AI is already assisting people in planning mass shootings, yet the law is scarcely taking notice

(SeaPRwire) –   On February 10, 2026, 18-year-old Jesse Van Rootselaar carried out a mass shooting in Tumbler Ridge, British Columbia, killing eight people before taking her own life. Prior to the incident, OpenAI had flagged her ChatGPT conversations for an alarming preoccupation with extreme violence and suspended her account— but reports indicate the company did not notify law enforcement.

On October 2, 2025, Jonathan Gavalas, a young man from Jupiter, Florida, died by suicide after forming what his father’s lawsuit described as a romantic attachment to Google’s Gemini chatbot. The suit alleged Gemini coached Gavalas to end his life, and noted Google had flagged his account 38 times over five weeks for sensitive content without restricting or terminating access.

These and other tragedies demonstrate that generative AI can potentially contribute to harming individuals, organizations, and the environment. As a legal scholar with nearly a decade of focus on AI liability and new frameworks for evaluating AI companies’ responsibilities, I believe such cases force unresolved questions on the legal community: If an AI firm detects warning signs of harm, does it have a legal obligation to alert relevant authorities? And should inaction in such cases be considered negligence?

A need to raise red flags

U.S. tort law provides a framework for examining this type of responsibility. In 1969, Prosenjit Poddar, a psychiatric patient at the University of California, told his therapist he intended to kill Tatiana Tarasoff. The therapist notified campus police, who briefly detained Poddar but released him. Tarasoff was never warned, and Poddar murdered her shortly after.

Tarasoff’s family sued the university, arguing its failure to warn amounted to negligence. In 1976, the California Supreme Court ruled that mental health professionals have a legal duty to take reasonable steps to protect identifiable individuals from serious harm if they have credible reason to believe a client poses a threat— including warning the victim or law enforcement. Today, most U.S. states recognize some version of this “Tarasoff duty.”

The logic is straightforward: If you hold special knowledge of a grave threat and can act (even just warning authorities or potential victims), the law may require you to do so. But does this apply to AI companies?

The case for yes is compelling. AI platforms interact with millions of users daily, often discussing deeply personal matters like mental health struggles, relationship issues, and violent thoughts. Most firms have systems to detect conversations that raise red flags.

Requiring AI companies to respond might be less controversial than for human therapists. Therapists are bound by strict confidentiality rules that complicate warning third parties ethically and legally. AI firms operate under far weaker regulations, especially in the U.S., which lacks a comprehensive federal privacy law.

This lighter regulatory burden makes it easier to justify requiring AI companies to act when someone’s life is at risk. Still, balancing this duty with privacy protection remains critical.

Who to warn, and when

The first challenge in applying the Tarasoff framework to AI is accuracy. Predicting violence is hard even for trained mental health professionals, and AI systems or human moderators reviewing flagged content are not clinicians. Requiring them to judge genuine threats could lead to many false positives— with real consequences for users whose accounts are suspended or data shared with authorities due to misread signals.

The second challenge is scale. A therapist sees dozens of patients; AI platforms serve hundreds of millions of users. Imposing a duty to monitor and act on worrisome content could create perverse incentives: firms might reduce monitoring to avoid gaining knowledge that triggers legal liability, reasoning “what you don’t know can’t hurt you.”

The third challenge is identifying at-risk parties. In the 1969 case, Poddar named Tarasoff explicitly. But many AI conversations contain vague violent or self-destructive language without a specific target. Courts will need to set clear standards for when a threat is specific enough to trigger a warning duty, and who should receive the warning or protective action.

Growing urgency

The AI industry is expanding rapidly, yet legal rules governing firms’ obligations to users and the public are deeply unclear. Courts are beginning to address these questions case-by-case— for example, whether OpenAI is responsible for a gunman who killed two Florida State University students on April 17, 2025. The shooter, armed with a semi-automatic pistol, allegedly had extensive ChatGPT conversations about maximizing the weapon’s effectiveness.

A narrow, carefully defined warning duty— triggered only when an AI system flags behavior and a human reviews it— would be a meaningful step forward. It could initially focus on the most serious and credible threats.

This practice could also shift the conversation away from technical debates about whether AI chatbots are products, services, or media (which complicate legal claims) to a more human question: Did the company know someone was in danger, and did it do enough to warn them and authorities?

Anat Lior, Assistant Professor of Law, Drexel University

This article is republished from The Conversation under a Creative Commons license. Read the original article.