On Friday, I had the privilege of delivering the keynote at the 2026 EastCon Cybersecurity Symposium on a question every organization deploying AI now has to answer: When a machine causes harm, who is responsible? My short answer: never the machine. AI has no legal personality. It cannot owe a duty of care, form intent or pay damages. Responsibility always traces back to a person or an organization. The real fight is over which one, on what legal basis, and whether the injured party can prove it. A few points I shared with delegates: 🔹 "The algorithm did it" is not a defense. In Moffatt v Air Canada (2024), the airline was held responsible for what its own chatbot told a customer. If you put an automated system in front of the public, you own what it says and does. 🔹 Outsourcing the technology does not outsource the accountability. Banks, telcos, hospitals and government bodies that deploy AI are usually the party closest to the harm, and under data protection law they typically carry the primary duties, whatever the vendor promised. 🔹 Uganda has no AI-specific law yet, but that is not a gap you can hide in. The Data Protection and Privacy Act 2019, the Computer Misuse Act, the Electronic Transactions Act, sector regulation, and ordinary contract and tort law already apply. 🔹 AI-enabled attacks are raising the bar for what counts as "reasonable security." When attackers are anonymous and offshore, victims and regulators turn to the organization that failed to defend against a foreseeable threat. The working principle I proposed: responsibility follows control and benefit. Whoever designs, deploys and profits from a system should bear the risk it creates, in proportion to their control over it. In practice, that means governance you can demonstrate, not just assert: risk assessments before deployment, meaningful human oversight, security by design, proper logs and audit trails, AI-specific incident response, strong vendor contracts, staff training and board-level ownership. Accountability has to be designed in before deployment. It cannot be argued into existence after the harm. Thank you to the EastCon organizers and to everyone who joined the conversation. I'd welcome your thoughts: is your organization ready to answer the question "who is responsible?" with evidence? #AI #Cybersecurity #TechLaw #DataProtection #AIGovernance #Uganda #EastCon2026 @MoICT_Ug @DICTSMakerere