Air Canada was ordered to compensate a customer after its chatbot gave incorrect information about the airline’s bereavement fare policy. As The Guardian reported, the tribunal found that Air Canada was responsible for information provided through its website, including the chatbot. The case became an early warning that customer-facing AI does not just answer questions. It can represent the company, influence decisions, and create liability.
In 2022, a customer named Jake Moffatt contacted Air Canada after the death of his grandmother to ask about bereavement fares. The airline’s chatbot reportedly told him he could book a flight and then apply for a bereavement fare refund within 90 days. He followed that guidance.
Air Canada later refused the refund, pointing to its actual policy, which said bereavement fares could not be applied retroactively after travel had already happened. The customer took the case to British Columbia’s Civil Resolution Tribunal and won.
According to Business Insider, Air Canada argued that it should not be held responsible for the chatbot’s actions. The tribunal rejected that argument, with the adjudicator calling the idea that the chatbot was a separate legal entity “a remarkable submission.” The ruling ordered Air Canada to compensate the customer for the fare difference, plus interest and fees.
For customers, the issue was simple: the company’s own digital assistant gave instructions, and a person relied on them. For businesses, the lesson is a little sharper: when AI is on your website, it is not just “chat.” It is part of your operating model.
This case matters because it moved AI risk out of the theoretical and into the checkout flow. No advanced cyberattack was required. No dramatic model jailbreak. No shadowy hacker hoodie. Just a customer asking a reasonable question and a chatbot giving a confident answer that turned out to be wrong.
That is why the case has become such a useful reference point for enterprise AI governance. Customer-facing AI systems represent the organization. They answer policy questions, shape expectations, influence buying decisions, and may guide people through financial, legal, medical, travel, insurance, or employment-related choices.
When those systems are wrong, the damage is not limited to a bad answer. The business may create liability, lose trust, trigger complaints, confuse employees, and expose gaps between policy, process, and customer experience.
The Air Canada case also shows why “the correct policy was linked elsewhere” is not a strong comfort blanket. Customers do not experience your business as a legal archive. They experience the interface in front of them. If that interface gives authoritative guidance, people will reasonably treat it as authoritative.
This is often described as an AI hallucination story, but the more useful angle is authority. The chatbot did not just invent a fact in a vacuum. It spoke in the context of a trusted brand, inside an official customer-service channel, about a real policy that affected a real financial decision.
That gives the AI operational agency, even if it was not “agentic” in the fully autonomous sense. It represented policy. It influenced action. It shaped the customer’s next step. In practical terms, it became part of the company’s decision environment.
That is where human risk management comes in. People decide which AI tools get deployed, how they are tested, what they are allowed to say, where they should escalate, and how exceptions are handled. People also decide whether customer-service teams are trained to spot AI-generated misinformation, whether policy owners review chatbot content, and whether leaders treat conversational AI as a risk-bearing business channel rather than a shiny FAQ machine.
A chatbot may generate the sentence. The organization owns the system that allowed the sentence to matter.
Any company using customer-facing AI should review where the tool is allowed to provide policy, pricing, refund, eligibility, legal, safety, or account guidance. These are high-trust areas, and vague disclaimers will not fix a badly governed experience.
Customer-facing AI should be grounded in approved knowledge sources, tested against real customer scenarios, and monitored for misleading answers. It should have escalation paths to humans when questions involve exceptions, money, complaints, vulnerability, bereavement, accessibility, safety, or legal rights. Nobody wants to discover their escalation process for grief-related travel policies through litigation. That is an expensive user test.
Organizations should also train the humans around the AI. Customer-service agents, marketing teams, legal teams, policy owners, product managers, and risk leaders need a shared understanding of what the tool can say, where it can fail, and how mistakes get corrected quickly.
This is not about slowing innovation. It is about making sure the company voice does not start improvising policy with the confidence of a man in an airport lounge who has never read the terms and conditions.
The Air Canada chatbot case is a perfect example of why AI governance belongs inside human risk management. The risk was not only technical accuracy. It involved trust, authority, customer behavior, internal accountability, and the culture around deploying automation into sensitive moments.
Traditional cyber awareness programs were not built for this world. Organizations now need employees to understand how AI changes decision-making, customer interaction, data exposure, and operational responsibility. That requires practical training, culture measurement, role-specific guidance, and leadership assurance.
For Cybermaniacs, the lesson is clear: when AI becomes part of how the business talks, advises, sells, supports, and decides, human risk expands. Companies need to know whether their people understand that shift and whether their systems support safe behavior in real work.
AI can be a brilliant service layer. It can also become a very confident intern with a company badge and no manager in sight. The difference is governance, culture, and human oversight.
Air Canada’s chatbot gave a customer incorrect information about claiming a bereavement fare refund after travel. The customer relied on that guidance, was denied the refund, sued through British Columbia’s Civil Resolution Tribunal, and won compensation.
The tribunal found that the chatbot was part of Air Canada’s website and that the company was responsible for ensuring information provided through that channel was accurate.
The case shows that customer-facing AI can create business liability when it gives inaccurate guidance. AI tools that answer policy, pricing, eligibility, or refund questions effectively speak on behalf of the company.
It is not agentic in the same way as an AI tool taking autonomous technical action, but it does show operational agency. The chatbot represented policy, influenced a customer’s financial decision, and acted as an authoritative company interface.
Use approved knowledge sources, test AI responses against real scenarios, monitor conversations, restrict high-risk topics, create clear escalation paths to humans, and train teams to manage AI as a business-risk channel.