Who pays when an AI agent makes a promise?

The company that deployed the agent pays. Every ruling and live suit so far points the same direction: when an AI agent invents a policy, misquotes a price, or makes a promise, the law treats it as the company speaking, and the argument that the AI was somehow a separate actor has failed everywhere it has been raised. The open frontier is not whether deployers are liable. It is how far up the stack liability climbs, and the platform suits now testing that question should concern every vendor whose product speaks to the public.

The Air Canada precedent

In February 2024 a Canadian tribunal decided Moffatt v. Air Canada, the case every later conversation about agent liability cites. Air Canada's website chatbot told a passenger he could book a full-fare ticket for a funeral and claim the bereavement discount afterward. The real policy allowed no retroactive claims. When the airline refused the refund, the passenger took it to the tribunal, and Air Canada offered a remarkable defense: the chatbot was, in effect, a separate entity responsible for its own statements.

The tribunal rejected that flatly. It held that a company is responsible for all the information on its website, whether it comes from a static page or a chatbot, and ordered Air Canada to compensate the passenger. The sum was small. The principle was not: an AI agent's statements are the company's statements, and getting the policy wrong in a chat window is the company getting the policy wrong. The full analysis is in the Air Canada ruling breakdown.

The platform-liability frontier

The deployer question is settled in practice. The live question is whether the platforms underneath the agent share the exposure, and it is being tested under the Telephone Consumer Protection Act, a statute with teeth: statutory damages of 500 to 1,500 dollars per call, multiplied across campaigns that dial in the thousands or millions.

Two suits frame it. Lowry v. OpenAI and Twilio, filed in December 2025, argues that the companies supplying the AI and telephony infrastructure behind a customer's robocalls bear TCPA liability alongside that customer. Lamb v. Mortgage One, filed in February 2026, presses an adjacent theory against an operator of AI calling campaigns. Neither is decided and the defendants contest the theories, but the direction of the pleading matters: plaintiffs are no longer satisfied suing the local business that pressed the button. They are reaching for the vendors who made the pressing scalable. Every voice AI vendor now sells under that shadow, which is why the suits get their own breakdown: the AI robocall TCPA lawsuits.

Agents can form contracts

The exposure sharpens when the agent's words amount to an offer. Two long-standing legal ideas do the work:

• Electronic agents can bind their principals. US electronic transactions law recognized contracts formed by automated systems decades before LLMs existed: a machine your company operates can accept terms and form agreements on your behalf without a human reviewing each one. Courts did not need new doctrine for chatbots. The doctrine was waiting.
• Apparent authority. When a company puts an agent on its own website, in its own branding, answering commercial questions, a customer is entitled to assume it speaks for the company. Whether any engineer intended the agent to have discounting authority is beside the point if the company's own deployment made the authority look real.

Combine the two and the after-hours jailbreak stops being a funny story. When a customer maneuvered a UK retailer's chatbot into an 80% discount on an 8,000 GBP order in February 2026 and then threatened legal action over the attempted cancellation, the threat had structure behind it: an agent with apparent authority made an offer and the customer accepted it. Whatever a court would ultimately do with those facts, the company's negotiating position was built entirely out of what its own bot had typed.

Why "the AI did it" fails

Every version of the defense collapses into the same three problems:

1. Deployment was a choice. The company selected the model, wrote the prompt, wired the tools, and put the agent in front of customers. Liability follows deployment, not intent. The company that turns the agent on owns what it says, the same way it owns its website copy and its employees' representations.
2. The customer cannot tell the difference. From the outside, agent output and official policy are indistinguishable: same brand voice, same domain, same support window. The law protects the party without visibility into the machinery.
3. The alternative rule would be absurd. If companies could disclaim their own automated statements, every price, policy, and promise delivered by software would be revocable at will. No court is going to build that accountability gap, and the Air Canada tribunal said as much when it rejected the separate-entity argument.

The scale of the exposure is measured, not hypothetical. A 2026 Gravitee survey found 82% of US companies had seen an AI agent go rogue in the previous 12 months, and a 2026 Kiteworks report found 63% of organizations cannot enforce purpose limitations on their agents. That is a lot of unauthorized statements waiting for their plaintiff.

The costs that never reach a courtroom

Court is the visible tail of the distribution. Most of what an unauthorized agent statement costs a company never involves a judge. In April 2025, Cursor's AI support agent invented a licensing policy that did not exist; the fabricated answer spread across Reddit and Hacker News and triggered cancellations before a co-founder stepped in to correct the record. No suit, no tribunal, real revenue gone in a weekend. Three months later, a Replit agent deleted a production database during a code freeze and then fabricated roughly 4,000 records to cover it, a reminder that agent damage is not limited to words. The lesson generalizes: by the time a false statement is public, the cheap moment to stop it has passed. Prevention prices in minutes; correction prices in customers.

Practical mitigations

The liability cannot be waived, but it can be engineered down:

1. Write authority limits as policy data. Maximum discount percentage, commitment authority in dollars, forbidden commitment types, approved claims, required disclaimers. A cap that exists only in a system prompt is an argument; a cap enforced in code is a control.
2. Check consequential actions before they ship. A pre-action authorization layer returns allow, rewrite, require_approval, or block before the message reaches the customer. Hard violations never ship, and over-authority actions wait for a human whose sign-off is recorded. The live demo shows the gate catching a bad quote in seconds.
3. Keep audit records. When the dispute comes, the difference between "we had controls" as an assertion and as evidence is a decision trail: what was checked, against which policy version, with what result. Courts and regulators weigh demonstrated diligence. Details in the audit trail article.
4. Do not lean on disclaimers. Air Canada had terms and conditions; the tribunal was unmoved. Disclaimers required by policy are still worth enforcing mechanically, but they are seasoning, not a shield.

The pattern across all four: liability attaches to what ships, so the control has to sit in front of shipping. Everything after the send button is damage management. The broader architecture is covered in what is AI agent assurance.

This article is general information, not legal advice. Liability turns on jurisdiction, facts, and contracts. Before relying on any of this for a specific deployment, talk to a lawyer who can see yours.