The Case That Changed the Rules
In 2024, Air Canada deployed a chatbot to handle customer inquiries. A passenger asked about bereavement fares. The chatbot gave incorrect information. The passenger booked a flight based on that information and was later denied the discount.
Air Canada's legal defense: the chatbot was "a separate legal entity" responsible for its own statements.
The court's response was immediate and unambiguous. A business is responsible for everything its systems say and do. Full stop. Air Canada was ordered to honor the fare and pay damages. The case is now cited in every AI liability framework being drafted in North America and Europe.
15,399 people upvoted coverage of this case. Because it answered a question a lot of businesses had been hoping would stay unanswered.
What Is Coming and When
The EU AI Act is the furthest along. For high-risk AI systems , which includes AI used in hiring, credit, healthcare, and customer service , mandatory auditing, documentation, and human oversight requirements are now law. Enforcement timelines vary by category, with the strictest rules fully active by 2026.
In the US, the picture is patchwork but moving fast. Several states have passed or are passing laws that hold businesses accountable for automated decision-making. Federal legislation is slower but the FTC has made clear it considers deceptive AI outputs to fall under existing consumer protection law.
The Air Canada ruling did not require a new AI-specific law. Existing liability principles were sufficient. That is the signal most businesses are missing: you do not have to wait for AI legislation to face AI liability. You are already exposed under rules that have been on the books for decades.
Three Things to Do Before the Regulation Arrives
Document every AI system that touches customers or decisions. What it does, when it was deployed, what it was trained on, who approved it. This is not bureaucracy , it is the evidence you will need to demonstrate due diligence if something goes wrong. Companies that cannot produce this documentation are in a structurally worse legal position before the first complaint is filed.
Build a human escalation path for every automated decision. Any AI system that makes or influences a significant decision , about a customer, an employee, a financial transaction , needs a clear path to human review. Not a theoretical path. An actual working process that gets used. The courts are not impressed by escalation policies that exist only in documentation.
Test your AI outputs the way you would test a product claim. If a human sales rep said what your chatbot says, would it be defensible? If a human advisor gave that recommendation, would it meet your duty of care? Apply the same standard to the AI. If the answer is "we never checked," check now, before a customer does.
The Thing That Will Not Change
Every legal framework being drafted for AI converges on the same principle: the company deploying the AI is responsible for what it does. Not the model provider. Not the API. The company.
That principle is already in effect under existing law, as Air Canada learned. The upcoming regulations will simply make it explicit, add documentation requirements, and introduce penalties structured to be large enough to matter.
The businesses that are preparing now are not doing it because the law requires it yet. They are doing it because the legal direction is clear, the lead time is short, and the cost of retrofitting accountability into an existing AI deployment is much higher than building it in from the start.