mythsthe wider recordMoffatt v. Air Canada2024aviation

everyone assumed:

a chatbot's answer isn't a company promise

what was actually true:

A chatbot speaks for the company that deploys it.

how it happened

  1. whocustomerasked about bereavement fares
  2. the gapwebsite chatbotinvented a refund policy
  3. the resulttribunal rulingairline liable for the bot
the gap that let it happen the result

what everyone assumed

A chatbot feels like a helper bolted onto the site, a convenience that points to the real answers rather than being one. The assumption, when it fails, is that a company is not bound by whatever its bot happens to say.

what happened

The airline argued in a tribunal that the chatbot was, in effect, a separate entity responsible for its own statements. The tribunal disagreed, holding that the company was responsible for all information on its website, the bot’s words included, and that the customer had reasonably relied on them.

step by step

  1. the website chatbot answers a fare questionThe customer relies on what it says.
  2. the airline refuses to honour the answerIt argues the chatbot is a separate entity responsible for its own words.the assumption breaks here
  3. February 2024the tribunal rules for the customerThe company is responsible for everything on its website, bot included. Damages for negligent misrepresentation.

how it surfaced

In February 2024 the British Columbia Civil Resolution Tribunal ruled against Air Canada in Moffatt v. Air Canada, awarding damages for negligent misrepresentation. It was an early ruling holding a company liable for its AI chatbot’s output.

A chatbot speaks for the company that deploys it.

Its confident wrong answer is the company’s confident wrong answer, with the company’s liability attached.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayYour website has a friendly chatbot that answers questions about pricing, refunds and terms.
the gap nobody seesNobody set limits on what it may promise, and nobody reads its answers.AI output nobody checks
  1. in this story
    the day it mattersIt tells a customer they qualify for a refund your policy does not offer, and the customer saves the chat.
    what it costs youA court or regulator treats the bot's words as yours, and you pay what it promised.
  2. or it goes like this
    howA bot is talked into mocking your company and the chat is shared.
    what leavesyour reputation, in screenshotswho ends up with ita million strangers in a day
    it happenedDPD chatbot, 2024
  3. or it goes like this
    howAI-drafted work cites sources that do not exist.
    what leavescredibility and, in court, sanctionswho ends up with itthe judge and the other side
    it happenedMata v. Avianca, 2023

sources

  1. Moffatt v. Air Canada, 2024 BCCRT 149

← all myths

your turn

what you can do about it

  1. this week

    Read what your customer-facing bot is allowed to promise, and who signed off on it.

    If you have put an AI assistant in front of customers, it is making statements in your name right now, some of them wrong with total confidence. Air Canada is the precedent that those statements are yours. What your bot can say, and whether anyone has bounded it, is a question with a legal edge.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.