An airline once argued that its chatbot was a separate legal entity, responsible for its own answers. The tribunal called the submission remarkable, and ordered the airline to pay. That case is the clearest statement yet of something every business putting AI on its website should settle first: whatever the AI says, the business said.
This is a practical account of who carries the risk when AI answers a customer, what UK law does with a statement made by software, and what that means for the way an AI integration is actually built. It follows on from whether your business should be using AI yet, which argued that accountability is the thing AI cannot take off your hands. This piece is about what to do with that.
The case that settled the argument
In Moffatt v. Air Canada, decided by British Columbia’s Civil Resolution Tribunal in February 2024, a customer asked an airline’s website chatbot about bereavement fares. The chatbot told him he could apply for the reduced fare retrospectively. A static page elsewhere on the same website said the opposite, and the airline refused the refund.
The airline’s defence is the part worth reading twice:
“In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission. While a chatbot has an interactive component, it is still just a part of Air Canada’s website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.”
The tribunal found the airline “did not take reasonable care to ensure its chatbot was accurate” and awarded damages of $650.88: the difference between what the customer paid and what he should have paid.
This is a Canadian small-claims decision. It binds nobody in the UK, and the sum is trivial. It matters because of how ordinary the reasoning is: the chatbot was part of the website, the website is the business, and the business is answerable for what it says.
What UK law does with the same facts
Two provisions get a UK business to much the same place, and neither needed amending for AI.
A statement can become a term of the contract
Section 50 of the Consumer Rights Act 2015 is blunt about pre-contract statements:
“Every contract to supply a service is to be treated as including as a term of the contract anything that is said or written to the consumer, by or on behalf of the trader, about the trader or the service, if— (a) it is taken into account by the consumer when deciding to enter into the contract, or (b) it is taken into account by the consumer when making any decision about the service after entering into the contract.”
“By or on behalf of the trader” is doing the work there. A chatbot on your website, answering in your name, is not a third party the customer chose to consult. If it tells somebody the job includes waste removal, or that you can be there on Friday, and they book on that basis, the natural reading is that they have been told something about the service by the trader.
And it can be a misleading action
Separately, section 226 of the Digital Markets, Competition and Consumers Act 2024 defines a misleading action as including “the provision of false or misleading information relating to a product, a trader or any other matter relevant to a transactional decision”. It says nothing about who or what provided it. That limb is enforced by the CMA rather than by a disappointed customer, which makes it a different order of problem.
We are not lawyers and this is not legal advice. But the practical planning assumption is not a close call: design as though every answer your AI gives is an answer your business gave in writing.
What that changes about how you build it
The useful question is not whether to use AI. It is what the AI is permitted to state, and what has to happen when it reaches the edge of that.
1. Decide what it may answer, in writing, before it is built
Three categories, agreed with whoever carries the risk: what it answers freely (opening hours, what a service includes, how the process works), what it answers only from approved wording (anything about price, availability, guarantees, insurance or regulatory status), and what it never answers but hands over (anything that amounts to advice, a commitment, or a complaint).
2. Ground it in your own approved content
A general-purpose model answering from its own memory is a liability. One restricted to your published pages, your price list and your policies is a search tool with better manners. When there is no grounded answer, the honest output is “I don’t have that. I’ll pass this to someone who does”, not a plausible paragraph.
3. Make the handover real
The handoff is the part that gets skipped, and it is the whole safety mechanism. A named route, a real person, a logged enquiry, and no dead ends at nine on a Sunday evening. Our post on removals quoting makes the same argument about prices: a number nobody will honour is worse than no number, and it applies with more force when software produced it.
4. Log every conversation, and keep the logs
If a customer says “your website told me”, the transcript is either your defence or your problem, and not having it is not neutral. Logs also happen to be the most useful content research a business can own: a fortnight of real questions tells you what your pages should have said in the first place.
5. Put the human where the cost is
Our AI integrations work is built around approval rules rather than autonomy: AI drafts, classifies and routes; a person signs off anything that commits the business. That is not caution for its own sake. It is placing the check where a mistake is expensive, and removing it where a mistake is cheap to catch.
6. Say that it is AI, and be straight about the data
The ICO’s transparency guidance expects people to be told, in plain language, how their personal data is used in an AI system, at the point of collection, and including whether it will be used to train a model. A chat window collects personal data the moment somebody types their name and their problem into it. That means a privacy notice that mentions the chat, a decision about retention, and a clear-eyed look at where the conversation is actually processed before it is switched on.
7. Try to break it before your customers do
Ask it for a price it should not give. Ask it to promise a date. Ask it something adjacent to regulated advice. Ask the same question six different ways. An afternoon of this before launch is worth more than a month of monitoring afterwards.
Regulated sectors: the bar is higher, not different
If the business is regulated, a chat answer is also a communication under the rules that govern communications. An adviser firm’s chat window sits inside the same regime as the rest of its site, the subject of our post on financial promotions. A dental practice, a law firm or a funeral director has its own equivalents.
The practical effect is that the “never answers” list gets longer and the approved-wording list gets stricter. The architecture does not change. What changes is who signs off the answers, and how often the list is reviewed.
What we would not build
- A chatbot that quotes prices or dates it cannot honour.
- An assistant that answers from the open internet rather than from your approved content.
- A bot that pretends to be a member of staff. Give it a name if you like; do not let it claim to be a person.
- Anything with no transcript. If it talks to customers, it keeps a record.
- Autonomous actions that cannot be undone (bookings confirmed, refunds issued, records amended) without an approval step.
- A deployment nobody owns. Somebody at the business has to be responsible for reading the logs and updating what it is allowed to say.
Sources and method
- Moffatt v. Air Canada, 2024 BCCRT 149: paragraphs 25 to 28 and 40, read from the tribunal’s own published decision.
- Consumer Rights Act 2015, section 50: information about the trader or service to be binding.
- Digital Markets, Competition and Consumers Act 2024, section 226: misleading actions.
- ICO, How do we ensure transparency in AI?
What this post does not do. It is not legal advice. Moffatt v. Air Canada is a Canadian decision with no binding force in the UK, and it is cited for its reasoning rather than as authority here. Whether a particular chatbot statement becomes a contract term, or amounts to a misleading action, depends on facts we cannot assess from a blog post, so take it to a solicitor. This post does not cover employment uses of AI, automated decision-making that produces legal effects, the EU AI Act, or sector-specific regulatory regimes beyond the general point made above. Legislation and guidance change; the linked sources are authoritative and this page is not.
Questions businesses ask us
Does a disclaimer saying “this is an AI assistant, answers may be inaccurate” protect us?
It helps set expectations and you should have one, but do not treat it as a shield. Air Canada’s own website contradicted its chatbot and that did not save it. A statement a customer reasonably relied on is the problem; small print beside it is not obviously a cure.
Is it safer to have no chatbot at all?
Safer, and often worse commercially. The realistic comparison is not chatbot versus perfection. It is a bounded, logged assistant that hands over cleanly versus an enquiry nobody answers until Tuesday.
Can AI give quotes?
It can present a range from your own rate card, with the assumptions shown, and route anything outside that to a person. What it should not do is invent a figure or promise a date it cannot check against a diary.
What about AI summarising enquiries internally?
That is the low-risk, high-value end and where we would usually start. Nothing reaches a customer unread, so a mistake is cheap and correctable.
Who should own this inside a small business?
One named person who reads the transcripts, keeps the “may answer” list current, and has the authority to switch it off. If nobody owns it, it will drift, and the first sign will be a customer quoting it back at you.
How long does a sensible integration take?
Less time than deciding what it is allowed to say, which is the real work and is mostly yours. Scoping that properly is the first conversation, not an afterthought once something is already answering customers.
Thinking about AI, but not about who answers for it?
Tell us what you would point it at first (enquiries, quoting, admin) and we will tell you which part is worth automating, which part needs a person in the loop, and what it should never be allowed to say.