In November 2022, after the death of a grandmother in Ontario, Jake Moffatt opened the chat window on Air Canada's website to ask about bereavement fares. The chatbot replied that the airline offered reduced fares in those circumstances and that a ticket could be submitted for the reduced rate within 90 days of the date it was issued, so Moffatt booked last-minute flights costing $1,630.36 and applied afterward, only to learn that the airline's written policy did not apply to requests made after travel was completed.
When the dispute reached the British Columbia Civil Resolution Tribunal, Air Canada argued, in the tribunal's words, that the chatbot was "a separate legal entity that is responsible for its own actions." Tribunal member Christopher C. Rivers called that "a remarkable submission," ruled for Moffatt in a decision issued February 14, 2024, and in doing so wrote the clearest rule a small business owner installing an AI chatbot on a website is likely to read.
The short version for anyone running a site: the bot is your business talking. Whatever it promises about refunds, prices, shipping or warranties carries the same weight as a sentence on your policy page, so the work is to make it accurate, keep it inside what you offer and send everything else to a human.
What the Air Canada Decision Held
The reasoning in Moffatt v. Air Canada, 2024 BCCRT 149, is short enough to quote at length, and the key paragraph reads less like a technology ruling than a reminder of ordinary responsibility.
"While a chatbot has an interactive component, it is still just a part of Air Canada's website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot."
Rivers found that "Air Canada did not take reasonable care to ensure its chatbot was accurate," and he rejected the idea that customers should have to double-check information found in one part of a website against another part. The airline was ordered to pay $650.88 in damages, $36.14 in pre-judgment interest and $125 in tribunal fees, a total of $812.02.
The sum was small, and a decision from a Canadian small-claims body does not bind any American court. Its value for site owners lies in how plainly it describes a principle that consumer protection law in the United States already applies to every other kind of business statement.
Regulators Have Said There Is No AI Exemption
On September 25, 2024, the Federal Trade Commission announced Operation AI Comply, a law enforcement sweep against companies that used artificial intelligence to boost deceptive or unfair conduct.
"The FTC's enforcement actions make clear that there is no AI exemption from the laws on the books," said Lina Khan, who chaired the commission at the time.
One of the companies named in that sweep, DoNotPay, accepted a final order in February 2025 that required it to pay $193,000 in monetary relief and barred it from advertising that its service performs like a real lawyer. In September 2025 the commission went further, issuing orders to seven companies, including Alphabet, Meta, OpenAI and Snap, seeking information on how they measure and monitor the effects of consumer chatbots on children and teens.
None of those cases involved a florist or a plumbing contractor, but together they show where the federal line sits. A claim made by software on your behalf is still your claim, and an assistant that overstates what your product does creates the same exposure as an exaggerated headline on your home page.
State Disclosure Rules Are Arriving One Statute at a Time
Several states now regulate chatbot disclosure, meaning whether a business must tell visitors they are talking to a machine. Utah's amended law, in effect since May 7, 2025, requires a supplier using generative AI in a consumer transaction to disclose that fact when the person makes a clear and unambiguous request, and it requires regulated occupations to disclose AI use prominently at the start of a high-risk interaction, in writing before a written exchange begins.
Maine moved in 2025 with a broader rule. Under Title 10, section 1500-DD, a business may not use an AI chatbot in trade with a consumer "in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human being" unless the consumer is notified in a clear and conspicuous manner, and a violation counts under the state's Unfair Trade Practices Act.
California's Senate Bill 243, signed on October 13, 2025 and effective January 1, 2026, targets companion chatbots rather than customer service tools, requiring notifications and reminders to minors that the bot is AI-generated. For a typical small business site the practical takeaway across all three states is the same: label the assistant as AI in its first message, in every state, and the patchwork stops mattering.
What Happens When the Bot Improvises
Public failures follow a recognizable pattern. In March 2024, The Markup reported that New York City's MyCity business chatbot told reporters that employers could take a cut of their workers' tips and that restaurants could go cash-free, both contrary to city law, and in January 2026 a spokesperson for Mayor Zohran Mamdani confirmed the new administration planned to take the bot down.
In April 2025, after a support exchange at the AI code editor Cursor went wrong in public, cofounder Michael Truell posted an apology on Hacker News that began, "Apologies - something very clearly went wrong here." He explained that the company used "AI-assisted responses as the first filter for email support" and that "any AI responses used for email support are now clearly labeled as such."
Each failure began the same way, with a model asked a question its source material did not answer and filling the gap with something that sounded like policy. For a small business the riskiest prompts are the ones customers care about most, such as whether a discount can be applied retroactively, whether a deposit is refundable and whether a repair is covered.
How Many Small Businesses Are Exposed
Adoption is still uneven. The Census Bureau's Business Trends and Outlook Survey, collected between December 14, 2025 and May 3, 2026, found that 19.8 percent of firms nationally reported using AI, with 37 percent of firms with at least 250 employees doing so compared with less than 20 percent of firms with four or fewer employees.
That gap is also an opening. The smallest operators are the most likely to install a chatbot plugin in an afternoon without a compliance team, and the least able to absorb a refund dispute, so the setup choices below matter more for a five-person shop than for a national brand.
Setting Up an Assistant That Knows Its Limits
Write the policy pages before you connect the bot
An assistant can only be as accurate as the pages it reads. Publish plain, dated pages for refunds, shipping, cancellations, warranties and service areas first, because those pages become both the bot's source material and your evidence of what the business promised. The same discipline that helps public AI systems cite your site correctly applies to the assistant you host yourself.
Restrict answers to your own content
Vendors handle grounding differently, so read the settings rather than the marketing page. Tidio says its Lyro agent answers using solely the data you provide and redirects the question to a human agent when it cannot find an answer. Intercom's documentation describes Fin drawing on a variety of public and private knowledge sources, which makes it worth confirming which sources are switched on before launch. Restricting what the bot reads is the companion to controlling what outside crawlers can take, and both decisions belong in the same afternoon.
Route money questions to a person
Configure human handoff rules so that any message mentioning refunds, discounts, deposits, contracts, legal terms or complaints goes to a human or to a form that promises a reply within a stated time. Intercom states that Fin will always hand off automatically when that is the safest option for the customer, and every serious platform offers some version of that control.
Disclose, log and test
Open every conversation with a sentence that identifies the assistant as AI and offers a way to reach a person. Keep transcripts for at least as long as your refund window, review them weekly, and before launch spend an hour trying to make the bot promise something you do not offer, asking it for a discount, a refund outside policy and a guarantee you have never given. Any answer that would cost money if a customer screenshotted it is a setting to change before the first real visitor arrives.
