The Chatbot Made a Promise Nobody Signed Off On

Jake Moffatt's grandmother died in 2022, and he went to Air Canada's website to book a flight home for the funeral. He asked the airline's chatbot about the bereavement fare policy. It told him he could book a full-price ticket and apply for the discount retroactively, within 90 days. That is not what Air Canada's actual policy said - bereavement fares had to be requested before travel. Moffatt booked based on what the bot told him, applied afterward as instructed, and was refused.

A promise with no one behind it

When Moffatt took the case to British Columbia's Civil Resolution Tribunal, Air Canada's defense was remarkable: the airline argued it wasn't responsible for what its own chatbot said, because the chatbot was "a separate legal entity responsible for its own actions." The tribunal did not find that persuasive.

The dollar figure is trivial. The precedent isn't: a company is on the hook for whatever its AI tells a customer, whether or not a human ever reviewed, approved, or even knew about that specific answer. Nobody at Air Canada authored "90 days retroactive." The chatbot generated it, and by the time anyone found out, it had already become a binding representation - enforced by a tribunal, not a support ticket.

"The chatbot said it, not us" has never held up anywhere it's been tested.

The gap this exposes

This is undocumented-agent risk in its purest form: an AI system operating inside a business process with the authority to make commitments, and no gate checking those commitments against the actual rulebook before they reach a customer. The chatbot wasn't rogue. It was doing exactly what it was deployed to do - answer questions - with no validation step asking "does this match the real policy" before the answer shipped.

Two years on, treat every AI-generated customer answer as a contract until you've built the gate that makes that untrue.