The proposed Meta settlement, filed on August 26, 2026 and subject to court approval, adds an important element to the argument I made in Designed to Cross: Why Nippon Life v. OpenAI Is a Product Liability Case and then developed in Architectural Negligence: What the Meta Verdicts Mean for OpenAI in the Nippon Life Case. It provides a concrete example of how regulators may translate legal obligations into technical controls and how those controls could inform an architectural-liability analysis.

My earlier comparison treated the Meta verdicts as support for examining liability at the level of system architecture. The proposed settlement sharpens—and limits—that analogy. The two verdicts do not rest on identical legal theories, Nippon presents a different causal structure, and age assurance is a more bounded classification problem than identifying individualized professional advice. The comparison that carries across is narrower: legal restrictions can be translated into technical controls whose design, performance, and governance can be evaluated.

FROM RULES TO WORKING CONTROLS

1. Making the Prohibition Operative

My Nippon Life argument distinguished between placing professional-advice restrictions in terms and policies and designing the product to recognize when an interaction is moving from general legal information into individualized legal judgment. OpenAI’s current Terms tell users not to rely on output as a substitute for professional advice, and its Usage Policies prohibit tailored legal advice requiring a license without appropriate involvement by a licensed professional.

Meta faced a related implementation problem. Facebook and Instagram already required users to be at least 13, and Meta had long acknowledged that users could evade an age screen by misstating their age. The proposed consent judgment would establish an age-assurance framework applying technical methods to determine whether users should be treated as teens or children under 13. Its terms call for annual accredited testing, defined false-positive thresholds, certification under real-world usage conditions, anti-circumvention measures, use of reliable Apple and Google age signals, soft matching across related accounts, and continuing oversight.

The comparison to Nippon operates at the implementation level. A professional-advice restriction can be translated into technical requirements for identifying relevant characteristics of an interaction and changing the system’s behavior as those characteristics accumulate. General legal information might remain available under ordinary conditions. User-specific facts, an active dispute, requested legal conclusions, litigation strategy, or the generation of documents intended for filing could trigger progressively more restrictive responses.

The relevant inquiry in Nippon would therefore reach the adequacy of the controls OpenAI chose to implement. What interactions were they designed to detect? What thresholds changed system behavior? How were they tested, and what failure rates were observed? How did they perform when users supplied increasingly specific facts or sought documents intended for real-world use? What happened when the system could not confidently classify the interaction? The existence of a warning or policy remains relevant, but the architectural inquiry reaches what the product was designed to do when the restricted interaction actually occurred.

2. Bounded Error Instead of Perfect Classification

My original Nippon analysis contemplated a boundary that ChatGPT should stop crossing once the system recognizes that a user is seeking individualized legal advice. An architectural boundary of that kind can remain meaningful even when the system enforcing it cannot classify every case correctly.

The proposed consent judgment expressly permits bounded error in Meta’s age-assurance methods. It defines the U18 False Positive Rate as the percentage of actual 13-to-17-year-old users incorrectly identified or predicted to be 18 or older, excluding method circumvention. Within one year after the Effective Date, which follows court entry, commercially available methods must produce rates at or below 10 percent for users ages 16–17 and 3 percent for users ages 13–15. Proprietary methods must produce rates at or below 14 percent and 7 percent, respectively, within the first year after the Effective Date, and 10 percent and 5 percent, respectively, within the second year. Those tolerances sit within requirements for testing, demographic evaluation, circumvention monitoring, continuing oversight, and corrective action.

Applied to Nippon, the boundary between general legal information and individualized legal advice depends on context. A request for the text of a statute presents a different risk from a conversation involving an active lawsuit, user-specific facts, requested legal conclusions, litigation strategy, and documents intended for filing. A professional-boundary control could evaluate those signals collectively and restrict the system’s behavior as the probability and consequence of crossing the boundary increase.

The acceptable error rate would depend in part on the type and consequence of the error. Failing to recognize individualized legal advice and allowing the interaction to continue may present a different risk from mistakenly constraining a request for ordinary legal information. Severity, available verification, and the burden imposed by the safeguard could therefore inform the tolerances applied to each type of error.

Performance would also have to remain adequate as the system changes. Updates to the underlying model, system instructions, routing logic, user behavior, or methods of circumvention could affect a control that previously performed within acceptable tolerances. Relevant evidence could include observed error rates, known failure modes, changes following system updates, and the provider’s response when performance deteriorated.

The proposed consent judgment does not adjudicate a tort standard of care. It also expressly provides that it may not be construed to establish a standard of care or precedent in any non-participating U.S. state or international jurisdiction, and it contains no admission of liability. As an analytical matter, it illustrates how an obligation directed at a probabilistic technical system can be expressed through measurable tolerances, testing conditions, protective responses to uncertainty, monitoring, and corrective processes. For Nippon, the analogy is a more administrable inquiry into how OpenAI defined the boundary, evaluated its controls, handled uncertainty, and responded to demonstrated weaknesses.

3. From Safeguard to Assurance

My Nippon analysis focused on whether a known risk should have triggered an architectural safeguard. The proposed settlement adds a further layer by requiring evidence that the safeguard performs as intended:

known risk → architectural safeguard → measurable performance → independent validation → monitoring → corrective action.

Deployment alone would not satisfy the proposed settlement. Any method adopted for the framework must be tested annually by an accredited third party and certified under real-world usage conditions, including performance across diverse demographic groups and without reliance on training or tuning data. Proprietary methods are certified by Meta on the basis of its own testing, with the third-party provider evaluating whether that testing supports the certification, and remain under continuous oversight. Meta must continuously investigate new or previously undetected forms of method circumvention and, once confirmed, use best efforts to correct resulting false positives and modify the framework. An independent auditor reviews implementation of the injunctive terms, relevant performance data, and material gaps or weaknesses.

Applied to Nippon, the inquiry would extend to how OpenAI evaluated its professional-boundary controls and what its own records show: evaluation criteria, red-team results, classifier performance, false-negative rates, known bypasses, escalation thresholds, regression testing, incident records, model-version comparisons, and internal acceptance thresholds. Those materials could establish whether OpenAI had a reasonable basis for relying on the control when it was deployed and whether that reliance remained reasonable as evidence of its limitations accumulated.

The architectural question therefore reaches both the safeguard and the assurance process supporting it: whether OpenAI built an appropriate boundary, established that it worked with acceptable reliability, and responded when its own evidence showed otherwise.

FROM TECHNICAL CONTROLS TO LEGAL CONSEQUENCES

4. A Reasonable Alternative Design Need Not Specify the Code

A product-liability theory against OpenAI invites a predictable response: what, exactly, should OpenAI have designed instead? Framed too narrowly, that question can force a plaintiff into the untenable position of having to design a competing LLM, identify the classifier that should have been used, or specify the algorithm that would have prevented the harm.

The proposed consent judgment operates at a different level. The participating States did not prescribe Meta’s source code or require a particular age-assurance technology. Meta could use commercial products, proprietary systems, or combinations of technologies. The obligations run principally to the capability the system must provide and the performance it must achieve, leaving the technical implementation to Meta.

A regulatory settlement does not establish the legal standard for proving a reasonable alternative design in a product-liability case, and age assurance is a more bounded classification problem than determining when a general-purpose AI system has crossed into individualized professional advice. The agreement nevertheless supports describing a proposed alternative at the level of system capability and measurable performance rather than prescribing source code or a particular technical mechanism, subject to the proof required by the governing product-liability law.

Applied to Nippon, the reasonable alternative design could be that OpenAI should have maintained a tested system capable of identifying individualized professional-advice interactions with a defined level of reliability and routing those interactions into an appropriately constrained mode, with OpenAI choosing how to accomplish that result.

That formulation places the inquiry at the level where many AI safety decisions are actually made. The design of an AI product includes model weights, source code, system instructions, classifiers, routing logic, permissions, access controls, warnings, escalation procedures, monitoring, human-review requirements, restrictions on particular uses, and related operational safeguards. If the alleged risk arose from the absence or inadequacy of one of those controls, the reasonable alternative design can be framed in terms of the safer architecture that should have existed.

The question then becomes whether the developer could reasonably have designed the deployed system to recognize a defined category of risk and respond to it with an appropriate safeguard. Framing the proposed safeguard at that level may make an architectural-negligence theory less vulnerable to the objection that product-liability law would require courts to become AI engineers.

5. Designing for Uncertainty

Under the proposed Meta framework, newly created accounts whose age remains unassessed receive protective defaults for 14 days, and after that an unassessed user is treated as a Teen User for purposes of the agreement, subject to specified protections for users who stated an adult age. The design assigns consequences to uncertainty instead of allowing unresolved age to preserve an unrestricted adult setting.

The architecture at issue in Nippon could operate on the same principle. ChatGPT would not have to determine conclusively that a user is seeking legal representation or that the model is “practicing law.” The design question becomes whether identifiable characteristics of the interaction should cause the system to operate differently.

A system could respond normally to a high-confidence request for general legal information. As the exchange becomes individualized, through user-specific facts, an active dispute, jurisdiction-specific questions, requested legal conclusions, filing deadlines, or proposed courses of action, the system could progressively narrow what it is permitted to provide. An ambiguous individualized matter might trigger a constrained informational response. A sufficiently strong combination of signals could require additional warnings, verification, human review, referral, or a refusal to provide the requested conclusion.

Uncertainty about whether the interaction has crossed into individualized professional advice can itself become a design input, with greater uncertainty or greater potential consequence producing more restrictive behavior. The system may be unable to determine with certainty that an interaction has entered a regulated or high-risk domain, yet the developer can still specify how it should behave as the relevant signals accumulate. The same general design principle might inform controls for medical, financial, engineering, and other high-risk interactions, although the relevant boundaries, safeguards, and legal requirements would differ by domain.

6. Governance Records and Foreseeability

Traditional negligence analysis often reconstructs foreseeability after the harm has occurred by asking whether the manufacturer should have anticipated the use or risk that caused it. An age-assurance system operating under the proposed framework could generate contemporaneous evidence bearing directly on that inquiry. Under that framework, Meta could measure how often age assurance fails, how frequently users circumvent it, how often accounts are reclassified, how performance varies across populations, and whether particular controls reduce the conduct they were designed to address.

Those measurements can create a record bearing on actual knowledge. Repeated failures, circumvention patterns, evaluation results, incident reports, internal thresholds, and changes made in response to testing can show when a company identified a risk, how significant it understood the risk to be, and whether its safeguards were performing as intended. The same evidence may also bear on what the company reasonably should have anticipated as experience with the system accumulated.

OpenAI’s own systems could generate a comparable record. If OpenAI classifies legal interactions, records refusals, evaluates model behavior involving professional advice, tests attempts to circumvent safeguards, or measures policy violations, those systems may show how often the relevant conduct occurs and how effectively existing controls address it. A recurring pattern identified through the provider’s own evaluations or monitoring could make it easier to establish that the risk was known before the particular injury occurred.

The significance of that record depends on what the provider did with the information. Evidence that a company identified a recurring risk, measured its frequency or severity, recognized weaknesses in existing controls, and left those weaknesses inadequately addressed could support both foreseeability and breach. Evidence that the risk was rare, difficult to predict, or reasonably mitigated could support the opposite conclusion.

Governance therefore creates evidence as well as controls. Evaluations, logs, incident records, risk assessments, and remediation decisions can establish what the provider knew, when it knew it, and how it responded. As AI governance becomes more systematic, negligence claims may depend less on reconstructing what a developer should have anticipated and more on the record the developer created while operating the system.

7. A Presumption for Independently Evaluated Controls

The proposed consent judgment gives qualifying commercially available age-assurance methods a defined compliance presumption. When Meta uses and relies on such a method for a user, Meta is presumptively compliant with specified age-assurance obligations on the basis of the most recent qualifying third-party certification—but only if it can demonstrate the enumerated conditions: operating the method according to vendor and certification requirements, matching settings to those tested, not encouraging, facilitating, or knowingly permitting circumvention, not willfully ignoring events that impair efficacy, supplying complete and accurate information, and meeting related obligations. Meta remains free to develop its own age-assurance system, but a proprietary system receives no comparable presumption and stays under continuous oversight.

That presumption runs to compliance with the agreement’s own terms rather than to reasonable care in tort. A similar structure could nonetheless connect AI governance controls to the standard of care. Under one possible legal approach, a provider implementing an independently evaluated professional-boundary control that satisfies an accepted technical standard could receive a rebuttable presumption that the control was reasonably designed for that purpose. The presumption would attach only to the particular control and the risks it was designed to address. It would not establish that the AI product as a whole was safe, excuse deficient operation, or protect the provider after evidence showed that the control was no longer performing adequately.

A provider could instead use a proprietary control. Its freedom to innovate would remain intact, but it would have to establish the adequacy of the control through ordinary evidence rather than receive the benefit of the presumption. The law would therefore avoid prescribing classifiers, models, thresholds, routing logic, or other implementation details while still creating an incentive to use controls whose performance has been independently tested.

For professional-advice interactions, an accepted standard might define the categories of conduct the control must detect, minimum performance characteristics, testing conditions, documentation requirements, monitoring obligations, and the safeguards triggered at specified thresholds. OpenAI could decide whether to satisfy those requirements through classifiers, model-based routing, contextual analysis, separate constrained modes, or some combination of them. Independent evaluation would test whether the resulting control met the required performance criteria rather than whether OpenAI had selected a regulator’s preferred engineering method.

The presumption would remain tied to the conditions under which the control was evaluated. Material changes to the model, routing architecture, thresholds, connected tools, or deployment environment could require reevaluation. Evidence of systematic circumvention, deteriorating performance, or known failure modes could rebut the presumption even without a formal change in configuration. Certification would therefore provide evidence of reasonable care at a defined point and under defined conditions, rather than permanent immunity from scrutiny.

Standards would then carry a legal function beyond demonstrating that an organization takes governance seriously. Technical standards can define measurable expectations; independent assurance can establish whether a control satisfies them; and tort law can determine the evidentiary consequence of meeting them. Under such a regime, providers following an independently evaluated path could receive greater legal certainty. Providers adopting different approaches would remain free to do so, but would have to establish the controls’ adequacy through other evidence.

A rebuttable presumption of that kind would also preserve room for liability where the provider knew that a certified control was failing, operated it outside the conditions under which it was tested, or failed to respond as the evidence changed. If measurable governance requirements were independently evaluated and assigned defined evidentiary consequences, they could serve a legal function beyond internal governance or aspirational standards and become part of the framework for evaluating reasonable care.

WHAT META CHANGES FOR NIPPON

8. From Architectural Liability to Architectural Remediation

My March 30 piece treated the two Meta verdicts as evidence that liability can attach to choices embedded in a technology’s architecture rather than solely to the content appearing on the screen. In New Mexico, a jury found Meta liable on both claims the State brought under the Unfair Practices Act for misleading consumers about platform safety and endangering children. The next day, in a Los Angeles youth social-media addiction case, a jury found Meta negligent in designing or operating Instagram and Google negligent in designing or operating YouTube, found that negligence a substantial factor in the plaintiff’s harm, and found inadequate warnings. The two verdicts rest on different theories, and the Los Angeles findings bear more directly on architecture. Both directed attention to product design and the risks associated with design choices, which is why they offered a comparison for Nippon.

The proposed consent judgment identifies corresponding forms of architectural remediation: classification mechanisms bound by quantified performance tolerances, annual accredited testing under real-world usage conditions and across demographic groups without reliance on training or tuning data, protective defaults for accounts whose age remains unassessed, anti-circumvention obligations with best-efforts correction once circumvention is confirmed, continuing monitoring, and independent evaluation of implementation and material gaps.

Applied to Nippon, a claim that OpenAI should have prevented ChatGPT from crossing into individualized legal advice becomes more concrete when the proposed safeguard is described at that level, with OpenAI choosing the technical implementation. The verdicts and the proposed settlement therefore contribute different kinds of evidence. The verdicts support attention to architectural choices in assessing liability. The proposed settlement provides an example of how alleged architectural deficiencies can be addressed through defined, measurable, and reviewable controls without prescribing source code.

9. Causation and the Intervening User

In the Los Angeles case, the claimed harm arose from the plaintiff’s repeated interaction with features alleged to affect behavior, including recommendations, notifications, engagement mechanisms, social comparison, and continuous scrolling. The New Mexico enforcement action concerned Meta’s alleged misrepresentations about platform safety and conduct endangering children; it did not present the same user-specific causal chain.

Nippon presents additional causal steps. Nippon alleges the following sequence:

ChatGPT assistance → Dela Torre’s reliance and decisions → court filings → Nippon’s claimed litigation costs and legal expenses.

On Nippon’s account, the alleged sequence gives OpenAI a substantial causation argument. Dela Torre allegedly decided whether to accept ChatGPT’s suggestions, use the documents it generated, and file them with the court. OpenAI might argue that those independent acts, rather than the design of ChatGPT, produced the claimed injury.

The system architecture remains relevant to whether those acts should break the causal chain. According to Nippon’s complaint, ChatGPT allegedly analyzed a response from Dela Torre’s former lawyer, generated Rule 60(b) legal arguments, formulated a draft motion to reopen the settled case, and later assisted with filings in related litigation. A product designed to adapt its responses to a user’s circumstances and generate materials that enable the user to carry out a suggested course of action makes some resulting conduct more foreseeable than a product that merely supplies static information.

The causal inquiry can therefore account for the relationship between the system’s functions and the user’s subsequent acts. Where a design allows the system to assist through successive steps toward a course of action it has suggested, the user’s decision to act on that assistance may bear on foreseeability rather than automatically severing causation. The user’s independent judgment remains part of the analysis, as does the extent to which the system enabled the conduct that produced the alleged harm.

Agentic systems can shorten the causal chain further. A system may analyze a problem, recommend a course of action, and generate the materials needed to pursue it while leaving execution to the user. Once the system is authorized to act through connected tools and delegated permissions, fewer independent human decisions may stand between the system’s output and the resulting conduct. The system may send the message, submit the filing, initiate the transaction, or take another external action itself.

As AI systems assume more of the execution, proximate-cause analysis will have to account for the diminishing role of intervening human conduct and whether the resulting harm flowed from actions the system was authorized and designed to perform. This progression echoes the concept I called “iterative liability” in my July 2011 post, The Case of the Robot: Personal Liability, Part II — Iterative Liability. The liability analysis should adjust as an AI system assumes a greater share of the decisions and conduct producing an outcome.

WARNING → CONTROL → ASSURANCE

My March 30 piece described a movement from warnings toward architecture. The proposed settlement adds assurance: evidence that the controls perform as intended and a process for correcting them when they do not.

For the risks covered by the proposed settlement, Meta would implement controls subject to defined performance requirements, annual testing and certification, and specified monitoring and corrective processes, with independent evaluation of implementation and any material gaps or weaknesses. The proposed consent judgment remains subject to court approval, contains no admission of liability, and includes specified limitations on its use as a standard of care or precedent elsewhere.

Applied to Nippon, a professional-boundary control could be evaluated through the same sequence. OpenAI could define the interactions the control is intended to identify, establish acceptable performance levels, test the control under realistic conditions, measure failures and circumvention, monitor performance after deployment, and modify the control or the system’s permitted behavior when the evidence shows that existing protections are inadequate. A guardrail that performs adequately when introduced may deteriorate as the underlying model changes, users discover ways around it, new use patterns emerge, or the provider expands the system’s capabilities, so testing at deployment supplies only part of the relevant evidence.

A provider may have implemented a safeguard and still face questions about how the safeguard was evaluated, what failures it detected, how frequently they occurred, whether their consequences were significant, and what it did after learning of them. An architectural-negligence theory in Nippon could therefore reach the way a professional-boundary control was governed over time, and the adequacy of the architecture would depend in part on how the provider responded to evidence generated by its own system.

A warning communicates a boundary or risk. A control changes what the system can do when that boundary or risk is encountered. Assurance generates evidence about whether the control performs as intended and supports corrective action when it does not.