a court to apportion the liability.

IANAL but I see no reason why these principles shouldn’t apply to GenAI.