AI risk #75/99: Your business answers for what its AI chatbot tells customers

If your website or app has an AI assistant, it is probably answering questions about prices, delivery and refunds right now. Most businesses added one for a sales or service reason: customers get answers faster, and the team handles more enquiries without growing.

This year, lawyers in the UK and judges in Germany have looked at who is responsible when that assistant gets something wrong. Both came back to the business that put it there.

What the UK taskforce said

In July, the UK Jurisdiction Taskforce published its final statement on liability for harm caused by AI under English law, written by a team of specialist technology barristers after a public consultation. Its main conclusion is that English law doesn't need a separate regime for AI, because existing rules on contracts, negligence and misleading statements already apply.

Two points in it matter for anyone running a customer-facing assistant. An AI system is not a legal person, so the tool itself can't be held responsible, and the question is always which person or business is. And the statement treats liability as likely where a business presents its chatbot as speaking on its behalf, which is how most website assistants are set up.

The statement isn't binding, and no English court has ruled on a chatbot yet. It was written to show courts and businesses how existing law applies, and it suggests that blaming the tool won't get a business very far.

A German court has already ruled

In May, the Higher Regional Court in Hamm ruled on a beauty clinic's website chatbot. The bot told visitors that the clinic's two managing directors were specialists in aesthetic medicine. Neither held that qualification. The clinic argued that the AI ran largely on its own.

The court found that the chatbot was part of the clinic's business rather than a third party, and that its answers were the clinic's own conduct. A large part of its reasoning was that the clinic could instruct the bot through its prompt and filter what it said. When the clinic later changed those instructions, the bot stopped calling the directors specialists.

The ruling isn't final. The court gave leave to appeal to Germany's Federal Court of Justice because of how much the question matters. Until that court decides, it shows how one European court has treated a chatbot's answers.

Where the risk sits in the plan

Adding an assistant is usually a good decision. It answers out of hours and gives people more time for the conversations that need them. The UK statement even points to the opposite risk for professionals, who could be liable for not using AI where a competent peer would have. So the answer is to give the assistant the same oversight as anyone else who speaks for the business.

The AI risks are in what it's allowed to say. It might quote a discount you then have to honour, or promise a refund your policy doesn't allow. It might also say something about safety or suitability that a member of staff would have known to leave alone. Those costs show up against the objective the assistant was meant to help, as lost revenue or lost trust, so that's where they belong on the risk register.

What to add to the risk register

An owner. One named person responsible for what the assistant tells customers, in the same way someone owns the price list and the terms on the website.

A hand-off list. The topics the assistant passes to a person instead of answering, such as prices outside the published list, refunds and exceptions, eligibility, and anything that reads as advice. These are the guardrails in practice.

A monthly review. A sample of real conversations checked by that owner, the way a new team member's calls would be reviewed, with a note of what was wrong and what changed.

In the German case, the fix was a change to the bot's instructions. A regular review is a simple way to spot changes like that early.

The AI Disruption Index starts from your objectives, including the sales and service goals a customer assistant was brought in for, and scores the AI risks against each one, with a safeguard drafted for every risk. It's free and takes about ten minutes, and you can look at a sample report before running your own.