Can my company be sued for what an AI agent says? The answer is yes almost everywhere, and the doctrine that gets you there differs by jurisdiction.

A customer asks a company's AI agent a question, gets a wrong or misleading answer, relies on it, and suffers a loss. The operator's first instinct is often that the chatbot said it, not the company. No jurisdiction examined in this guide accepts that argument. This is a plain, comparative answer to whether a business can be sued for what its AI agent says, drawn from real case law and statute across the United States, Canada, the United Kingdom, the European Union, and Australia, for operators who need the global picture rather than a single-jurisdiction deep dive.

The short global answer

Strip away the jurisdictional detail and the answer is consistent: yes, a business can be sued for what its AI agent tells a customer, and in the jurisdictions surveyed here, it typically will be found liable if the statement was false, the customer reasonably relied on it, and the reliance caused a loss. The AI agent is not a legal person. It cannot be sued in its own right, cannot hold assets, and cannot be a defendant separate from the business that deployed it. Every claim, in every jurisdiction, is ultimately a claim against the operator.

What differs across jurisdictions is not the outcome so much as the legal label attached to it, the specific elements a claimant must prove, and the statutory backdrop that shapes how the claim is framed. Understanding those differences matters for operators managing risk across borders, because the evidence that defeats a claim in one jurisdiction is not always the evidence that defeats an equivalent claim in another.

The doctrine underneath every jurisdiction: agency

Every legal system surveyed here starts from the same foundational principle, even where it is not always named explicitly: an agent, human or automated, that acts within the scope of authority a business has given it binds that business to the consequences of its acts. This is centuries older than AI. A shop assistant who misquotes a price, a call centre operator who gives wrong information, a printed brochure with an error, all bind the business under the same underlying agency logic. An AI agent deployed by a business to interact with customers is, in every material legal respect examined here, treated the same way.

This is why the "the chatbot said it, not us" defence fails consistently. It is not a novel AI-specific rule that defeats this argument. It is the oldest rule in commercial law, applied to a new kind of agent.

The reference case: Moffatt v Air Canada

The single most cited case in this area, and the reference point every jurisdiction's analysis eventually returns to, is Moffatt v Air Canada, decided by the British Columbia Civil Resolution Tribunal on 14 February 2024. Air Canada's customer service chatbot told a customer that bereavement fare refunds could be claimed retroactively after travel. That was incorrect. When the customer sought the refund, Air Canada argued it could not be held responsible because the chatbot was, in the airline's framing, a separate legal entity responsible for its own actions.

Tribunal member Christopher Rivers rejected this argument directly, finding it unclear why a business would suggest that its own chatbot is a separate legal entity capable of being responsible for its own representations. The tribunal held Air Canada liable for the chatbot's misrepresentation on ordinary negligent misrepresentation principles, and the disclaimer accompanying the chatbot, which stated that information might not be accurate, did not change the outcome. The damages awarded were modest, CAD 812.02 plus fees, but the precedent has become the anchor point for AI agent liability analysis across common law jurisdictions and beyond. A fuller treatment of the case and its practical lessons for smaller operators is available at insureyouragent.com.

United States: consumer protection layered on negligence and professional responsibility

US liability for AI agent statements runs through several overlapping channels rather than a single federal AI liability statute, since no such statute exists as of 2026. State consumer protection statutes, most modelled on the Federal Trade Commission Act's prohibition on unfair or deceptive acts or practices, apply to false or misleading statements made by a business's AI agent in the same way they apply to any other business communication. Negligent misrepresentation and, in commercial contexts, breach of warranty claims provide additional routes.

A distinct thread running through the US case law is professional responsibility exposure where AI-generated content enters a regulated professional context. In Mata v Avianca, decided by the US District Court for the Southern District of New York in 2023, attorneys who used ChatGPT to draft a legal filing containing fabricated case citations were sanctioned by the court, with Judge P. Kevin Castel imposing a USD 5,000 fine. The court's reasoning was that the professional standard of care applicable to the attorneys did not lower because AI was involved in producing the content. That principle generalises beyond legal practice: any US professional or business relying on AI-generated output for client-facing work carries the underlying professional responsibility exposure regardless of the tool used to produce it.

Colorado's SB 24-205, the Colorado AI Act, adds a state-specific layer for high-risk AI systems, requiring developers and deployers to use reasonable care to protect consumers from algorithmic discrimination, with the Colorado Attorney General empowered to enforce violations. Operators deploying consumer-facing AI agents in Colorado should treat this as an additional compliance layer on top of the general negligence and consumer protection exposure that applies nationally.

United Kingdom: the Consumer Rights Act and misrepresentation

The United Kingdom has no AI-specific liability statute, having opted for a sectoral regulator approach through the AI Regulation White Paper of 2023 rather than horizontal legislation. AI agent statement liability in the UK runs primarily through the Consumer Rights Act 2015, which implies terms about the quality, fitness, and description of goods and services into consumer contracts, and general misrepresentation law, which allows a claimant to recover loss caused by reliance on a false statement of fact made before a contract was formed.

A UK business whose AI agent makes a false statement that induces a customer to enter a contract, or that breaches an implied term about the service being provided, faces liability on largely the same footing as if a human representative had made the same statement. Sectoral regulators including the Financial Conduct Authority, for financial services AI use, and the Competition and Markets Authority, for broader consumer protection enforcement, add regulatory exposure on top of the private law claim a customer could bring individually.

European Union: moving toward AI-specific liability architecture

The European Union is the jurisdiction furthest along in building AI-specific liability infrastructure on top of the general agency and misrepresentation principles that already applied. Article 26 of Regulation (EU) 2024/1689, the EU AI Act, imposes direct deployer obligations on businesses using high-risk AI systems, including maintaining human oversight and monitoring operation for risks, obligations that a claimant or regulator can point to when arguing a deployer failed to meet its statutory duty of care.

Separately, the revised Product Liability Directive, Directive 2024/2853, applies from December 2026 and explicitly brings AI software within the definition of a product for strict liability purposes, meaning a claimant will in some circumstances no longer need to prove fault at all, only that the AI system was defective and caused harm. This is a materially different liability standard from the negligence-based approaches that dominate elsewhere in this comparison, and EU-facing operators should treat it as a distinct compliance track. For the full mechanics, see the double exposure analysis on agentliability.eu and the Article 26 deployer obligations guide.

Australia: misleading or deceptive conduct

Australia addresses AI agent statement liability primarily through section 18 of the Australian Consumer Law, which prohibits conduct in trade or commerce that is misleading or deceptive or likely to mislead or deceive. This is a strict provision in the sense that intent is not required, only that the conduct, viewed objectively, was likely to mislead a reasonable person in the audience it was directed at. An AI agent that gives a customer an incorrect price, an incorrect product description, or a false representation about a service falls squarely within conduct section 18 was designed to capture, regardless of whether a human or an AI system produced the statement.

The Australian Competition and Consumer Commission enforces section 18 and has signalled active interest in AI-driven conduct as automated systems become more prevalent in consumer-facing roles. Australia has not adopted a horizontal AI statute comparable to the EU AI Act, relying instead on the existing Australian Consumer Law framework alongside a voluntary AI Safety Standard, which functions as a governance benchmark rather than a binding liability rule.

A comparative table

What operators should do regardless of jurisdiction

Four practices reduce exposure consistently across every jurisdiction surveyed here, because they address the underlying fact pattern that produces liability rather than any one country's specific procedural rule. First, do not rely on a generic disclaimer as a substitute for accuracy. Disclaimers have not reliably protected operators in the cases and statutes examined, and specific, prominent warnings at the point a consequential statement is made carry more weight than boilerplate footer text.

Second, implement human review for consequential outputs, meaning any AI agent statement that could reasonably induce a customer to act, spend money, or forgo a right. This is both a risk reduction measure and, in the EU specifically, a direct requirement under Article 26.

Third, log AI agent outputs and maintain the ability to reconstruct what a customer was actually told. Several of the doctrines surveyed here turn on what was said and what a reasonable customer understood, and an operator without records is at a structural disadvantage defending any of these claims.

Fourth, treat documented governance as evidence, not paperwork. A structured governance record, of the kind produced by an assessment against the Agent Certified framework, is directly relevant to a negligence or duty-of-care defence in every common law jurisdiction surveyed, because it demonstrates the operator took reasonable care, which is precisely the question several of these doctrines turn on.

For the deeper mechanics of how liability allocates between a foundation model provider and the deploying business specifically, see who pays: foundation model versus deployer, and for the procedural question of which court hears a cross-border claim, see cross-border AI agent liability and conflict of laws, both on this site.

Frequently asked questions