Corporate legal liability for ungoverned decisions made by AI agents

"What happens legally when an AI agent makes a bad decision on the company's behalf" sounds like a novel question, but the emerging answer is mostly a familiar one: the company is on the hook, the same as it would be for a human employee or a printed policy document. The clearest precedent for this is a small-dollar Canadian tribunal case that's become the reference point for the whole issue.

The precedent: Moffatt v. Air Canada

In late 2022, Jake Moffatt asked Air Canada's website chatbot about bereavement fares after a family death. The chatbot told him he could book a full-fare ticket and claim the bereavement discount retroactively — which was wrong; Air Canada's actual policy required the discount to be requested before travel. When Moffatt tried to claim it afterward, Air Canada refused, and the case went to the British Columbia Civil Resolution Tribunal.

Air Canada's defense was, in effect, an ungoverned-agent argument: it claimed the chatbot was "a separate legal entity that is responsible for its own actions." The tribunal rejected this outright in February 2024, finding Air Canada liable for negligent misrepresentation and ordering it to pay damages. The tribunal's reasoning was blunt: a company is responsible for all information it puts in front of customers, whether that information comes from a static web page, a human agent, or an automated system. This is now the standard reference point cited across legal commentary on AI agent liability, because it's a clean, decided case rather than a hypothetical.

Why this isn't really a new legal problem

Legal analysts tracking agentic AI liability generally frame it through existing doctrine rather than treating it as legally novel. Under ordinary vicarious liability principles, an organization can be responsible for an AI agent's actions similarly to how an employer is responsible for an employee acting within the scope of their role — the AI doesn't need to be a "person" for the company to own the consequences of deploying it. Legal commentators tracking this space note that jurisdictions are increasingly converging on a "reasonable oversight" standard: the deploying organization is liable for an agent's bad decision unless it can demonstrate it had genuine monitoring, auditing, and safety controls in place — not just a policy document saying it should.

Some jurisdictions are also moving to close any residual ambiguity by statute rather than relying purely on case law. California has enacted a law that specifically bars defendants from arguing that an AI system's autonomous operation is itself a defense against liability. Colorado's AI Act, effective June 2026, goes further procedurally: it requires deployers of high-risk AI systems to conduct regular impact assessments and maintain active risk-management programs — turning "we didn't have adequate oversight" from a liability argument into a compliance violation in its own right.

What this means for governance in practice

The practical takeaway from Air Canada isn't "don't use AI agents" — it's that deploying one doesn't change who's accountable for its output. Treat an AI agent's customer-facing statements and decisions the same way you'd treat statements from a human employee: they need to be accurate, the company needs a way to catch and correct mistakes quickly, and "the system said something wrong" needs to trigger the same kind of remediation a human error would, not get treated as a technical curiosity outside the company's responsibility.