The "It Wasn't Us, It Was the AI" Defense Just Lost in Court

2026-08-18

For the past two years, companies deploying customer-facing AI systems have operated on a quiet assumption: if the system says something false, the system said it, not the company. The chatbot is a tool, a third party of sorts, and liability stops at the point where a human stopped writing the words.

In May, a German court took that assumption apart.

The case involved a cosmetic medicine practice in North Rhine-Westphalia, run by two doctors who go by "Dr. Rick" and "Dr. Nick" and appear on their own reality television show. Their website's chatbot told visitors the pair held specialist titles in aesthetic and plastic surgery. They didn't hold those titles. A consumer protection group sued under German unfair competition law, and the Higher Regional Court of Hamm ruled against the practice — rejecting outright the argument that the chatbot was a third party the doctors couldn't be blamed for. The court's reasoning was blunt: whoever puts a chatbot in front of customers owns what it says.

It's not an isolated data point. A Canadian tribunal reached the same conclusion in 2024, when an airline argued its support chatbot's bereavement-fare promise didn't bind the airline. It lost too. And in the US, California's AB 316, passed last year, goes further still: in civil actions over AI-caused harm, defendants can't argue the system "autonomously caused the harm." They can contest causation or fault, but the door marked "the algorithm did it" is now closed by statute, not just by a judge's reasoning in one case.

Put these together and a pattern holds across three different legal systems, three different theories of liability, and three different kinds of harm — commercial misrepresentation, contract, and open-ended civil claims. Regulators and courts are converging on the same position: an AI system's output is the deploying organisation's statement. Full stop.

That's a manageable problem when the AI system belongs to you. You can audit it, log its answers, retrain it, shut it off. The German court's own advice to companies was to test, monitor, and review what their chatbots say — sound advice, because the record exists and the responsible party is obvious.

It's a much harder problem once you ask the next question: what happens when the false statement about your organisation comes from an AI system you don't operate and never agreed to be described by? ChatGPT, Gemini, and half a dozen others answer questions about every company, executive, and public figure whether those parties consented or not. If the doctrine now emerging says "whoever deploys the AI owns what it says," the practical question for everyone else becomes: what do you do when the deploying party is someone else entirely, and the statement is about you?

There's no equivalent of "shut it off." You can't retrain a system you don't operate, and you're not a party to the terms of service. The regulatory and judicial machinery being built right now runs on the assumption that a deploying organisation can locate, log, and correct its own AI's statements. None of that logic transfers to the case of an outside AI system describing a company that has no seat at that table.

What does transfer is the underlying expectation these rulings are setting: that organisations are expected to know what AI systems are saying, in real time, not reconstruct it after a dispute has already started. The German court had a clean record of what the chatbot said, to whom, and when, because the plaintiff built one. As liability standards tighten around AI-generated statements generally, the gap between organisations that can produce that kind of record for themselves — even for systems they don't run — and those that can only offer a memory of what they think an AI probably said, is going to matter a great deal more than it does today.