Your chatbot is not a third party: what OLG Hamm and Moffatt mean for the agent on your website

Published October 14, 2026 · Last reviewed October 14, 2026

Chatbot liability is the question of who answers for what an automated assistant tells a customer, and two decisions now point the same way: the business that put it on its website. In February 2024 a British Columbia tribunal ordered Air Canada to pay a passenger C$812.02 after its chatbot gave him a refund rule that did not exist, and called the airline’s argument that the bot was a separate legal entity “a remarkable submission.”¹² On 12 May 2026 the Higher Regional Court (OLG) of Hamm, applying German unfair-competition law, held that a company’s chatbot, which gave its doctors specialist titles they do not hold, was “not a third party” (our translation), so the company itself had misled consumers.³ The court’s database lists that judgment as final.⁴ Neither case involved an attack: in both, a bot answered an ordinary question with something untrue about the business. That makes chatbot liability, in practice, a knowledge problem with four controls a business can publish. Here is how the two cases map onto them.

This piece is legal information, not legal advice, and it covers what a website agent tells customers, not harm from companion chatbots. If your agent operates in a regulated profession, talk to a lawyer in your jurisdiction.

Two decisions, one direction: the bot speaks for the business

Moffatt v. Air Canada, 2024 BCCRT 149. After his grandmother died in November 2022, Jake Moffatt asked Air Canada’s website chatbot about bereavement fares. It told him he could book at full price and claim the reduced rate within 90 days of the ticket being issued.² The airline’s own bereavement page said the opposite: the reduced fare could not be claimed for travel already completed.⁵ Air Canada refused him, and argued it could not be held responsible for information from its agents, servants or representatives, including the chatbot. The tribunal read that as treating the chatbot as a separate legal entity and rejected it: the bot was part of Air Canada’s website, and Air Canada is responsible for everything on its website. It found the airline had not taken reasonable care to make the chatbot accurate, and asked why a customer should have to check one part of a website against another.¹ The award was C$650.88 in damages for negligent misrepresentation, C$36.14 in interest and C$125 in tribunal fees.²

OLG Hamm, 12 May 2026, 4 UKl 3/25. The second case was an injunction action brought by a consumer association, not a customer. Verbraucherzentrale NRW sued Aesthetify GmbH, whose two managing directors are doctors known as “Dr. Rick” and “Dr. Nick.” Asked about them, the company’s website chatbot called them specialists in plastic and aesthetic surgery, in aesthetic medicine and in aesthetic treatments. The first title exists, but they do not hold it; the other two do not exist at all.⁴⁶ German law sends this kind of consumer-association action straight to a Higher Regional Court as the court of first instance, so the judgment is not an appeal ruling.³

The company argued the bot’s answers were not its own business conduct. The court disagreed on each point. The answers were a misleading commercial practice about a trader’s qualifications under § 5 (1) and (2) no. 3 of the Act against Unfair Competition (UWG). The company was responsible even if it had built the bot only from correct data. And the chatbot was not a third party, so the softer duty-of-care test that German law applies to other people’s content did not fit; the court added that the company would have been liable under that test too.³⁶

The reasoning is worth reading for anyone who runs a site agent. A question about the doctors’ qualifications was obvious, so the court found it reasonable to make sure, before the bot first went live, that it would not answer falsely. The IT contractor that set the bot up did not move the responsibility: its conduct was attributed to the company. After the warning letter the company switched the bot off, had it reworked with a prompt instruction and a keyword filter, and switched it back on; the court read that easy fix as proof the company controlled what the bot said. And it rejected the argument that consumers know chatbots make mistakes and check their answers. Many, it said, trust a computer’s answer more, because machines are seen as less error-prone than people.³

Three cautions. The remedy was an injunction, backed by a fine of up to €250,000 per breach, not damages. The court admitted an appeal to the Federal Court of Justice because of the case’s fundamental importance, yet both the court’s database and the consumer association list the judgment as final, and we found no Federal Court file number: it is one Higher Regional Court’s judgment, with no ruling from the top court behind it.³⁴ And it left one question open on purpose: whether answers provoked by leading questions would be treated differently. The questions in this case were neither leading nor suggestive.³ Writing in June, DLA Piper’s AI team called the two cases “emerging signs that judges will not treat chatbot statements as different from static content.”⁷

Wrong facts, not attacks

Neither bot was tricked, as far as the decisions show. In Moffatt a customer asked an ordinary question and got a refund rule that appeared nowhere in the airline’s policy. In Hamm the court noted the questions were plain ones, and held the company responsible even if the bot had been built from correct data.

A third example, outside any court, repeats the pattern. In April 2025 a Cursor user who kept getting logged out when switching machines emailed support and got an answer from “Sam,” which said single-device use was an expected security policy. There was no such policy, and Sam was an AI support bot. Users threatened to cancel, Cursor apologized and refunded affected users, and co-founder Michael Truell called it an incorrect response from a front-line AI support bot.⁸⁹

Policy, credential, policy. Each is a fact the business owns, and in each case the bot did not answer from one approved version of it. So the useful question for an operator is narrower than how to stop hallucination in general. It is: which facts is our agent likely to be asked about, and where does the one approved version of each live?

The German case matters most to services firms, which sell on trust facts: who the experts are, what they are qualified to do, how many cases they have handled. A prospect uses those facts to decide whether to book, and the Hamm court treated a question about them as foreseeable. If your agent is going to say “our certified advisers,” that sentence has to come from a source someone signed off, not from a model’s sense of what a firm like yours usually says.

Disclosure is a separate duty from accuracy

A common reflex after reading about these cases is to add a banner: “You are chatting with an AI assistant. Answers may contain errors.” Telling people they are talking to a machine is often required. It is a different duty from being responsible for what the machine says, and the Hamm court went out of its way to reject the idea that users discount a chatbot’s answers.

In the EU, since 2 August 2026, Article 50 of the AI Act requires a system that talks to people to tell them it is an AI,¹⁰ and the Commission’s July guidelines explain how; we decoded them in what your AI agent must disclose under Article 50. That duty says nothing about whether the content is true. The Hamm bot could have announced itself as an AI in every message and the titles would still have been false.

US states are writing the same separation into law. Utah’s consumer-protection code has said since May 2025 that it is not a defense that generative AI made the violating statement.¹¹ California’s AB 316, enacted in 2025, stops a defendant from arguing that an AI system autonomously caused the harm, while still letting it argue causation, foreseeability and comparative fault.⁷ New York’s draft S7263-A would make an operator liable when it knowingly lets its chatbot pose as a licensed professional such as a doctor, engineer or lawyer, require a clear notice that the user is talking to an AI, and state that the notice does not waive that liability. It is a bill, not law: the Senate lists it as committed to the Rules Committee on 5 June 2026.¹²

A disclaimer helps with the first row. The other two depend on what the agent knows and what it is allowed to say.

Four controls, mapped to the two failures

If both failures were wrong facts, the controls are about knowledge: what the agent may say, where each fact lives, and what happens when it does not know. DLA Piper’s advice after Hamm is to test consumer-facing chatbots, monitor them in production and audit them regularly.⁷ The Hamm court expected that work before launch, not after a warning letter. The four controls below are what you would be testing against.

1. A facts registry with a source page for every number. One file, or one section of your knowledge base, that holds every price, deadline, policy window, qualification and success figure your agent may state, each linked to the public page it comes from. When the policy changes, you change one line. Moffatt is the case for this control: Air Canada had the correct bereavement rule on its own site, but the bot was not answering from it, and the tribunal saw no reason the customer should have cross-checked. A registry turns the truth is somewhere on the site into one line the agent quotes, or it says nothing.

2. A boundaries file: what the agent never says. A short, plain list of claims the agent must not make, whatever the visitor asks. The worked example we know best is public. Relovisa, an immigration consultancy that shares a founder with Tobira, publishes its assistant’s boundaries at relovisa.co/agent/boundaries.md. Its rules cover guaranteed outcomes, acting as a licensed lawyer, invented facts, sensitive documents in chat, and acting on a booking or sharing contact details only with explicit human authorization.¹³ A Hamm-style failure needs one more line: never state a qualification that is not in the registry.

3. Qualify and route instead of advising. When the agent cannot answer from approved facts, the better answer is a route, not a guess: ask the few questions that tell you what the visitor needs, then offer a call, a booking or a page. In regulated professions this is also the line between helping someone find a professional and practicing the profession through a bot, which is exactly what New York’s draft targets.

4. Handoff with context, and a record. When the agent routes, the person who picks up should get what was asked and what was answered. That serves the customer, and it gives you the record that testing, monitoring and audits depend on. A transcript you never read is not a control.

None of this makes an operator immune: Hamm held the company responsible even if the bot had been built on correct data. What the controls change is how often the bot says something false, and what you can show afterwards: the facts you published, the limits you set, the record of what happened. Whether that risk can be insured is a separate question, covered in insuring AI agents.

When the visitor is someone else’s AI agent

Both cases involved a human typing into a chat window. A business website in 2026 also gets a second kind of visitor: an AI assistant asking on behalf of a person, which then passes the answer on. If a buyer’s assistant asks your agent about refunds and your agent invents a window, the buyer hears it secondhand, in their assistant’s words, and may never see your page.

Neither decision turned on who was asking. Both turned on whose statement it was. That is our reading, not a holding, but it points one way: what your agent tells a visiting AI can be treated as a statement your business made, with no disclaimer in view, because there may be no page in view.

So the four controls have to cover both doors. A separate, looser knowledge set for machine visitors recreates the Moffatt problem: two versions of the truth, and the visitor gets whichever one the bot reached first. One registry and one boundaries file, used for people and for their AI agents alike, removes it. The difference between a site agents can only read and one they can ask is laid out in agent-readable vs agent-addressable; this is the liability side of the addressable half.

This is also where the product we build sits. Tobira Site Agent answers people, and the AI agents that come on their behalf, from the owner’s materials. Its product page says that when the agent does not know, it “offers a call instead of making things up,” and that setup includes your rules and what the agent must never promise (as listed on tobira.ai/agentic-site/, read 14 October 2026).¹⁴ Those are settings the operator fills in, not a guarantee about what any agent will say: the facts and the limits still have to be written, approved, tested and kept current by someone in your business. Our agent-washing test includes an accountable check, a named operator and a path to a person, that works for any site agent, ours included.

What to remember

• A Canadian tribunal (Moffatt v. Air Canada, February 2024) and a German Higher Regional Court (OLG Hamm, 12 May 2026, listed as final) both refused to treat a website chatbot as someone other than the business running it.
• Both cases turned on false facts, not attacks: a refund window in one, specialist titles in the other. Cursor’s support bot did the same with a login policy in April 2025.
• Disclosure and accuracy are separate duties. The Hamm court rejected the idea that users discount chatbot answers, and Utah’s consumer code says it is no defense that generative AI made the statement.
• The Hamm court expected the risk to be handled before launch. The controls are about knowledge: a facts registry with source pages, a boundaries file, qualify-and-route, and a handoff with a record, for people and visiting AI agents alike.

If a visitor asked your agent about your refund window tonight, which page would it answer from?

FAQ

Is a business liable for what its chatbot says?

In the two decisions covered here, yes. A British Columbia tribunal held Air Canada liable for negligent misrepresentation by its website chatbot in 2024, and the Higher Regional Court of Hamm held a German company responsible for its chatbot’s false claims about its doctors’ qualifications in May 2026; the court’s database lists that judgment as final. Rules differ by country.¹³

What did OLG Hamm decide about chatbots?

On 12 May 2026 (4 UKl 3/25) the court held that a website chatbot which gave a company’s doctors specialist titles they do not hold was not a third party. Its answers were the company’s own misleading commercial practice under the German Act against Unfair Competition, even if the bot had been built from correct data, and the court granted an injunction. It admitted an appeal to the Federal Court of Justice, but the judgment is listed as final.³⁴

Does an “AI may make mistakes” disclaimer protect me?

Not on the evidence here. A notice that users are talking to an AI meets disclosure duties such as Article 50 of the EU AI Act, which are separate from accuracy. The Hamm court rejected the argument that consumers know chatbots err and check their answers, and Utah’s consumer-protection code says it is not a defense that generative AI made the statement.³¹¹

How do I reduce chatbot liability on my website?

Control what the agent knows and may say: a facts registry with a source page for every price, policy and qualification; a boundaries file of claims it never makes; qualify-and-route instead of advice in licensed fields; and a handoff with context and a record. Test the agent before launch and monitor it in production, as the Hamm court’s reasoning and DLA Piper’s advice both suggest. This reduces the risk; it does not remove it.⁷

Does any of this change if the visitor is an AI agent rather than a person?

The two decisions involved people, and neither turned on who was asking. Our reading, not a holding, is that what your agent tells a visiting AI assistant can be treated as your business’s statement, passed on to a person who sees no disclaimer. Use the same approved facts and limits for both.

Does the new EU Product Liability Directive cover chatbot mistakes like these?

Mostly not. The directive, which EU countries must transpose by 9 December 2026, treats software including AI systems as a product, but it compensates death, personal injury, property damage and destroyed or corrupted data, and it does not cover companies as victims. A wrong fare or a false credential falls under misrepresentation and unfair-competition law, as in Moffatt and Hamm.¹⁵

Sources