Deploying Chatbots, don’t overlook the legal risks

Artificial intelligence is everywhere. Businesses are deploying chatbots to answer customer queries, process requests, draft communications and reduce costs. The attraction is obvious. The legal risk is less so.

Much of the commentary around AI focuses on the idea that the law is struggling to keep pace with technology. Whilst there is some truth in that, businesses should be careful not to mistake legal uncertainty for legal immunity.

The reality is that if your chatbot gets something wrong, a court is unlikely to throw up its hands and say, “the law hasn’t caught up yet.” Instead, it will reach for familiar legal principles and apply them to a new set of facts.

In other words, whilst AI disputes are an emerging area of law, they are likely to be resolved using well-established legal concepts such as negligence, negligent misstatement, misrepresentation and breach of contract. Courts have long recognised that liability can arise where inaccurate information causes foreseeable loss. A chatbot may be novel, but the legal questions are not. The Court is still likely to ask was the information accurate? Was it reasonable to rely upon it? Did the business take reasonable care? Did loss result?

Your Chatbot Is Not Your Scapegoat

Moffatt v. Air Canada (2024 BCCRT 149) is one of the first high-profile cases involving chatbot liability. A customer relied on information provided by Air Canada’s chatbot about bereavement fares. The information was wrong. When the customer sought compensation, Air Canada argued, in effect, that the chatbot was responsible for its own actions. The tribunal was having none of it, describing the argument as “remarkable” and holding that the chatbot was simply part of Air Canada’s website. Air Canada was therefore responsible for what it said.

The significance of Moffatt is not that it created new law. It didn’t. The significance is that it confirmed that Courts are likely to approach AI disputes by applying existing legal principles to new technology. The Tribunal focused on whether Air Canada had taken reasonable care to ensure the information provided to customers was accurate, not on the technical workings of the AI system.

Although Moffatt is a Canadian decision and not binding in England and Wales, it reflects how an English court would likely approach a similar dispute.

This is where things get interesting. While the core legal principles are well established. What remains uncertain is how they will be applied in increasingly complex AI environments. For example:

• What level of oversight is “reasonable” for a generative AI chatbot?
• How frequently should outputs be tested and audited?
• Who bears responsibility where a third-party AI supplier is involved?
• What warnings or disclaimers will be effective?
• At what point does a failure to supervise AI become negligent?

These questions are still being worked through. That is why AI litigation remains an emerging area of law. Not because Courts lack legal tools, but because they are only beginning to apply those tools to rapidly evolving technology.

Regulation Is Moving in the Same Direction

The Courts are not the only ones taking this approach. The regulatory landscape is evolving too, and the direction of travel mirrors the approach seen in Moffatt. The Online Safety Act 2023 has introduced a framework for regulating online harms, and Ofcom has made it clear that certain AI chatbots and generative AI services may fall within the scope of the online safety regime depending on how they operate and how users interact with them. AI-generated content is not treated as existing in a regulatory vacuum simply because it was produced by a machine. The focus is not on whether the chatbot itself should be blamed. The focus is on the organisation deploying it, the risks it creates, and the safeguards put in place to manage those risks.

In June 2026, Ofcom confirmed it was carrying out research into AI chatbots and online safety risks, while the Crime and Policing Act 2026 introduced powers that could bring AI services more squarely within the Online Safety Act regime in the future. The government is required to report on progress towards any such regulations by 31 December 2026.

Practical tips

For businesses, the message is straightforward:

• Whether the issue is inaccurate or misleading chatbot response, harmful AI-generated content, or a failure to supervise an automated system properly, the question will be: what did the business do to identify, monitor and mitigate the risk?
• Do not assume you can innovate first and worry about governance later.
• Continue to monitor legal and regulatory developments carefully. The rules are still developing, but the expectation of responsible oversight is already firmly established.

The businesses best placed to navigate this developing area will be those that:

• maintain human oversight;
• regularly test chatbot outputs;
• keep source information up to date;
• implement clear escalation procedures; and
• put appropriate contractual protections in place with AI providers.

Final Thoughts

The real uncertainty isn’t whether the law applies to AI. It’s how Courts and Regulators will answer the difficult questions around oversight, testing, accountability and governance as these technologies continue to evolve.

Whether you’re deploying AI tools, reviewing governance frameworks, managing risk, or responding to a dispute arising from AI-generated content, now is the time to ensure the appropriate safeguards are in place. So, by all means experiment with AI. Innovate. Automate. But don’t leave your business exposed, if you require assistance, please contact Sadiea Mustafa-Awan in our Dispute Resolution & Litigation team, at sadiea.mustafa-awan@fsp-law.com.