In February 2024, Air Canada's chatbot invented a refund policy. It told a grieving passenger he could buy a full-price ticket and claim a bereavement discount retroactively within 90 days. That policy didn't exist. The airline refused the refund, and a tribunal ruled against them — holding that the chatbot's hallucinated promise was legally binding. The damages were small, roughly $800. The precedent was enormous.
The ruling in Moffatt v. Air Canada established something that should keep every executive deploying AI chatbots awake at night: your AI is not a software tool. It's a digital employee. And when it makes a promise — even one it fabricated from statistical patterns — your company has to honor it. We've spent months analyzing why this happened, what architectural failures made it inevitable, and what enterprises need to build instead. The answer isn't better prompts. It's a fundamentally different approach we call Deterministic Action Layers — hybrid systems that let AI be conversational without letting it improvise on contracts, pricing, or policy.
The Ruling That Killed the "Black Box" Defense
Air Canada tried something remarkable in its defense. The airline argued that its chatbot should be treated as a separate legal entity — responsible for its own mistakes. The correct refund policy, they pointed out, existed on their static website. The chatbot just got it wrong.
The tribunal dismissed this almost contemptuously. Member Christopher Rivers ruled that "Air Canada could not separate itself from the AI chatbot." To a customer, there's no meaningful difference between a webpage, a human agent, and a bot. They're all the company speaking.
Three principles emerged from that ruling that now define enterprise AI liability:
Unified liability. A company is responsible for all information on its digital properties — whether it's static HTML or dynamically generated by a neural network.
Duty of care. Deploying an unverified probabilistic model for policy communication is negligence. Hallucinations aren't glitches. They're negligent misrepresentation.
No black box defense. The internal complexity of the AI doesn't matter. If the bot promises a discount, the company pays.
If your AI says it, your company has signed it.
Under agency law, if a customer reasonably believes the chatbot has authority to speak for the company, the company is bound by what it says. That's the same legal framework that governs human employees. The difference is that a human employee doesn't invent a refund policy because the words "bereavement" and "refund" appeared near each other in their training.
Why the Smartest AI Still Can't Follow Policy
To understand why the Air Canada incident will keep happening, you need to understand what large language models actually do. They don't "know" your refund policy. They predict the next most likely word in a sequence based on patterns in their training data.
When the chatbot told a grieving customer about a 90-day refund window, it wasn't reading Air Canada's tariff rules. It was completing a sentence. Across the millions of documents it had ingested, "bereavement" appears near "special consideration" and "refund." So it constructed something that sounded authoritative and compassionate. It was fluent. It was also completely wrong.
This isn't a bug that a software update will fix. It's how the technology fundamentally works. Even frontier models from OpenAI and Google retain baseline hallucination rates — ranging from 0.7% for highly optimized models to over 25% for less sophisticated ones. In a creative writing context, a 1% error rate is a quirk. If your bank's AI assistant handles a million queries a month, that 1% means 10,000 potential regulatory violations.
A 1% hallucination rate sounds small until you multiply it by a million customer conversations a month.
The financial scale of this problem is staggering. Global losses attributed to AI hallucinations reached $67.4 billion in 2024. And enterprises are spending roughly $14,200 per employee per year just on hallucination mitigation — people manually double-checking work that AI was supposed to handle autonomously. We explore the full scope of this liability landscape in our interactive analysis.
RAG Won't Save You
Many technology consultancies pitch Retrieval-Augmented Generation — RAG — as the solution. The idea is straightforward: instead of relying on the model's training data, you retrieve the correct document from your own database and feed it to the AI alongside the customer's question. The AI reads the policy, then answers correctly.
Except that's almost certainly what Air Canada's chatbot was already doing. The bot actually provided a link to the correct policy page. It had access to the right document. It still summarized it wrong.
This is the critical failure that most RAG implementations ignore. Giving the AI the right information doesn't guarantee it will follow that information. If the retrieved text is complex, if the legal language is dense, or if the model's pre-trained patterns conflict with the retrieved context, the AI may ignore what it just "read" and default to what its training data suggests sounds right.
Think of it like handing a new employee the policy manual and assuming they'll follow it perfectly under pressure. The manual is necessary, but it's not sufficient. You also need rules they can't override.
Vector search — the retrieval mechanism behind most RAG systems — adds another layer of risk. A query about "refunds" might pull up a document about "refund processing times" instead of "refund eligibility criteria." The words are semantically similar, but the distinction is the difference between a valid claim and a rejected one.
RAG gives your AI knowledge. It doesn't give it obedience.
What We Build Instead: Deterministic Action Layers
Our approach starts from a simple premise: a single AI model should never handle both conversation and compliance. The chatbot can be creative when discussing your brand, suggesting products, or making small talk. But the moment a customer asks about refunds, pricing, warranties, or legal terms, creativity becomes fabrication.
We call the architecture that enforces this separation a Deterministic Action Layer — a middleware system that sits between the customer and the AI model, acting as a traffic controller for risk.
When a customer types "Can I get a refund for my grandmother's funeral flight?", a standard chatbot sends that straight to the language model and hopes for the best. In our architecture, a semantic router intercepts the message first. It converts the query into a mathematical representation and compares it against known high-risk categories. If the query matches a sensitive intent — refund, pricing, legal terms, data privacy — it never reaches the language model's creative engine at all.
Instead, the system triggers a rule-based module. Hard-coded logic checks the ticket status against the actual policy database. If the ticket has been used, the answer is no. The AI's only job is to deliver that answer in a polite sentence. It doesn't interpret. It doesn't improvise. It translates a database result into human language.
For the Air Canada scenario, the output difference is stark. A probabilistic wrapper says: "Sure, just submit the form within 90 days." Our system says: "Our policy strictly prohibits refunds after travel has commenced. Reference: Tariff Rule 45."
One creates liability. The other eliminates it.
The Silence Protocol
The most counterintuitive — and most important — design principle in our architecture is what we call the Silence Protocol. When a customer asks about a compliance-critical topic, we don't make the AI smarter. We make it quieter.
The generative engine's creative capabilities are effectively silenced. The system switches from "author" mode to "reader" mode. It retrieves the exact policy text and serves it verbatim, or fills a pre-approved template with verified data. No paraphrasing. No helpful elaboration. No creativity.
For compliance topics, the AI's most valuable feature is not what it can say — it's what it's prevented from saying.
And when a customer asks something that falls into a gap — a question where no deterministic rule exists — the system doesn't guess. It says: "I can't answer that directly. Let me connect you with a specialist." This "fail-safe" design prevents the AI from expanding corporate liability into territory the company hasn't mapped.
This mirrors how well-run organizations handle sensitive topics with human employees. A customer service representative doesn't improvise legal terms. They read from the approved script or escalate. We apply the same discipline to AI, except the AI can't decide to go off-script because it's feeling helpful.
This Isn't Just an Airline Problem
The Moffatt ruling hit the travel industry, but the vulnerability exists anywhere a chatbot discusses money, terms, or safety.
Financial services. If an AI assistant misstates an interest rate — pulling from outdated training data that reflects 2021's near-zero rates instead of today's environment — that's a regulatory violation. Our architecture routes rate queries to a real-time API that fetches the current number from the core banking system. The bot never "remembers" an old rate. It fetches the truth every time.
Healthcare. A language model might associate "ibuprofen" and "warfarin" with "commonly prescribed together" because those words appear near each other in training text — missing the critical interaction warning. Our system doesn't let the AI generate drug interaction information. It queries a trusted medical database and wraps the result in a template. If the database flags a severe interaction, the AI cannot contradict it.
Legal services. The "fake case citation" scandal — where lawyers were sanctioned for submitting AI-hallucinated legal precedents — demonstrated the same failure pattern. Our Chain of Verification protocol cross-references every citation against trusted legal databases. If a citation doesn't exist, it's stripped from the output. The system is configured to prefer "I don't have that information" over a fabricated answer.
Retail. Less regulated, but the financial exposure from a bot promising a "free replacement" for a non-warrantied item adds up fast across millions of interactions. Refund eligibility gets determined by code that checks the order date and return policy. The bot reports the outcome. It can't override the math.
The Regulatory Walls Are Closing In
Beyond court rulings, the regulatory landscape has shifted from guidelines to mandates.
The EU AI Act classifies many customer-facing AI systems as high-risk and requires human oversight under Article 14 — systems must be designed so humans can interpret outputs, intervene, and hit the stop button. Deterministic Action Layers provide exactly this mechanism. The compliance officer who writes the policy rules has ultimate control over what the AI can and cannot say.
GDPR Article 22 gives individuals the right not to be subject to purely automated decisions that produce legal effects. Denying a refund qualifies. Neural networks can't easily explain why they generated a specific answer. Deterministic logic can point to the exact rule: "Ticket Status = Used. Policy: No retroactive refunds."
ISO 42001, the first global standard for AI governance, requires organizations to map where probabilistic versus rule-based logic is used, measure hallucination rates, and maintain complete audit trails. Our architecture is built to satisfy these requirements structurally, not as an afterthought.
For the full technical methodology behind our compliance architecture, including implementation blueprints and regulatory mapping, see our detailed research.
"But Isn't This Expensive to Build?"
It's more expensive than wrapping an API call in a chat interface, yes. A semantic router, knowledge graphs, deterministic logic modules, verification loops, and audit logging require real engineering. But this objection mistakes the cost of building for the cost of operating.
The "cheap" approach — a thin wrapper over a foundation model, secured by prompt engineering that politely asks the AI to be accurate — is a liability engine. It's vulnerable to hallucination, prompt injection, model updates that change behavior overnight, and the slow accumulation of binding promises your company never authorized.
The market for hallucination detection tools grew 318% between 2023 and 2025. Enterprises are spending billions trying to verify outputs from systems they could have constrained in the first place. The $14,200 per employee per year in manual verification costs dwarfs the upfront investment in architecture that makes verification unnecessary for high-risk queries.
What About Creative Use Cases?
Nothing in our approach eliminates the value of generative AI. Language models are extraordinary at understanding messy human language, detecting sentiment, suggesting products, writing marketing copy, and handling the thousands of low-stakes interactions that make up the majority of customer service volume.
The entire point of Deterministic Action Layers is separation, not elimination. Let the AI be brilliant at conversation. Let it be empathetic and fluent and creative — for topics where creativity isn't dangerous. But the moment a query touches money, contracts, legal terms, health, or safety, route it through logic that can't hallucinate because it doesn't generate. It executes.
The analogy is straightforward: you wouldn't let a gifted writer with no legal training draft your contracts, no matter how persuasive their prose. You'd let them write the cover letter and hand the contract to a lawyer. We apply the same principle to AI architecture.
What This Means for Your Organization
If you're deploying customer-facing AI today, three questions matter:
Can your chatbot make a promise your company can't keep? If it discusses pricing, refunds, warranties, service terms, or legal rights, the answer is almost certainly yes — unless you've built explicit constraints.
Can you trace exactly why your AI said what it said? If a customer disputes an AI-generated claim, can your team reconstruct the logic path? "The neural network's weights produced this output" is not an answer that satisfies a regulator or a tribunal.
Does your architecture distinguish between conversation and compliance? If the same probabilistic engine handles "What's your return policy?" and "Tell me about your latest products," you've built a system where the AI's most dangerous capability — confident improvisation — is pointed directly at your highest-risk interactions.
The Moffatt ruling wasn't an anomaly. It was the first tremor. As AI moves from chat interfaces to agentic workflows — booking flights, transferring money, signing agreements — the stakes multiply. The companies that thrive in this environment won't be the ones with the most creative AI. They'll be the ones that knew exactly where creativity needed to stop.
If your team is grappling with where to draw that line, we'd welcome the conversation.