When Your AI Agent Talks to Customers, You Own What It Says
A legal question that seemed theoretical has been settled in three jurisdictions, in the same direction: the agent's words are the company's words. Most of the failures that create that liability aren't detectable as bad text — which is why output filters miss them.
On this page
Customer-facing agents are among the fastest-growing kinds of AI in production — voice agents handling calls, chat agents resolving tickets, assistants quoting terms and processing requests. They're also where a legal question that once seemed theoretical has been settled, in three jurisdictions, in the same direction.
You own what your agent says.
How it got settled
In 2024, the British Columbia Civil Resolution Tribunal held Air Canada liable after its chatbot told a customer about a bereavement-fare policy that didn't exist. The airline argued, in effect, that the chatbot was responsible for its own statements. The tribunal rejected that.
In May 2026, the Higher Regional Court of Hamm went further. It held that a website chatbot is legally part of the business organisation, and that its invented statements are attributed to the operator — even where the system had been carefully configured. Careful configuration was not a defence.
Weeks later, the Munich Regional Court barred Google from publishing false AI Overviews, treating the AI-generated output as the publisher's own new statement rather than reproduced third-party content.
The direction is consistent. The agent's words are the company's words.
What actually goes wrong
The failures that create liability in customer-facing agents are predictable, which is the good news.
Fabricated policy. The agent states a refund rule, coverage term or eligibility condition that doesn't exist — usually because retrieval returned nothing authoritative and the model filled the gap with something plausible. In April 2025, a developer-tools company's support agent told users about a one-device-per-subscription policy that didn't exist, and cancellations followed before a founder corrected it publicly. The reported root cause: nothing sat between the agent and the customer to catch the fabrication before it shipped.
Commitments the business didn't authorise. A dealership's chatbot was manipulated into agreeing to sell a vehicle for one dollar. The words were polite and well-formed. The commitment was the problem.
Data crossing a boundary. Personal information surfacing where it shouldn't — including one customer's details appearing in another customer's conversation.
Instruction leakage. Agents induced to reveal their own system instructions, exposing internal routing and escalation logic.
Notice that most of these aren't detectable as bad text. A fabricated policy reads exactly like a real one. That's why output filters miss them.
Why this is a revenue problem, not just a legal one
If you build customer-facing agents and sell them to banks, insurers or lenders, your customer is the regulated party — and, under the rulings above, they own what your agent says to their customers.
So their risk committee will ask how your agent is controlled. What stops it inventing a policy? What stops it committing to terms it shouldn't? Can you show, afterwards, what it said and why?
Those questions are often the longest part of the sales cycle. A vendor who can answer them with evidence — a record of each consequential statement judged against the customer's own policies before it went out — shortens that cycle and wins accounts a competitor can't. For the agent builder, governance is a revenue lever.
What has to sit between the agent and the customer
Judgment against the customer's real policies. The refund rules, coverage terms and eligibility criteria that actually exist — retrieved at the moment of judgment, so a policy change takes effect immediately. A fabricated policy fails this check precisely because it doesn't match what's written.
Evaluation of commitments, not just words. Whether the agent was permitted to make this commitment, to this customer, under these conditions.
Inline protection for data. Personal data detected and redacted on the request path, before it reaches the model or another customer.
A record of what was said and why. The artifact that answers the risk committee — and that exists whether or not anything went wrong.
Where we stand
Syntrox evaluates each consequential agent action — including what an agent commits to a customer — against the organisation's own policy corpus before it executes, names the rule it applied, and redacts sensitive data inline. It runs inside the organisation's own environment, so conversation data never leaves it.
What it doesn't do: it doesn't make anyone compliant, and it doesn't yet correct an agent's response — redirecting the agent to a safe answer instead of blocking it is on the roadmap, built with design partners. Today it judges, blocks, escalates and records.
The courts have answered the liability question. What's left is whether you can show, for any given statement your agent made, that you checked it first.