In November 2022, Jake Moffatt’s grandmother died. He went to Air Canada’s website to book a bereavement-fare flight and asked the site’s support chatbot how the discount worked. The bot told him he could apply for the reduced fare within 90 days of the ticket being issued, even after travel. That was false. Air Canada’s actual policy, sitting on a separate page the chatbot didn’t bother to mention, said bereavement fares had to be requested before travel. Moffatt flew, applied for his refund, and got rejected. An Air Canada representative later admitted by email that the bot had given him “misleading words.”
Moffatt took Air Canada to British Columbia’s Civil Resolution Tribunal over roughly $650. What the airline argued in its defence is the part every business running a customer-facing AI tool should read closely.
The Defence That Failed
Air Canada told the tribunal it could not be held responsible for what its own chatbot said. In the tribunal’s words, the airline was effectively arguing “the chatbot is a separate legal entity that is responsible for its own actions.”
“This is a remarkable submission. While a chatbot has an interactive component, it is still just a part of Air Canada’s website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.”
· Tribunal Member Christopher C. Rivers, Moffatt v. Air Canada, 2024 BCCRT 149
The tribunal found Air Canada liable for negligent misrepresentation: it owed Moffatt a duty of care as a service provider, its chatbot made an untrue statement, it hadn’t taken reasonable care to ensure the bot was accurate, and Moffatt reasonably relied on it. Air Canada was ordered to pay $812.02: the fare difference, interest, and tribunal fees.
The dollar amount is trivial. The precedent isn’t. This was a small-claims tribunal, not a binding court ruling, but it’s the clearest statement so far of a principle every regulator and law firm now treats as settled: an AI tool your business deploys is legally part of your business. Not a vendor. Not a separate actor. You.
This Isn’t Just a Chatbot Problem
The same principle applies wherever a company lets an AI system make or influence a decision that affects someone. In 2023, the EEOC settled its first-ever AI hiring discrimination case against iTutorGroup, whose recruiting software was found to automatically reject female applicants aged 55 and older, and male applicants 60 and older, rejecting more than 200 qualified candidates. iTutorGroup paid $365,000.
A larger case is still working through federal court: Mobley v. Workday, a collective action alleging Workday’s screening tools disadvantaged older applicants across the platform’s customer base. In May 2025, a court granted preliminary certification of the collective, and Workday itself has represented that it processed over a billion job applications through the relevant tools. Nothing is decided yet, but the exposure isn’t Workday’s alone. Every company using the tool to screen candidates is a potential co-defendant in claims like this.
The FTC Is Watching What You Claim, Not Just What You Build
Liability doesn’t only follow from an AI tool being wrong. It also follows from overselling what one does. The FTC’s “Operation AI Comply,” running since September 2024, targets exactly this. Its most instructive case for a small business: DoNotPay marketed itself as the “world’s first robot lawyer” without ever testing whether its output matched a licensed attorney’s competence, or having any lawyer review its work. The FTC’s final order in February 2025 fined DoNotPay $193,000 and barred it from claiming its AI could substitute for licensed legal advice without evidence to back it up.
Separately, the FTC banned Rite Aid from using facial recognition technology for five years after finding the retailer deployed AI-based recognition without reasonable safeguards, producing high false-positive rates that led staff to wrongly confront and eject innocent shoppers, with a disproportionate impact on people of colour.
Neither case required a customer to sue. The FTC acted on its own, using existing consumer-protection law, no new AI statute was needed.
Your Insurance Might Not Cover This
The instinct to assume general liability or E&O insurance already covers an AI mistake is, increasingly, wrong. One in five commercial insurers reported an AI-related loss in 2025, and only about half of those losses were fully covered, according to the American Bar Association’s Tort Trial & Insurance Practice Section.
Insurers aren’t staying silent on the gap: they’re actively closing it against you. The Insurance Services Office introduced new exclusion endorsements for 2026 commercial general liability policies that explicitly carve out harm “arising out of generative artificial intelligence,” and major carriers including Chubb, Travelers, and Berkshire Hathaway have already secured regulatory approval to add AI exclusions to general liability, D&O, and E&O policies. Where AI coverage is offered at all, it typically adds 5–15% to premiums. If you haven’t checked your policy language since deploying an AI tool, you likely don’t know which side of that gap you’re on.
What the Law Actually Expects From You
If you sell to EU customers, the EU AI Act treats a business using a third-party AI tool as a “deployer”: a lighter set of obligations than the vendor carries, but real ones: transparency requirements (disclosing that a customer is talking to a bot) and, for high-risk uses like hiring, compliance obligations that begin taking effect through 2026.
In the US, Colorado passed the country’s first comprehensive AI liability law, then substantially rewrote it in May 2026 under SB 189, pushing the effective date to January 2027. Worth knowing if you’re a small business hoping to be exempt: an earlier draft would have carved out companies under 250 employees. That carve-out did not survive into the final law. There is currently no small-business exemption.
Four Things That Would Have Saved Air Canada
Every failure in the Moffatt case is avoidable, and law firms tracking the case have been specific about what would have changed the outcome:
Keep your AI’s answers consistent with your actual policy. The tribunal singled out the fact that Air Canada’s chatbot and its policy page flatly contradicted each other, and that the airline expected a grieving customer to know which one to trust. If your bot and your website disagree, you’ve already lost the argument.
Put your disclaimer where the risk actually is. A buried terms-of-service clause carries little weight once a tool starts giving specific, confident answers about policy, pricing, or legal rights. Legal analysis of the case is explicit: the more authoritative an AI tool sounds, the less a generic disclaimer protects you. A contextual warning at the moment the bot gives that kind of answer holds up far better.
Document that you tested the thing before you shipped it. Air Canada offered no evidence about how its chatbot was trained or tested. Because the legal question is whether you took “reasonable care” to ensure accuracy, having nothing to show is itself the failure.
Get indemnification from your AI vendor in writing. If you’re not building the tool yourself, your contract with whoever did should include AI-specific indemnification and audit rights, not a generic limitation-of-liability clause that quietly cancels out the protection you think you’re getting.
None of this requires a legal department. It requires treating your AI tool the way the tribunal already told Air Canada to: not as a separate, disclaimable entity, but as your business, talking to your customers, on the record.
This is squarely an Architect-stage responsibility. A Pioneer or a Builder can reasonably plead they were moving too fast to formalize every vendor relationship. An Architect cannot, because by this stage the business has enough customers, enough contracts, and enough exposure that an undocumented AI tool is not a shortcut anymore, it is a liability sitting quietly on the balance sheet until a regulator or a customer finds it first.
So here is the real question: if your highest-traffic AI tool got something wrong tomorrow, could you actually produce the paperwork showing you tested it, or would you be finding out what you do not have on record at the same time as your lawyer?