Failure File™

Air Canada Chatbot: When Your AI Invents Policy

#FailureFiles #AIGovernance #AirCanada #AILiability #ChatbotGovernance #HumanSignal

Listen on The AI Governance Briefing


In November 2022, Jake Moffatt's grandmother died. He went to Air Canada's website and asked the chatbot about bereavement fares. The chatbot told him he could purchase a full-price ticket now and apply for a retroactive bereavement discount within 90 days. He followed those instructions. He spent $1,640 on airfare.

That policy did not exist.

When Moffatt submitted his refund claim, Air Canada denied it. The airline's legal position was extraordinary: it argued the chatbot was a "separate legal entity" responsible for its own information — and that Air Canada could not be held liable for what its own AI system told a grieving customer.

In February 2024, British Columbia's Civil Resolution Tribunal ruled against Air Canada. The tribunal awarded Moffatt $812.02 in damages and court fees. The precedent landed like a verdict on every AI deployment team in every customer-facing organization on earth: you own what your AI says.

Incident Summary

  • Air Canada deployed a customer-facing chatbot to handle airline policy queries, including bereavement fare inquiries
  • In November 2022, the chatbot provided Jake Moffatt with an inaccurate bereavement refund policy — telling him a retroactive discount application was available within 90 days
  • No such retroactive policy existed at the time of the interaction
  • Moffatt purchased full-price tickets based on the chatbot's instruction, then submitted the refund request per those instructions
  • Air Canada denied the refund and argued its chatbot was a separate legal entity not binding on the airline
  • The BC Civil Resolution Tribunal rejected that argument in February 2024, ruling the airline liable for its AI's representations
  • Air Canada was ordered to pay Moffatt $812.02 — less than the cost of the chatbot's hallucination, and far less than the reputational damage of the ruling

The Tribunal's Finding

"Air Canada did not take reasonable care to ensure its chatbot was accurate. It is responsible for all information on its website, whether it comes from a static page or a chatbot." — BC Civil Resolution Tribunal, 2024

What the Chatbot Actually Said

The chatbot's failure was not a minor inaccuracy. It constructed a policy — complete with a specific timeframe (90 days) and a specific mechanism (retroactive application) — that did not exist anywhere in Air Canada's actual fare rules. This is the signature failure mode of large language models deployed without output governance: the system does not know what it does not know. It fills the gap with plausible-sounding language.

That is not a model problem. That is a governance problem. The model did exactly what models do. The failure was the absence of a control layer that prevented the model from making binding policy representations to customers in a context where those representations carry financial and legal weight.

"The chatbot did not malfunction. It performed exactly as an ungoverned AI system performs — it generated a confident, plausible, and completely fabricated answer to a high-stakes customer question." — Dr. Tuboise Floyd

"Air Canada argued its AI was a separate entity. The tribunal said: no. You built it, you deployed it, you own it."

Governance Control Analysis

The Air Canada failure is a compound governance breakdown. It is not a single missing control — it is a stack of absent or insufficient structures across two TAIMScore™ domains that allowed a hallucinated policy to reach a grieving customer, be acted upon, and then be denied in a way that compounded the institutional exposure.

The GOVERN domain failure is foundational: Air Canada deployed an AI system in a customer-service context with no defined accountability structure for what the system could and could not represent. There was no policy bounding the chatbot's scope — no list of topics the system was authorized to make definitive claims about, and no mechanism to flag when a customer query required human confirmation before the AI provided a binding answer.

The MANAGE domain failure is operational: once the chatbot was in production, there was no post-deployment monitoring system capable of detecting when the chatbot was generating policy representations that did not match Air Canada's actual fare rules. The hallucination could have been caught on day one of deployment if any system was watching what the chatbot was telling customers about policy.

Neither of those controls is exotic. Both are baseline requirements under any serious AI governance framework. Their absence in a high-stakes, legally consequential deployment context is a structural failure — not a technology failure.

TAIMScore™ Diagnostic

Scored against the TAIMScore™ framework — GOVERN, MAP, MEASURE, MANAGE — the Air Canada chatbot failure implicates four specific controls:

GOVERN
1.1

Accountability Structure

No defined accountability structure governed what the chatbot was authorized to represent to customers. The system operated without a policy boundary distinguishing informational content from binding representations. When a customer acts on AI output in a high-stakes context, the institution is liable — and Air Canada had no governance structure to prevent that exposure before it materialized.

GOVERN
1.7

Human Review Escalation

No escalation mechanism required human review before the chatbot provided definitive answers to queries involving financial commitments, refund eligibility, or fare policy. A query about bereavement fares following a family death is a high-stakes, emotionally charged interaction — exactly the context GOVERN 1.7 is designed to gate with human confirmation before the system makes binding claims.

MANAGE
1.1

Incident Escalation Path

When Moffatt submitted his refund request, Air Canada's response was denial and a legal argument that the chatbot was a separate entity. No incident response process existed to recognize a chatbot-generated policy claim as a systemic risk event requiring investigation. The denial compounded the institutional exposure. A MANAGE 1.1-compliant response would have flagged this as a chatbot governance incident on day one and authorized a review of what other policy claims the system might have generated.

MANAGE
4.1

Post-Deployment Monitoring

No monitoring system was in place to detect when the chatbot's outputs diverged from Air Canada's published fare policies. Post-deployment monitoring of a customer-facing AI in a policy-sensitive context is not optional — it is the minimum viable governance layer for any system making factual claims about products, services, or entitlements. The hallucination was not a one-time event; it was a symptom of a system operating without output validation.

Structural Lessons

The Air Canada ruling is a watershed moment in AI liability — not because the dollar amount was significant (it wasn't), but because of what the tribunal refused to accept. Air Canada's defense — that the chatbot was a separate entity — was the corporate equivalent of a grocery store arguing it is not responsible for its checkout lanes. You own the system. The system spoke on your behalf. You are liable for what it said.

Every organization that has deployed a customer-facing AI system without a policy boundary — without a defined list of topics the system is authorized to make definitive claims about — is operating under the same liability exposure Air Canada discovered at $812. That number will be higher at your institution. The legal environment is no longer sympathetic to "the AI did it."

"Permitted is not the same as admissible. Air Canada permitted its chatbot to answer bereavement fare questions. The tribunal ruled that answer inadmissible as a defense." — The Trust Gap, Human Signal

The structural lesson is not "don't use chatbots." It is: every AI system operating in a customer-facing, policy-sensitive, or legally consequential context requires a governance layer that defines scope, gates escalation, monitors output against ground truth, and owns the incident response when divergence occurs. Without that layer, the technology is not governed. It is deployed. Those are not the same thing.

The Workflow Thesis applies directly: Air Canada did not fail because its chatbot was a bad model. It failed because the governance structure surrounding the model could not intervene at the moment of execution — when the model was about to make a binding financial representation to a grieving customer with no human in the loop.

The Question Your Institution Must Answer

If your organization has deployed any AI system — chatbot, virtual agent, automated responder, decision-support tool — in a context where the system's output can be reasonably interpreted as an institutional commitment, ask this question before you read another vendor pitch:

What is the accountability structure that governs what our AI is authorized to represent to the people it serves?

If you cannot answer that question in one sentence — with a name, a policy document, and an escalation path — you have a GOVERN 1.1 gap. The Air Canada tribunal will not be the last to decide that gap is your problem, not your vendor's.

For federal agencies, healthcare systems, financial institutions, and any organization operating under fiduciary or regulatory obligations: the question is not whether an AI liability ruling will affect your sector. It is whether your governance structure will be ready when it does.


Apply the Framework

Failure Files™ Hub — All 12 cases scored against TAIMScore™ GOVERN, MAP, MEASURE, and MANAGE controls. Filterable by domain and sector.

→ All Failure Files™ → TAIMScore™ Assessor Workshop

The Trust Gap — Permitted is not the same as admissible. Air Canada's chatbot was permitted to answer any question. The tribunal ruled those answers admissible against the airline. Read the framework.

→ Read the Trust Gap → GASP™ Diagnostic → ✦ Underwrite Human Signal

Related Failure Files™

UnitedHealthcare AI Claim Denials — When the Algorithm Overrules the Doctor Zillow iBuying Collapse — $881M in Losses and a MAP Control That Was Never Built The Anthropic Exodus and Governance Collapse