Chatbots that are the first point of contact can bind companies to costly mistakes, whether to customers or employees
A Toronto BMW dealership and Air Canada have both learned the same expensive lesson this year: when a chatbot speaks for a company, the company is on the hook for what it says. Now, as some organizations are considering AI chatbots for internal HR functions – fielding questions on benefits, leave, and entitlements before an employee ever reaches a manager – the same risk is quietly moving inside the building.
In June 2026, BMW Toronto's chatbot offered a customer more than $27,000 to buy back his vehicle – an amount that, by the dealership's own account, mistakenly matched his outstanding loan balance rather than the vehicle's actual value. A sales consultant later called to revoke the offer, telling the customer that the deal had dropped by more than $7,000. The dealership only reinstated the original price after being contacted by CBC News.
“If they're going to be replacing their employees' jobs with AI, then they need to be honouring what that AI says,” the customer told CBC News.
That case echoes an earlier case involving Air Canada. In 2024, the British Columbia Civil Resolution Tribunal found the airline liable after its website chatbot wrongly told a grieving customer he could apply for a bereavement fare discount after he had already travelled. Air Canada tried to argue the chatbot was “a separate legal entity” responsible for its own errors – an argument the tribunal rejected outright, according to CBC News. Tribunal member Christopher Rivers wrote that “it should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.”
Both cases involved customers, but the underlying failure – a chatbot stating something confidently and incorrectly, with real financial consequences – is something that could also happen internally as AI moves into employee-facing roles.
The internal risk looks different
It becomes a real risk when an organization goes all-in on chatbots as the first point of contact for employees – something US software company Clickup did recently when it announced it was using three times as many internal AI agents as employees and staff were told to interact with an AI agent trained to act like the CEO before reaching out directly to him.
Helen Ashton, Vice-President of People, Culture and Customer Experience at Grand and Toy in Toronto, said the dynamic changes when a chatbot becomes an employee's first point of contact rather than a manager or HR business partner. “I think there is a time and place for it, and I think people will start using it a lot more on their own as well, as long as the tools are available and they’re reliable,” says Ashton. “But I also think that it should be very clear that this is not to replace that collaboration, internal communication, and the partnership with the other departments – this is a tool that could help you, but also be mindful that this isn’t a bible and don't follow it to the ‘T’.”
Ashton believes that there’s a generational shift already underway in how people relate to AI advice, describing how her own teenage son now consults a chatbot before difficult conversations with her. “We as HR leaders need to start thinking about that overreliance on those tools and what does that mean,” she says. “And how do we help the generations that are coming into the workforce learn those critical thinking skills versus what the chatbot told me.”
Katie Thibeault, HR manager at Cognition+ in London, Ont., believes that the guardrails start with knowing exactly where a chatbot's answers come from. "It's really important that the HR team who may be supporting that AI chatbot understands where the chatbot is pulling information from and ensuring those sources of information are accurate,” says Thibeault. She says that many enterprise HR chatbots draw on uploaded company policy documents, which makes version control critical: "You're going to want to make sure that where you're storing those company policies is somewhere secure, and that if you're updating a policy or the source of information that AI is using, you're keeping those sources up to date.”
Chatbots should never be the final word
Chatbots can be tricky because they’re usually built to sound certain even if they’re wrong, says Thibeault. “[A chatbot] might sound like an employment lawyer, but it isn't,” she says. “When you have those more complex, challenging employee relations cases or terminations, you need to go to the source for those types of information.”
Thibeault also expresses concern with confidentiality risks with AI note-takers sitting in on legally sensitive conversations, noting some employment lawyers are already wary of a third party recording device eroding privilege between an employee and counsel.
An audit trail matters too, according to Thibeault, who points to the kind of built-in logging that could have caught BMW Toronto's pricing error before it reached a customer. "Sometimes those chatbots will have an audit function,” she says, adding that flagging AI-generated answers as potentially fallible upfront – while not eliminating liability – is a basic transparency step every organization should take.
Building guardrails without losing the human touchpoint
While AI technology can have its risks, Ashton believes it can be effective, whether for answering employee queries or other uses. “For every story about the car dealership and the wrong information, there's also a story of, ‘Now I have weight off my shoulders because I know how to tackle this problem,’” she says. “AI is just another tool in your toolbox, and [HR must] help our organizations to understand when to use it, how to use it, and when you need other tools and not just AI – finding that balance is very important.”
Neither Ashton nor Thibeault described a finished playbook. “I don't know that there’s a lot of right or wrong right now [for AI], we're all sort of in the phase of discovery,” says Ashton.
Thibeault points instead to living policy: usage guidelines that are revisited regularly, clear communication to staff about what is and isn't acceptable, and treating the chatbot "as a partner or as a co-worker, versus something that you're going to ask a question and blindly follow along without doublechecking.”
Confidentiality is also a key consideration for guardrails, according to Thibeault. “Make sure that if you’re using AI to update a policy and you're putting information about your company in an enterprise-level level tool, it’s not training anything external because, once put that into an external LLM, you can't take that back,” she says. “So just being really careful about that confidentiality piece, because if you break those gaps, you can't come back from that – being aware of where the data is going and what it might be training is a really important component of it as well.”
That framing – tool, not authority – is likely to define how Canadian organizations navigate the accelerating rollout of workplace AI systems over the next year. As the BMW and Air Canada indicate, there’s no responsibility distinction between a human giving bad advice and a chatbot doing the same on behalf of an organization and legal exposure travels with the answer, not the messenger.
