Jennifer Scott, in our Corporate & Commercial team, considers the legal risks businesses should address when introducing customer-facing chatbots and other AI-powered tools.
Chatbots are increasingly being used to answer customers’ questions, process requests, recommend products and services, and support internal teams. In many cases, they can help improve response times, provide assistance outside normal working hours and reduce administrative costs. However, convenience and efficiency should not outweigh any legal considerations and risks.
A business will not usually avoid responsibility simply because inaccurate or misleading information was produced by an automated system. Existing rules on contract, negligence, misrepresentation, consumer protection, data protection and intellectual property can all apply. We recommend that businesses adopting chatbots should treat legal compliance as part of the design and deployment process, to avoid claims rather than an issue to address only if something goes wrong.
Who is responsible if a chatbot gets it wrong?
A chatbot may communicate incorrect pricing information, misstate a returns policy, make an unsuitable recommendation or give an inaccurate account of a customer’s rights. Depending on the circumstances, the business deploying it could face a complaint or claim for breach of contract, misrepresentation, negligent misstatement or a breach of consumer law.
The Canadian case of Moffatt v Air Canada, in 2024, provides a useful warning. A customer relied on incorrect information supplied by the airline’s chatbot about fare refunds due to bereavement. The tribunal rejected the suggestion that the chatbot was a separate entity responsible for its own actions and treated it as part of the airline’s website. Although the decision is not binding in England and Wales, it illustrates the likely practical approach: a business remains responsible for the information it chooses to place before customers, whether that information is provided by an employee, a webpage or a chatbot.
Contract and consumer law
Statements made during a chatbot conversation may influence a customer’s decision to enter into a contract. In some cases, those statements could become contractual terms or give rise to liability if they are false or misleading. A disclaimer may help explain the tool’s limitations, but it will not necessarily protect a business where the overall interaction is inaccurate or unfair.
Consumer-facing businesses must also ensure that chatbot content complies with applicable consumer protection requirements. Important qualifications should be clear and prominent, pricing and product descriptions should be accurate, and customers should not be guided by misleading claims or hidden assumptions.
Data protection and confidentiality
Chatbot conversations can involve names, contact details, account information and other personal data. Some users may also enter sensitive or confidential information that the business did not intend to collect. Before launch, organisations should understand what data the chatbot receives, why it is processed, where it is stored, how long it is retained and whether it is shared with the technology provider or transferred overseas.
Privacy information should accurately describe the processing of any data, and users should not be encouraged to provide more information than is necessary. Appropriate security measures, access controls and retention periods will also be required. If the chatbot contributes to decisions that have legal or similarly significant effects on individuals, the rules and safeguards relating to automated decision-making should be considered carefully.
Intellectual property
Businesses should establish whether they have the right to use any material supplied to or generated by the chatbot. This includes training content, product information, internal documents, images and third-party material. Contracts with providers should address ownership and permitted use of inputs and outputs, the use of customer prompts to improve the provider’s models and responsibility for intellectual property claims.
Bias, accessibility and reputation
A chatbot may produce inconsistent or biased responses because of its training data, configuration or the context supplied by a user. This can create legal and reputational risks, particularly where the tool is used in recruitment, access to services or other decision-making. Businesses should test for unfair outcomes, consider accessibility and provide a simple route to human support.
Practical steps before deploying a chatbot:
- Define its purpose and limits. Decide which questions the chatbot may answer and which should be referred to a person.
- Check the chatbot supplier contract. Review warranties, service levels, liability, data use, security, intellectual property and exit arrangements.
- Test before launch. Use realistic and challenging prompts, including questions that are ambiguous or outside the chatbot’s intended scope.
- Use reliable source material. Restrict responses to approved, current information where possible and assign responsibility for keeping it updated.
- Be transparent. Tell users that they are interacting with an automated tool and explain any important limitations without relying on unclear or overbroad disclaimers.
- Provide for human escalation. Make it easy for users to reach an appropriately trained person, particularly for complaints, vulnerable customers or high-risk enquiries.
- Monitor and audit. Review conversations, complaints and unusual outputs, record changes and suspend the tool if a material risk emerges.
- Keep evidence. Retain proportionate records of testing, risk assessments, approvals and monitoring so that the business can demonstrate reasonable care.
Keeping the risks under review
There is no single compliance exercise that will make a chatbot risk-free. The technology, the information available to it and the way customers use it will continue to change over time. Governance should therefore continue after launch, with clear ownership across legal, data protection, information security, customer service and operational teams.
Used carefully, chatbots may deliver real benefits. The key is to recognise that automation does not transfer accountability. Businesses that set appropriate limits, verify outputs and maintain meaningful human oversight will be better placed to innovate while protecting their customers and their reputation.
Our Corporate and Commercial team can advise on supplier contracts, customer terms, data protection, intellectual property and practical governance. Please contact us to discuss how these issues may affect your business.
For further information or legal advice, please contact law@blandy.co.uk or call 0118 951 6800.
This article is intended for the use of clients and other interested parties. The information contained in it is believed to be correct at the date of publication, but it is necessarily of a brief and general nature and should not be relied upon as a substitute for specific professional advice.
