The short answer
In almost every case, your business is. UK law does not treat “the AI did it” as a defence. If an employee acts on a wrong AI output and a customer is harmed, liability sits with the organisation, the same as any other mistake by a member of staff or a tool it chose to use. That is exactly why a human check and a clear policy matter.
This is the question that keeps sensible business owners up at night, and rightly so. The short answer is not comforting, but it is clear. When AI produces something wrong and your business acts on it, the buck stops with your business.
None of this is a reason to avoid AI. It is a reason to use it with a hand on the wheel. Please note this article is general information, not legal advice. For anything specific, talk to a solicitor.
So who is actually responsible?
Your business. If a member of staff uses an AI tool as part of their job and gets it wrong, the law generally treats that the way it treats any other workplace mistake. The employer carries the responsibility to the customer or third party. You cannot outsource accountability to a piece of software any more than you could blame a faulty calculator.
Suing the AI vendor is rarely a realistic route either. Their terms almost always place responsibility for how you use the output squarely on you.
How does this go wrong in real life?
Two well-known cases make it concrete. Air Canada was ordered by a Canadian tribunal in 2024 to honour a refund policy its own website chatbot had invented, after it argued unsuccessfully that the chatbot was responsible for its own words. And in the United States, lawyers in the Mata v Avianca case were sanctioned in 2023 after they filed a brief citing court cases that ChatGPT had entirely made up.
The pattern is the same every time. A person trusted an AI output without checking it, acted on it, and the organisation wore the consequences.
What does UK law say right now?
There is no single UK statute that creates special AI liability. Instead, the existing law applies. Negligence, breach of contract, consumer protection, and UK GDPR for anything involving personal data. The UK has chosen a pro-innovation approach rather than one big AI law, which puts the onus on businesses to use these tools responsibly under the rules that already exist.
How do you protect your business?
Five safeguards that carry most of the weight
- A human check on anything that matters. A named person signs off AI-assisted work before it reaches a client or the public.
- A written AI policy. It shows you took reasonable steps, which matters if anything is ever challenged.
- Approved, paid tools for client work. Business plans with proper data terms, not free personal accounts.
- Records. Keep a light trail of where AI was used on important work, so you can reconstruct what happened.
- Training. People who understand how AI gets things wrong are far less likely to be caught out by it.
Where the contract chain leaves you
People often assume responsibility can be passed up the chain to whoever built the model. It is worth understanding why that expectation usually fails, because the assumption itself is a risk.
Read the terms of any mainstream AI tool and you will find the same shape: the output is not warranted to be accurate, you are responsible for checking it before relying on it, and the supplier's liability is capped at something close to what you paid them. Some enterprise agreements offer narrow indemnities, typically around third-party intellectual property claims arising from output rather than around the output simply being wrong. None of them accept responsibility for your business decisions.
Meanwhile the obligation running the other way is largely untouched by any of this. If you provide a service, you owe your customer reasonable care and skill, and that duty does not thin out because you used a tool to help. The customer contracted with you. A regulator supervises you. From their side, how the work was produced is your business, and "the AI said so" is not a defence anybody is obliged to accept.
Two practical consequences. First, check what your professional indemnity insurer says about AI use — some policies now ask about it, and it is much better to know the answer before a claim than during one. Second, look at your own customer-facing terms: if they promise things your workflow cannot reliably deliver, that gap is worth closing.
Employees, mistakes and reasonable steps
The other question that comes up is whether the person who made the mistake carries it. Broadly, an employer is answerable for what employees do in the course of their work, so the business is normally exposed to the outside world regardless of who pressed the button. Internally it is a different conversation, and the fairness of it turns almost entirely on what you had put in place beforehand.
If nobody was told what was allowed, nobody was trained, and no approved tools were named, then disciplining someone for using AI badly is difficult to justify and reflects a management failure more than an individual one. If there was a clear policy, the person had been trained on it, and they pasted confidential client information into a consumer chatbot anyway, that is a straightforward conduct matter.
The gap between those two situations is made of documentation, and it is the cheapest risk reduction available. Written rules, recorded training, a named approved tool list, and the date each person was briefed. None of that is expensive; all of it is the difference between a defensible position and an awkward one.
The records that actually protect you
When something goes wrong, your position is determined less by what you believed and more by what you can show. Four things are worth keeping.
Evidence that you set the rules. The policy, with a version and a date, and a record that it was issued to people.
Evidence that people were trained. Who attended, when, what was covered. A one-line register is enough, and is far more persuasive than an assertion that everybody knew.
Evidence that humans checked the work. This is the important one and the one most often missing. For anything client-facing, being able to show that a named person reviewed and approved the output before it went out converts an AI error into an ordinary human mistake within a controlled process — which is a category everybody already knows how to handle.
Evidence that you responded. What you did when you found out, who you told, how you corrected it. If personal data was involved, note that a breach may need reporting to the ICO within 72 hours, and that an automated cause does not pause the clock.
None of this stops errors. What it does is keep an error from becoming a story about a business that had no idea what its staff were doing — which is usually the part that causes lasting damage.
This article is general information and not legal advice. If you are in a regulated sector, or a specific incident has occurred, take advice on your own circumstances.
Who's Liable When AI Gets It Wrong? – frequently asked questions
If AI gives bad advice and someone acts on it, who is liable?
Normally the business, not the tool. UK law treats it much like any other mistake by staff or equipment the business chose to rely on. That is why a human check on important work is essential.
Can we blame the AI vendor if the output is wrong?
Rarely. Most AI tools' terms place responsibility for how you use the output on you, the user. Suing the vendor is not a realistic route for the vast majority of businesses.
Does UK GDPR apply to how we use AI?
Yes, wherever personal data is involved. Putting customer or employee personal data into an AI tool is processing that data, so your usual data protection obligations still apply. Use tools with proper business data terms.
Can an employee be disciplined for misusing AI?
They can, if there is a clear policy they have breached. This is one more reason to have a written AI policy: it sets the standard everyone is held to and makes fair action possible.
How do we reduce legal risk from AI at work?
A human check on anything that matters, a written policy, approved paid tools for client work, light record-keeping, and training. Together these show you took reasonable care.
Can we rely on the AI vendor's indemnity if the output is wrong?
Rarely. Mainstream AI terms disclaim accuracy, put the duty to verify on you, and cap liability at roughly what you paid. Some enterprise agreements add narrow indemnities, usually around third-party intellectual property claims rather than output simply being incorrect. Read your actual agreement, and assume the commercial risk of a wrong answer sits with your business.
Does our professional indemnity insurance cover AI mistakes?
It depends on the policy, and it is worth establishing before you need to know. Some insurers now ask about AI use at renewal, and the answers you give matter. Check whether your cover says anything about AI-assisted work, tell your broker how the tools are actually used, and make sure your customer-facing terms do not promise more than your process can deliver. This is general information, not legal or insurance advice.
What single record best protects us if AI output causes a problem?
Proof that a named human reviewed and approved the output before it went to the client. That one record turns an AI incident into an ordinary mistake inside a controlled process, which is a far more defensible position. Keep it alongside your dated policy and a simple training register showing who was briefed and when.
Which Oxford AI School training fits this need?
Put the safeguards in place before you need them. Policy and practical training, in person across the UK or live online.
Reduce your AI risk without killing the upside
Our AI Policy Workshop helps your team agree the safeguards above and build the habit of checking, so you get the productivity and skip the headlines.
Book the AI Policy Workshop Keep your data safe
Harry Lang runs The Oxford AI School, teaching teams and businesses the basics of AI in a fun, easy and practical way. A marketing leader turned AI trainer, he can be reached at Learn@TheOxfordAISchool.com.