Claims Industry Needs Money Again
Tech Pulse | viable.works Technology Consulting | July 2026
The major Dieselgate proceedings are gradually winding down. The claims industry has been looking for new territory for some time. This time it is not the diesel engine, but software, data and artificial intelligence. The current case brought by a German IT lawyer against the importer of a Chinese electric car shows how quickly theoretical compliance issues can turn into real court proceedings with tangible economic consequences.
The Case
A leased MG4 Electric in Germany was powered by extensive open source software. The manufacturer failed to provide the required licence texts or source code upon request. The plaintiff lawyer is relying on a defect in title under § 435 of the German Civil Code (BGB): the vehicle is not in a condition such that third parties (rights holders) cannot assert claims. The Munich I Regional Court will decide in the coming months whether buyers and lessees can demand remedy – up to and including contract rescission.
The case is not isolated. It is representative of a new generation of proceedings in which customers themselves are taking legal action – no longer just rights holders or associations.
From Open Source to GPAI and GDPR
What is playing out in the MG4 case with classic open source licences is being supplemented in modern driver assistance, SDV and other complex technology systems by General Purpose AI (GPAI) and data protection requirements.
GPAI (General Purpose AI) refers to large, versatile base models that increasingly serve as a foundation for development – even if the final systems deployed in products are often Single-Purpose AI (Dedicated/Narrow AI): specialised models trained and validated for concrete tasks such as object detection, sensor fusion, path planning or quality inspection.
The AI Act addresses both worlds: GPAI models come with high documentation and transparency obligations that must be passed on to downstream developers. Single-Purpose AI in safety-critical or high-risk applications additionally falls under stricter rules.
At the same time, GDPR violations arise whenever personal data from Europe is used to train models in third countries. Missing legal bases, inadequate Transfer Impact Assessments or insufficient additional safeguards can lead to fines, damages claims and injunctions.
This dynamic is not limited to automotive. Semiconductor companies, industrial automation, medical technology and other advanced industries face the same structural risks.
Economic Relevance
New waves of litigation based on the AI Act and GDPR hit organisations of every size. Possible consequences range from individual warranty and defect claims to recalls, loss of value, blocked market access and significant reputational damage. The claims industry will not adjust its business model to the economic situation of any particular sector.
What Really Matters: Solutional vs. Transactional
Most risks do not arise from a single wrong decision, but from two fundamental weaknesses:
- Solutional: The wrong technology or architecture choice — for example a GPAI model that does not allow sufficient documentation and clear interfaces to Single-Purpose AI, or training data whose provenance cannot be demonstrated.
- Transactional: Missing or inadequate processes along the value chain — weak acquisition requirements, no systematic incoming inspection, and no controlled process for training data.
Both can be addressed systematically, whether you are an OEM, a Tier-1 or Tier-2 supplier, a technology company, or a specialised semiconductor or software firm — and whether you are a large corporation or an SME.
Concrete Measures That Work
Theoretical frameworks alone are not enough. The following four priority measures form a pragmatic and scalable foundation. They can be implemented by organisations of any size:
1. Risk Assessment of Assets
Create a clear inventory of all relevant software, AI models, datasets and open-source components. Map each asset against potential claim types (AI Act documentation duties, GPAI obligations, GDPR transfers, licence violations, high-risk classification). Keep it as a living register.
2. Strengthened Acquisition Process
Treat every external software component, AI model, dataset and open-source package as a supply. Update RFQs and contracts so that they explicitly require the necessary documentation, provenance information, licence compliance and audit rights. Evaluate suppliers against these requirements.
3. Incoming Inspection and and Artifact Control
No component, model or dataset enters development or product use without passing a defined incoming check (SBOM, licence scan, model documentation, provenance, integrity verification). Compliant artifacts are stored in a controlled artifact store; non-compliant ones are rejected. The same discipline applies to data as to code.
4. Clean AI Training Process
Establish a controlled process for all training data — whether externally sourced or generated in-house. This includes source approval, legal review, metadata standards, versioning and clear rules against contamination. Prevention at the source is essential because contamination often cannot be detected reliably later.
These four measures already close the most critical gaps. They scale from small expert teams to complex multi-site organisations and work across automotive, semiconductor and other technology domains.
Further Reading & Related Methods
The measures above are not isolated. They build directly on the frameworks and analyses we have already published:
Automotive Guardrail Development Manifest
Our core development paradigm. It provides the strategic foundation for separating solutional and transactional work, establishing claim-based supply chains, and treating safety, security and compliance (including AI/ML components) as non-negotiable. The four concrete measures operationalise key principles of the Manifest.
Vibe Engineering
Shows how strong traceability can be achieved with significantly less effort. Essential for creating and maintaining the technical documentation, model cards and evidence required by the AI Act and for defending against claims.
China Platform Localization for Europe
Addresses the geopolitical and regulatory reality when platforms, models or data pipelines have roots in China — directly relevant for GDPR transfer issues and AI Act compliance in global supply chains.
The Great SDV Decoupling
Explains why technology stacks are diverging and why organisations need architectures and processes that remain resilient under different regulatory regimes (US, EU, China).
These resources together form a coherent toolkit: strategy (Guardrail Manifest), efficient execution (Vibe Engineering), geopolitical context (Decoupling & China Localization), and now concrete operational measures against the rising claims risk.