Skip to content
Bonrock
Back to articles
AI Strategy

The Customer Kept the Screenshot: AI Governance Starts With the Record

AI laws keep slipping. A 2024 tribunal ruling on Air Canada's chatbot shows why a company should keep its own record of what its AI said and did, and on whose authority.

On 11 November 2022, Jake Moffatt's grandmother died, and he went to Air Canada's website to book a flight to her funeral. The site's chatbot told him he could buy a ticket now and apply for the reduced bereavement fare afterwards, "within 90 days of the date your ticket was issued". The airline's own bereavement page, which the chatbot linked to, said the policy did not apply once travel was completed.

Moffatt took a screenshot of the chat. In February 2023 he emailed it to Air Canada with his grandmother's death certificate. A representative replied that the chatbot had provided "misleading words" and that it would be updated, and the airline still would not honor the fare, so Moffatt took the dispute to British Columbia's Civil Resolution Tribunal. Air Canada argued, in effect, that the chatbot was a separate legal entity responsible for its own actions. The tribunal called that "a remarkable submission", held the airline responsible for the information on its website, and ordered it to pay $812.02 (Legal500).

The ruling decided this British Columbia dispute; it did not settle liability for every AI system, and a similar case elsewhere would turn on its own facts and law. The case is cited so often because the reasoning was ordinary negligent misrepresentation, applied to a chatbot without any special AI rule. One detail in the record stays with us: the person who could show exactly what the chatbot had said was the customer.

The AI-specific rules keep moving

Since that decision, a great deal of AI regulation has been announced and then postponed. In July 2026 the European Union moved its obligations for high-risk uses such as hiring and education from August 2026 to 2 December 2027 (European Commission). Colorado's governor signed a law in May 2026 that significantly scales back the state's original AI Act and delays it to 1 January 2027 (Hunton). Canada abandoned its proposed AI act and in June 2026 tabled Bill C-36, a privacy bill that would require organizations to be transparent about automated decisions that significantly affect people (ISED).

It is tempting to read the delays as time to wait. The new timetables do not suspend ordinary law of the kind that decided Moffatt, and in that dispute it was enough to hold a company responsible for what its chatbot told a customer.

What we would build toward

The new rules differ in scope and politics, and meeting one does not satisfy another. Two of them still point at the same practical capability. Canada's bill asks for transparency about automated decision-making. China's guidelines on AI agents, issued in May 2026, sort an agent's decisions into three tiers (those only the user can make, those that need the user's authorization, and those the agent may make alone) and give users "the final decision-making power" over what the agent does on its own (NYU Shanghai RITS). Both assume someone can say, for a particular automated decision, who was entitled to make it.

Our proposed operational test is four questions about one action on one day: which system did this, on whose authority, using which data, and how could a person have stopped it? Answering them will not by itself make a company compliant anywhere. A company that cannot answer them will find every one of these regimes harder to meet, and will be poorly placed in a dispute.

The evidence is usually scattered

IBM's 2025 breach study gives a sense of how often the basics are missing where it matters. Of the 600 breached organizations it examined, 63% had no AI governance policy, and 97% of those that reported an AI-related security incident said they lacked proper access controls for their AI systems (IBM). These were companies that had already suffered a breach, so the figures say little about companies in general. They do show that, among organizations that later needed to investigate, basic controls were often absent.

Agents make the question harder to answer even where logs exist. A chatbot produces words, and one screenshot can capture them. An agent that reads an order, updates a record and sends an email leaves traces in the model vendor's console, the CRM's audit trail and the mail server, each with its own retention period and access rules. Reassembling one action after the fact means pulling those pieces together, and some may already have expired.

Start with authority and outcome

We think a company running agents should start by making each action traceable to an agent and a grant of authority. Give each agent its own credentials, scoped to its job. Record who authorized each kind of action and what the agent actually did, in one place the company controls. Decide in advance which actions an agent may take alone, which need a person's approval, and which it may never take; China's three tiers are a workable template wherever you operate. Put a person in front of anything that moves money, contacts someone outside the company or cannot be undone.

Raw content needs more care than a blanket rule. Prompts and inputs can contain personal and confidential data, and every stored copy is something that can leak. Keep them as long as the duties that apply to that particular use require, and decide that use by use with counsel. Logging everything indefinitely in the name of governance creates an exposure of its own.

Policies, risk registers and committee charters still matter, especially once the EU's high-risk rules arrive. They are easier to write when the record exists, because every rule can point at something real.

One exercise shows where a company stands. Pick an action an AI system took on your behalf last week, such as an email it sent, a record it changed or a customer it answered, and time how long it takes your team to answer the four questions. In Moffatt's dispute, the clearest record of what the chatbot said was the customer's screenshot. It is better to learn whether the same would be true of your systems before a customer, regulator or tribunal asks.

Sources

Found this helpful? Pass it on.

Working on something like this?

We help organizations build AI systems that are secure, private and ready for real load.

Talk to us →