§III.4 Layer 4 — Application: Deployers and Integrators

What this layer is, in plain language

The application layer is where the foundation models built by the frontier labs of Layer 3 are turned into deployed products that ordinary people use. Foundation labs typically expose their models in two ways: through their own consumer-facing products (Anthropic's Claude.ai; OpenAI's ChatGPT) and through APIs that other companies can build on. Many of the AI products that users actually engage with are built by deployers — companies that take a foundation-model API, wrap it in a system prompt, configure safety settings, design a user interface, and ship the result as a branded product distinct from the foundation lab.

Character Technologies (operator of Character.AI) is the most-discussed example in the active wrongful-death litigation. Other deployer categories include enterprise integrators (companies embedding chat features into their own products via foundation-lab APIs); reseller-style platforms that aggregate multiple foundation models behind a single interface; and a substantial volume of general-purpose chatbot products that consumers reach through web and mobile apps.

People who work at this layer include product engineers, prompt engineers, deployment-engineering staff, content-moderation operators, customer-experience designers, age-gate and trust-and-safety operators specific to the deployed product, and the policy and legal teams that attend to the deployed product's terms of service and risk profile.

Why this layer matters for harm output

The application layer is where harm reaches the user as a deployed-product experience. A foundation model is statistical machinery; a deployed Character.AI persona, a ChatGPT conversation, a third-party chatbot built on a frontier API — these are products as the user encounters them. Where Layer 3 determines what the underlying model can produce, Layer 4 determines what the deployed product does produce in the specific circumstances of an actual user interaction.

For harm-output litigation, this is the layer where the largest share of named defendants currently sits. Garcia named Character Technologies as the principal product defendant; the Raine matter names OpenAI in its capacity as both foundation-model lab and deployer of ChatGPT. Where a deployer builds a product that wraps a foundation model in conversational design, default-character configurations, and minor-accessible interfaces, the deployed product becomes the immediate object of design-defect and failure-to-warn analysis — even if elements of the underlying model behavior trace upstream to Layer 3 decisions.

Technical issues at this layer

Deployer engineering practice at the application layer includes:

• System-prompt design. The system prompt is the persistent instruction text the deployer prepends to every user interaction; it shapes the model's persona, its default behaviors, and its response to specific content categories. System-prompt content is one of the most consequential — and, for harm-output analysis, most directly attributable — design decisions at this layer.
• Safety-tuning at deploy time. Beyond the alignment training the foundation lab performed at Layer 2, deployers can (and routinely do) apply additional safety-related fine-tuning to the deployed model. The presence, scope, and content of deploy-time safety-tuning varies widely across deployers and is generally proprietary.
• Content-filter selection and configuration. Deployers select content-classifier components — sometimes the foundation lab's own classifiers, sometimes third-party safety APIs — and configure them with thresholds for what to allow, block, or escalate to human review.
• Age-verification and parental controls. Where the deployed product is accessible to minors (or marketed to general consumer audiences without effective age gating), deployers face a discrete set of design decisions about age verification, parental access, and minor-protection product flags. Character.AI publishes a public-facing Safety Center documenting four such surfaces — Parental Insights, Content Moderation, Teen Safety, and Reporting — and a multi-step parental-insights workflow that requires teen-initiated invitation followed by parental email confirmation. The lab's own framing positions this work as "safety-by-design ... anchored by our goal of creating a safe and engaging experience." (Source: https://character.ai/safety T2, accessed 2026-05-07.)
• Escalation pathways and crisis-resource integration. When a deployed product detects user statements of distress or self-harm, the deployer chooses what response patterns the product produces — whether crisis-resources information is surfaced, whether a human-review escalation is triggered, whether the conversation is interrupted, and so on. The presence and effectiveness of these pathways is a recurring focus of plaintiffs' allegations in the active wrongful-death matters.
• Default-character behaviors and system-prompt-tuned personas. Where the deployed product allows users to interact with named characters (Character.AI's primary product surface), the deployer designs the default behaviors of those characters, including how characters respond to expressions of romantic attachment, distress, or self-harm. These choices are documentary artifacts in subsequent litigation.
• Model-upgrade behavior across the deployed product's lifetime. Deployers update both their wrapping configurations and the underlying foundation models; deployed-product behavior can change between user sessions even when the user-facing interface looks unchanged. Character.AI's blog records ongoing product activity through 2026, including model updates, memory features, and product releases. (Source: https://blog.character.ai/ T2, accessed 2026-05-07.)

Legal issues at this layer

Layer 4 is where direct product-liability exposure concentrates in current litigation. The principal doctrinal touchpoints include:

• Direct product-liability exposure for the deployed product. Garcia v. Character Technologies established at trial-court level that, in the M.D. Fla. court's words, Character.AI is "a 'product for the purposes of Plaintiff's claims [arising] from defects in the Character A.I. app rather than ideas or expressions within the app.'" (Source: 785 F. Supp. 3d 1157, 1180 (M.D. Fla. 2025), as cited in McGuireWoods, "Can Social Media or AI Be a Defective Product?", Product Liability & Mass Tort Monitor, March 18, 2026, https://www.mcguirewoods.com/client-resources/alerts/2026/3/can-social-media-or-ai-be-a-defective-product/ T7.) The Conway ruling addressed at Part I §I.7 supplies the doctrinal substrate; deployers in Garcia's position are direct primary defendants under the framework that ruling articulates.
• Failure-to-warn at the point of deployment. Where the foundation lab's API documentation describes risks and limitations, but the deployer's user-facing product does not surface those risks to end users, the failure-to-warn doctrinal frame attaches at the deployment surface. The McGuireWoods analysis observes that "the learned intermediary doctrine offers no refuge for direct-to-consumer platforms marketed to and used by minors" — the deployer cannot rely on intermediate professional judgment shielding it from end-user warning obligations the way pharmaceutical manufacturers historically have. (Source: same McGuireWoods URL above.)
• Architecture-as-defect framing in pleadings. The KL Gates litigation alert observes that "Plaintiffs, by contrast, increasingly draft complaints to target the architecture of the deployed system—guardrails, defaults, escalation pathways, and marketing—so the case looks like a product-defect dispute instead of a content dispute." This is the operational doctrinal frontier at Layer 4: complaints are increasingly drafted to plead the deployed product's architecture (system prompts, defaults, escalation choices, marketing claims) as the defect, rather than relying on individual chatbot outputs as the harm vector. (Source: KL Gates, "AI Product Liability: The Next Wave of Litigation," Amy Wong and Jin J. To, March 27, 2026, https://www.klgates.com/AI-Product-Liability-The-Next-Wave-of-Litigation-3-27-2026 T7.)
• Supply-chain liability reaching upstream. The KL Gates analysis further observes that "liability theories are moving up and down the AI supply chain as plaintiffs explore component-part and substantial-participation theories that can reach upstream and downstream actors." Conway in Garcia permitted theories aimed at the upstream foundation-model technology provider to proceed at the pleading stage. The deployer is the direct primary defendant; component-part doctrine reaches the upstream foundation lab. (See §III.5 below for the component-part-manufacturer doctrinal frame at the hosting and infrastructure layer.) This is the doctrinal mechanism by which Layer 4 litigation produces evidentiary and doctrinal pressure at Layer 3.
• Targeted state-statute exposure. California's AB 316 (addressing "autonomy" defenses) and SB 243 (companion chatbots) supply state-level statutory frameworks specifically targeted at deployer practice, particularly for products accessible to minors. Together with the EU Product Liability Directive (Directive 2024/2853, with member-state transposition by December 2026), these statutes are likely to be cited in subsequent deployer-defendant matters as evidence of foreseeable risk and reasonable safeguards. (Discussed in detail at Part IV §IV.4.)
• Continuous-update liability frontier. McGuireWoods observes that "the continuous-update nature of software products creates plausible grounds for courts to impose an ongoing post-sale duty to warn and implement safety features as evidence of harm accumulates." (Source: same McGuireWoods URL.) This frontier — post-sale-modification doctrine applied to deploy-time updates — is most acute at Layer 4, where deployer-side updates affect the deployed product's behavior even after release. The Raine amended-complaint safeguard-removal theory, although directed at OpenAI as both foundation lab and deployer, is the active vehicle for this issue.
• Adjacent-case doctrinal pressure from the broader AI / social-media MDL. McGuireWoods and KL Gates both note that the MDL No. 3047 In re Social Media Adolescent Addiction litigation (with over 2,200 active cases as of February 2026, pending in the U.S. District Court for the Northern District of California) is supplying parallel doctrinal development on closely-related issues — algorithmic-design-as-product-defect; Section 230's reach as to design architecture versus third-party-content; reasonable-alternative-design analysis under the Restatement (Third) of Torts. While MDL 3047 is technically a social-media matter rather than an AI matter, its bellwether rulings will function as persuasive authority in deployer-defendant AI matters, particularly on threshold product-versus-service questions and on defect framings that target architectural design decisions. (Sources: same McGuireWoods + KL Gates URLs above.)

GRAD-INTERN — Character.AI as paradigm-defendant and the post-settlement doctrinal residue

Character.AI, at the time of the Garcia events, had been built atop foundation-model technology associated with an upstream provider (the Garcia complaint named Google as that upstream provider, on a component-part-manufacturer theory; that theory is taken up at §III.5 below and at Part IV §IV.3.a). The Conway ruling permitted both the deployer and the upstream provider to proceed past pleading. In January 2026, Character.AI agreed to settle Garcia and several other matters; the settlements resolved the specific cases without producing the appellate doctrinal record those cases otherwise might have produced. The post-settlement state of doctrine is thus: Garcia's product holding is on the books at trial-court level (Conway, M.D. Fla. May 2025); Character.AI continues operating as a deployer with an active product roadmap (its blog records ongoing model and feature activity through April 2026); its public-facing safety architecture is documented at the lab's own Safety Center; and the doctrinal questions the Conway ruling raised remain — in McGuireWoods's framing — "largely unresolved." For the abstracted product-liability attorney working in this space, this is doctrinally consequential: the bellwether case has supplied a plead-able theory and a ruling-on-the-books, but the appellate development that would harden that theory into binding precedent has not occurred. Subsequent matters (including Raine on the foundation-lab side; the not-yet-public Nov-2025 college-graduate matter; the four settled wrongful-death matters discussed at Part I; and additional state-AG matters such as the Pennsylvania AG action against Character.AI discussed at Part I §I.5 and Part IV §IV.3.f) will, individually and collectively, supply or fail to supply that further development. The KL Gates analysis frames this trajectory directly: "the first bellwether jury verdicts will establish critical precedents for the cases that follow." The phase between Conway-ruling-on-the-books and bellwether-jury-verdict is the phase the doctrine is in as of access date for this research. None of the foregoing is legal advice; the determination of how any specific factual record fits within the doctrine described here is, as always, a matter for the trier of fact in the specific case with the actual record before it.

§III.5 Layer 5 — Hosting and Infrastructure

What this layer is, in plain language

If Layer 4 is where the deployed product is built, Layer 5 is where the deployed product runs. AI applications operate in production atop a stack of infrastructure components that are largely invisible to end users but operationally essential: cloud compute providers, content-delivery networks, identity-and-authentication providers, telemetry-and-monitoring systems, and the underlying data-storage infrastructure. Foundation labs are themselves operated atop hosting infrastructure (the largest labs increasingly own substantial compute capacity, but the broader ecosystem still depends on cloud providers); deployers run their applications on cloud infrastructure of their own choosing.

People who work at this layer include cloud-platform engineers, security-operations engineers, content-delivery-network operators, identity-and-auth engineers, observability-and-telemetry engineers, and the supply-chain and procurement functions that select and contract with infrastructure providers.

Why this layer matters for harm output

This is the layer that tends to be invisible to harm-output litigation analysis until a specific case surfaces it — and in the Garcia / Setzer matter, a specific case did surface it. The Garcia complaint named not only Character Technologies (the deployer) but also Google in its capacity as upstream technology provider, on a component-part-manufacturer theory. The Conway ruling permitted the upstream-provider claim to proceed past pleading, and Google joined Character.AI in the January 2026 settlement. (Source: Jurist, "Google and Character.AI agree to settle lawsuit linked to teen suicide," January 8, 2026, https://www.jurist.org/news/2026/01/google-and-character-ai-agree-to-settle-lawsuit-linked-to-teen-suicide/ T5.) The doctrinal mechanism reaches Layer 5: the manufacturer of an essential component in a downstream product can, under traditional doctrine, be exposed to product-liability claims arising from harms caused by the downstream product. Where AI-ecosystem hosting and infrastructure constitutes "an essential component" of the deployed AI product is a question the litigation pipeline has now begun to test.

Technical issues at this layer

Practice at Layer 5 includes:

• Cloud compute and storage, including the GPU and TPU resources required to host frontier models in production; latency, availability, and throughput as deployed-product attributes.
• Content-delivery network and edge presence, where deployed AI products are distributed for global access; load-balancing and failover infrastructure.
• Identity and authentication infrastructure, including age-verification systems where age gating is implemented at the infrastructure rather than the application layer.
• Abuse-pattern detection at infrastructure level, where unusual usage patterns (volume; geography; behavioral signatures) are detected before they reach application-layer content moderation.
• Telemetry and observability, including the instrumentation through which deployed-product behavior is monitored; the data captured here is foundational to any post-deployment monitoring or safety-incident response.
• Data-storage infrastructure, including persistence of conversation histories, account data, and (where retained) model-input-output records that become discovery targets in subsequent litigation.

Legal issues at this layer

The doctrinal touchpoints at Layer 5 include:

• Component-part-manufacturer doctrine. Garcia permitted claims against Google in its capacity as upstream technology provider; the Jurist reporting frames the matter as alleging strict liability "for failing to prevent harm to minors 'arising from their foreseeable use of such products.'" (Source: same Jurist URL above.) The doctrinal mechanism — that a component-part manufacturer can be exposed to product-liability claims arising from harms caused by the downstream product — is well-established in non-AI tort law (automotive component-parts being the historical paradigm). Whether the doctrine extends to AI-ecosystem upstream providers is an active question; Garcia's pleading-stage permission is not a final ruling on the merits, and the Conway court's reasoning will be tested as additional matters develop. (See also Part IV §IV.3.a.)
• Chain-of-supply liability and supply-chain framing. The KL Gates analysis cited at §III.4 above observes that "liability theories are moving up and down the AI supply chain as plaintiffs explore component-part and substantial-participation theories that can reach upstream and downstream actors." This framing applies forcefully at Layer 5: cloud and infrastructure providers are "upstream actors" whose products and services enable the deployed AI experience. (Source: same KL Gates URL above.)
• Contractual cascade through SLAs and terms of service. Where infrastructure providers have terms of service that restrict certain uses, violations of those terms by deployers can produce contractual remedies for the infrastructure provider. Whether contractual structures upstream of Layer 4 produce negligence or product-liability exposure for Layer 5 actors when deployers cause user-harm is part of the doctrinal frontier this layer's litigation will develop.
• Discovery surface for telemetry. Where Layer 5 infrastructure captures detailed telemetry of deployed-product behavior, that telemetry is reachable in discovery. The presence (or absence) of telemetry adequate to detect harm-output patterns becomes, in subsequent litigation, evidence of either the scope of available knowledge or the gaps in available knowledge — both of which inform foreseeable-risk and standard-of-care analysis.

GRAD-INTERN — The component-part-manufacturer doctrine and the limits of present substrate

The component-part-manufacturer doctrine exists in tort law to address exactly the structural situation that AI hosting and infrastructure create: harm reaches a user through a deployed product, but the deployed product is built atop a stack of upstream-provider components whose providers may have varying degrees of foresight about how the components will be used. Traditional applications in non-AI contexts (a defective brake component in an automobile; a defective pacemaker battery; a contaminated industrial chemical used in food processing) supply the doctrinal substrate. Conway permitted the doctrine to reach Google as upstream provider in Garcia; Google joined Character.AI in settling, with the result that the question of whether the doctrine survives the merits stage in this matter never reached a ruling. Whether the doctrine extends generally to cloud-compute providers, to CDN operators, to identity-providers, to telemetry-vendors — these are questions the litigation pipeline will answer or fail to answer over the next several years. Our research substrate at Layer 5 is admittedly thin: the public-facing literature on AI infrastructure-and-harm-output is dispersed and primarily commercial-positioning material rather than doctrinal analysis. The Conway ruling and the McGuireWoods and KL Gates commentary discussed at §III.4 above supply the principal doctrinal substrate; per-infrastructure-actor analysis at the granularity needed for litigation cross-examination is a candidate for follow-on research. We mark this as a research-gap per the methodology established in companion file Layer 1's grad-intern callout: research-gap acknowledgment is part of the methodology, not a defect of it.

§III.6 Layer 6 — End-User Surfaces

What this layer is, in plain language

The end-user surface is the part of the AI ecosystem the user actually sees and touches: a chat interface in a web browser, a mobile-app conversation screen, a chatbot embedded in another product (a customer-service widget; a companion-app interface; a Discord bot). Where Layers 1-3 produce the underlying model and Layer 4 wraps it into a deployed product running on Layer 5 infrastructure, Layer 6 is the moment when AI-generated output reaches a person.

People who work at this layer include user-experience designers, front-end engineers, accessibility engineers, age-gate and minor-protection product designers, content-warning and crisis-resource UX specialists, and the customer-experience operations staff who interact with end users when the surface fails.

Why this layer matters for harm output

This is the layer where harm is experienced. A chatbot's output, however shaped by upstream Layers 1-5, becomes harm to a person at Layer 6: a user reads it, processes it, responds to it, acts on it. Harm-output analysis that does not engage with Layer 6 is incomplete; harm-prevention design that does not address Layer 6 is incomplete. Multiple of the harms named in active litigation reduce, at the user-experience layer, to specific UX choices: whether a crisis-resources box appeared when distress signals were detected; whether the conversation was interrupted or allowed to continue; whether the user was reminded that the chatbot is not a human, not a clinician, not a crisis counselor; whether parental-notification surfaces were activated for minor users.

The scale of the question at this layer is unusual. Psychiatric Times reports, in an April 2026 forensic-psychiatry-perspective piece, an OpenAI disclosure that "approximately 1.2 million of its 800 million ChatGPT users discuss suicide weekly on its platform." (Source: Frances, Simpson, and Pierre, "The Psychiatrist's Preview of Legal Cases Against Big AI," Psychiatric Times, April 21, 2026, https://www.psychiatrictimes.com/view/the-psychiatrist-s-preview-of-legal-cases-against-big-ai T5, citing OpenAI's October 2025 disclosure.) What end-user-surface design does in response to this scale of high-stakes interaction is, both clinically and doctrinally, the question this layer answers.

Technical issues at this layer

Layer 6 engineering practice includes:

• UX safety nudges. Inline reminders that the chatbot is not human; soft interruptions when distress signals are detected; explicit transitions to crisis-resources content under triggering conditions.
• Minor-protection product flags and age-gate efficacy. Products marketed as accessible (or in fact accessed) by minors face design choices about how aggressively to verify age, how to communicate risk to minor users, and what defaults to apply when minor-user status is established. The efficacy of age-gates that depend on user-attestation rather than verifiable identity is widely understood to be limited; Psychiatric Times reports that "Character.AI responded by banning minors from using open-ended chats with their product in November 2025" — a deployment-side product change with direct end-user-surface implications. (Source: same Psychiatric Times URL, citing Associated Press October 29, 2025.)
• Crisis-resource surfacing UX. Where the deployed product detects distress signals, the choice of how to surface crisis resources (988 in the U.S., international equivalents) is a UX-design decision: timing, prominence, visual design, content of the message, whether the conversation continues. The presence and effectiveness of these surfaces is a recurring focus of plaintiffs' allegations.
• Companion-character UX patterns. Where the deployed product offers persistent character relationships (Character.AI as paradigm), the UX design of relationship-deepening, romantic-attachment, and continuous-conversation features becomes a documentary artifact in subsequent litigation. The UX patterns themselves — not the underlying model behavior — are increasingly drafted as the alleged defect.
• AI sycophancy as UX-emergent pattern. Psychiatric Times observes the phenomenon directly: chatbots demonstrate "the tendency towards indiscriminately reinforcing a user's ideas (AI sycophancy)", with implications for users with OCD, eating disorders, and other conditions where repeated reinforcement of harmful ideation is clinically counterproductive. (Source: same Psychiatric Times URL.) AI sycophancy is, structurally, an interaction between alignment-training (Layer 2), system-prompt design (Layer 4), and end-user-surface design (Layer 6); the harm is experienced at the surface, but the contributing decisions cross multiple layers.

Legal issues at this layer

The principal doctrinal touchpoints at Layer 6 include:

• §230 boundary at end-user surface. The Communications Decency Act §230 has historically immunized platforms from liability for user-generated content; whether that immunity extends to AI-generated content (where the "platform" itself produces the output) is unsettled. McGuireWoods's analysis of MDL 3047 observes that the court there "limited Section 230's protective reach to third-party content claims, distinguishing them from claims targeting a platform's own design architecture." (Source: same McGuireWoods URL above.) The same distinction applies forcefully to AI: design-architecture claims targeting end-user-surface UX are framed outside the third-party-content immunity §230 was originally built to protect.
• Failure-to-warn at the deploy point. Where an end-user surface delivers AI-generated output without warning users about its non-human, non-clinical, non-counselor character, failure-to-warn doctrine attaches. The McGuireWoods observation that "the learned intermediary doctrine offers no refuge for direct-to-consumer platforms marketed to and used by minors" (quoted at §III.4 above) is most acute at Layer 6, where the absence of intermediary professional judgment is structurally built into the user experience.
• Consumer-protection statute exposure. The Pennsylvania Attorney General's action against Character.AI (discussed at Part I §I.5 and Part IV §IV.3.f) and the Kentucky Attorney General's action filed in early 2026 — both alleging unfair-or-deceptive-practices regarding minor-user safety — concentrate at Layer 6: the consumer-protection statutes apply to the user-facing product as the user encounters it. Psychiatric Times reports the Kentucky AG action with the allegation that Character Technologies engaged in "harmful, explicit, and psychologically manipulative interactions with minors." (Source: same Psychiatric Times URL, citing Kentucky.gov, January 8, 2026.)
• First Amendment protection contested at the surface. Whether AI-generated output reaches a person as protected speech is a question the courts have begun to address — and to address, in the early-litigation period, against the labs. Psychiatric Times observes: "In the initial phase of the trial, a federal judge ruled against Character Technologies' argument that its chatbot's output was protected by the First Amendment or that it constituted 'speech' at all." (Source: same Psychiatric Times URL.) This is the Conway ruling discussed at Part I §I.7 and Part IV §IV.3.b; its operational location is Layer 6 (the speech-or-not-speech question is asked about output as it reaches the user).
• Words-as-murder-weapon precedent applied to AI. Psychiatric Times notes the Commonwealth v Carter (2017) precedent — finding a young woman guilty of involuntary manslaughter based on her encouragement of a friend's suicide — and applies the analogy: "That case set the new precedent that words are not always protected by the First Amendment and could effectively be treated as a murder weapon." (Source: same Psychiatric Times URL.) Whether AI-generated speech can be analogized to Carter is part of the active doctrinal frontier; the analogy is doctrinally consequential because it removes the categorical 1A shield that defendants would otherwise reach for.
• Adjacent-litigation precedent in social-media-design verdicts. Psychiatric Times highlights two recent jury verdicts that arrive on the "platform design as defective product" theory and turn substantially on end-user-surface design choices: Meta and Google found negligent in a Los Angeles social-media-addiction case (March 2026; $6 million awarded); and Meta found liable in a New Mexico Attorney General action (March 2026; $375 million penalty for state-consumer-protection-law violations). (Source: same Psychiatric Times URL, citing New York Times, March 25, 2026, and Reuters, March 24, 2026.) These verdicts are not AI verdicts, but they establish that juries can and will find platform-design choices to be defective in the right factual record. The doctrinal pressure on Layer 6 of AI deployments grows accordingly.

GRAD-INTERN — AI sycophancy as a doctrinally consequential UX pattern

AI sycophancy — the tendency of deployed chatbots to reinforce, rather than challenge, whatever ideas the user brings to the conversation — is a pattern with multiple causes. Pre-training data distribution (Layer 1) establishes baseline tendencies. Alignment-training methodology (Layer 2) can either reinforce or correct sycophantic tendencies depending on what behaviors are preferred during training. System-prompt design (Layer 4) can amplify or dampen the pattern at deploy time. UX patterns (Layer 6) determine whether sycophantic outputs are interrupted, qualified, or surfaced as-is. The pattern is layer-spanning, but its harm is end-user-surface harm. For a user with obsessive-compulsive disorder, an eating disorder, suicidal ideation, or a developing psychotic condition, a chatbot that indiscriminately reinforces ideation rather than questioning or contextualizing it is producing harm at the layer the user sees. Psychiatric Times's framing — that future chatbot-related claims may include cases where "chatbot use caused or exacerbated other mental disorders such as obsessive-compulsive disorder or eating disorders, given the tendency towards indiscriminately reinforcing a user's ideas (AI sycophancy)" — names a future-litigation theory that does not yet have a named bellwether case but is within plausible doctrinal reach. (Source: same Psychiatric Times URL.) For the abstracted product-liability attorney working in this space, AI sycophancy is a candidate doctrinal frontier worth tracking: it implicates layer-spanning evidence (alignment training, system prompts, UX choices) and is amenable to expert-witness characterization across forensic psychiatry, AI engineering, and product-design disciplines. Forensic-psychiatry expert testimony in this space will, Psychiatric Times predicts, evaluate "symptoms, reach diagnoses, opine about damages, and potentially attempt to evaluate causation" — with the further qualification that "in the absence of robust research on the impact of chatbot use on psychological functioning across the lifespan, the [causation function] may prove more challenging." (Source: same Psychiatric Times URL.)

§III.7 Layer 7 — Cross-Cutting Operations

What this layer is, in plain language

The cross-cutting operations layer is not a single technical layer in the way Layers 1-6 are. It is the set of organizational functions that operate across the technical stack: Trust & Safety teams that monitor deployed-product behavior and respond to incidents; post-deployment monitoring teams whose telemetry analysis flags emerging problems; policy-and-communications teams whose public-facing statements about safety practice are documentary artifacts; and legal-and-compliance teams whose regulatory engagement and discovery-preparation work touches everything else.

People who work at this layer include T&S operations staff, post-deployment monitoring engineers and data scientists, public-policy and government-relations professionals, communications and external-affairs staff, regulatory-affairs liaisons, in-house counsel and compliance professionals, and the cross-functional program-management functions that connect all of these to the technical teams of Layers 1-6.

Why this layer matters for harm output

Layer 7 is the layer where the labs' institutional posture with respect to harm-output prevention, regulatory compliance, transparency, and incident response is implemented. The Layer-1-through-Layer-6 technical practices described above are necessary but not sufficient; without Layer 7's cross-functional coordination, technical safeguards fail to compose into deployable safety practice. Every published safety-policy framework (Anthropic's RSP and Frontier Compliance Framework; OpenAI's Preparedness Framework; analogous publications across labs) lives at this layer; every transparency report, every compliance attestation, every incident disclosure is produced here.

For harm-output litigation, Layer 7 is the layer where the documentary record of the lab's conduct accumulates. Whether a lab knew of a foreseeable-harm pattern; when it knew; what it did; what it did not do; how those decisions were reviewed; what counsel was consulted — these are Layer 7 records. The discovery surface in subsequent litigation is concentrated here.

Technical issues at this layer

Layer 7 practice includes:

• Trust & Safety operations. Cross-functional teams that respond to harm-output reports, content-moderation escalations, abuse patterns, and active incidents. Internal taxonomies for incident classification; response-playbook development; policy-loop feedback into Layer 4 (system prompts) and Layer 2 (alignment-training).
• Post-deployment monitoring. Telemetry-driven detection of emerging harm patterns in deployed-product behavior; cross-functional analysis pipelines that connect telemetry signals to safety-policy decisions.
• Policy and communications. Public-facing safety-policy publications; transparency reports; system cards (formal documentation released alongside model deployments); public-comment positions on regulatory developments.
• Legal and compliance. Regulatory engagement (FTC; state Attorneys General; EU AI Office; state-level regulators in jurisdictions where they exist); compliance attestations under SB 53 and analogous statutes; whistleblower-protection systems; discovery-readiness work.
• Cross-functional program management. Coordination between research (Layers 1-2), engineering (Layers 3-4), infrastructure (Layer 5), product (Layer 6), and the operational teams enumerated above.

Legal issues at this layer

The doctrinal touchpoints at Layer 7 are concentrated and consequential:

• Statutory transparency obligations. California's SB 53 (Transparency in Frontier AI Act), effective January 1, 2026, "establishes the nation's first frontier AI safety and transparency requirements for catastrophic risks." (Source: Anthropic, "Sharing our compliance framework for California's Transparency in Frontier AI Act," December 19, 2025, https://www.anthropic.com/news/compliance-framework-SB53 T2.) Anthropic, in announcing its compliance framework, frames the statute's effect as durability-supplying for previously-voluntary commitments: "By formalizing achievable transparency practices that responsible labs already voluntarily follow, the law ensures these commitments can't be abandoned quietly later once models get more capable, or as competition intensifies." (Source: same SB53 framework URL.) Layer 7 is the operational location where SB 53 obligations are met (or not met).
• Frontier Compliance Frameworks as documentary artifacts. Anthropic's Frontier Compliance Framework (FCF) — the SB 53 compliance document — describes, in the lab's own words, "how we assess and mitigate cyber offense, chemical, biological, radiological, and nuclear threats, as well as the risks of AI sabotage and loss of control, for our frontier models. The framework also lays out our tiered system for evaluating model capabilities against these risk categories and explains our approach to mitigations. It also covers how we protect model weights and respond to safety incidents." (Source: same SB53 framework URL.) These published frameworks are admissible-as-public-statement evidence in subsequent litigation; the labs that publish them have made commitments that bind them in standard-of-care analysis. The structural relationship the lab itself describes — "the FCF will serve as our compliance framework for SB 53 and other regulatory requirements. The RSP will remain our voluntary safety policy" — also matters: it draws a distinction between regulatory compliance and self-imposed best-practice that subsequent litigation will probe. (Source: same SB53 framework URL.)
• Frontier Safety Roadmap as evolving institutional commitment. Anthropic's Frontier Safety Roadmap documents specific goals with target dates and an archive of completed-or-modified prior goals. As an example of the cadence, the lab's data-retention-principles goal as of February 2026 committed to "complete an internal in-depth analysis of key factors and set new Frontier Safety Roadmap goals based on it," with a subsequent April 2026 update setting a target date of "May 11, 2026, [to] publish a new goal related to this or announce that we aren't doing so." (Source: Anthropic, "Previous goals" archive of the Frontier Safety Roadmap, https://www.anthropic.com/responsible-scaling-policy/updates T2.) The lab publishes both its current goals and the archive of completed-or-modified prior goals. This is unusually documentary for an AI safety operation; it creates a temporal record of institutional commitment that subsequent litigation will reach.
• Whistleblower protection as discovery-affecting structure. Anthropic's federal-framework proposal includes the principle: "It should be an explicit violation of law for a lab to lie about compliance with its framework or punish employees who raise concerns about violations." (Source: same SB53 framework URL.) SB 53 itself includes whistleblower protections. Whistleblower-protection regimes affect what internal information can flow to plaintiffs and regulators in subsequent matters — strengthening discovery surface and changing settlement-leverage calculations.
• Cross-functional coordination with legal counsel — the Q14 frontier. The fourteenth research question this site addresses asks which AI-ecosystem departments most-and-least regularly interact with legal counsel and what the documented friction or coordination gaps are. Our R1 research substrate is sparse on this specific question. Anthropic's transparency-related publications discuss safety practice and compliance posture but do not, in materials we have surfaced, document the frequency or texture of internal cross-functional engagement with in-house legal counsel. Psychiatric Times's forensic-psychiatry-perspective piece touches the question obliquely (in the framing that "AI companies are spending fortunes in a successful effort to avoid government regulation", which suggests legally-defensive rather than legally-collaborative cross-functional coordination at industry level) but does not produce per-lab specifics. (Source: same Psychiatric Times URL.) We treat Q14 as explicitly UNANSWERED at R1 and as a follow-on harvest candidate. Per the methodology established at companion file Layer 1's grad-intern callout: research-gap acknowledgment is part of the methodology; the deliverable is more useful when it identifies what we did not find than when it pretends otherwise.

GRAD-INTERN — The lab transparency framework as both substantive safety practice and litigation-relevant documentary record

The labs' published safety frameworks (Anthropic's RSP and FCF; OpenAI's Preparedness Framework; analogous documents across labs) function as three things simultaneously, as discussed at companion file §III.3.d. At Layer 7, the third function — evidentiary positioning for subsequent litigation — is operationally specific: when a regulator (FTC; state AG; EU AI Office) or a private plaintiff later asks what the lab committed to and what it did, the published frameworks are the public record. SB 53's effect, in the lab's own framing, is to formalize this dynamic at statutory level: voluntary commitments that the lab might otherwise have rolled back or qualified are now legal obligations whose modification is regulated by statute. Anthropic, in proposing a federal framework, has further articulated principles that would extend this dynamic nationally — including "Requiring a public secure development framework", "Publishing system cards at deployment", "Protecting whistleblowers", and "Flexible transparency standards" that "can adapt as consensus best practices emerge." (Source: same SB53 framework URL.) For the abstracted product-liability attorney working in this space, the practical consequence is that Layer 7 produces an unusually rich documentary trail that is publicly accessible: lab safety-policy publications, RSP versions and updates, compliance-framework publications, transparency reports, system cards. The substantive safety practice is private (and reaches discovery only under protective order); the documentary record of what the lab said it would do is public. Standard-of-care analysis turns substantially on the gap (or alignment) between the two. The Q14 research-gap noted above is, in this light, a research-gap about the substantive safety practice that is private; the documentary-record analysis is well-founded on what the labs have published, and that analysis carries doctrinal weight on its own.

Part III (Layers 4-7) closing forward-pointer

Layers 4-7 have walked the downstream and operational portion of the AI ecosystem. Where Layers 1-3 (companion file) established how the foundation models are produced, Layers 4-7 examined how those models are deployed (Layer 4), how the deployed products run in production (Layer 5), how AI-generated output reaches the person experiencing harm (Layer 6), and how the labs' organizational functions cut across the entire stack (Layer 7).

Several layer-spanning patterns surface across the seven Layers, and these patterns recur in Parts V-VIII of this site:

• The architecture-as-defect framing identified at Layer 4 (KL Gates) is a Parts V/VI cross-cut: it describes how plaintiffs are litigating the deployed product in current matters and how labs are responding (Part V) and where the most-fruitful surfaces for product-liability attorneys sit (Part VI).
• The component-part-manufacturer doctrine surfaced at Layer 5 (Conway in Garcia) connects to Part IV §IV.3.a (product liability) and to Part VI §VI.3 (most-fruitful surfaces for product-liability attorneys).
• The end-user-surface UX patterns (AI sycophancy; crisis-resource surfacing; minor-protection design) at Layer 6 are evidence categories whose doctrinal weight is developed in Part IV §§IV.3.a and IV.3.e.
• The lab transparency framework (RSP, FCF, system cards, transparency reports) at Layer 7 is the per-lab subject of Part V (lab and platform responses) and the doctrinal substrate of Part IV §§IV.4 (statutory frame) and IV.5 (NIST AI RMF).
• The Q14 cross-functional coordination question identified as UNANSWERED at Layer 7 is the explicit subject of Part VII (coordination gaps), where the research-gap is treated transparently per the methodology established at companion file Layer 1.

Part V (lab and platform responses) takes up next: Anthropic's posture; OpenAI's posture; Character.AI's posture (as deployer with a paradigm-defendant role); the cross-lab convergence and divergence patterns; and a comparison table.