Well, there is the EU Cyber Resilience Act (CRA) which fines manufacturers for security flaws in their products. I assume we cannot apply it here because this happened "in development" and is not about a product. I can imagine similar regulations for AI users though.