Your AI assistant tells a customer the delivery date is the 15th, but it is the 30th. The customer books a crew, loses a week, and sends you an email. Whose fault is it? Spoiler: not the software's. Let's see why, and how to protect yourself without giving up on AI.
A merchant from Prato and his agents
Let's start far back, because the Professor has a soft spot for merchants. Francesco di Marco Datini, born in Prato around 1335 and died there in 1410, built a network of businesses across Pisa, Prato, Genoa, Barcelona, Valencia and Majorca, with general management in Florence and the old Avignon house still running (see also the Wikipedia entry on Datini). His archive, kept at the State Archive of Prato, holds about 150,000 letters, documents and account books: a merchant who wrote a great deal because he could not be everywhere.
And you may ask: what does Datini have to do with an AI assistant? Quite a lot. A medieval merchant could not see with his own eyes what his agents, the fattori, signed on his behalf in Barcelona or Genoa. Yet under the ius commune, which drew on Roman law, whoever put an agent in charge of a business was in broad terms answerable for what the agent did in that role. The technical details varied by place and case, and I am not pretending to be a lawyer: the general principle, though, was that one. If you send an agent to negotiate in your name, third parties trust you, not him.
Well, your company today is in that same workshop. The agent is now a piece of software.
The same principle, in 2024, with a chatbot
In February 2024 the Civil Resolution Tribunal of British Columbia decided Moffatt v. Air Canada. A passenger had asked the airline's chatbot how the bereavement fare worked; the chatbot told him he could claim it after buying the ticket, but the airline's real policy did not allow that. The airline tried to argue it was not responsible for what its chatbot said. The tribunal rejected the defense: the company had not taken reasonable care to make sure the chatbot was accurate, and a customer should not have to check one page of the site against another (as summarized by Canadian press).
A caveat: this is a Canadian decision, not a European one, and it concerned a small claim. It sets no precedent here. But it shows how decision-makers reason: whoever puts a tool in front of customers answers for it, full stop.
What European and Italian law say today
There is no article of any code titled "AI mistakes". General rules apply all the same:
- Contract and pre-contract liability. If you promise something to a customer through a chatbot or a generated email, you made that promise. Which rule applies depends on the case, which is why a clear terms page is worth more than a thousand apologies.
- GDPR. The regulation provides, in Article 22, safeguards for decisions based solely on automated processing that significantly affect people. If AI alone decides on credit, hiring or exclusion, extra care is needed.
- AI Act. Regulation (EU) 2024/1689 requires those who use high-risk systems to ensure competent human oversight. We covered it in What the AI Act means for SMEs.
- Italian Law 132/2025. The Italian AI law, in force since October 10, 2025, provides that professionals inform clients when they use AI systems, and that employers inform workers.
What's new: software becomes a "product"
Then there is Directive (EU) 2024/2853 on liability for defective products. Two points to know:
- The definition of product expressly includes software; those who supply an AI system can fall among the liable parties.
- Member States must transpose it by December 9, 2026; it will apply to products placed on the market after that date.
An honest caveat: the directive mainly protects natural persons for harm such as injury, death, damage to property and loss or corruption of data. It is not the rule that covers a wrong quote between two businesses. But if you make or resell solutions with AI inside, or embed software in your own product, it concerns you directly. Before making decisions, check the Italian transposition decree once it is published in the Gazzetta Ufficiale.
Where AI gets it wrong in an SME, and who answers
A typical scenario, not a real client: a 12-person consulting firm uses AI in four places. Here is who answers in each.
| Use | Typical error | Who answers to the customer |
|---|---|---|
| Website chatbot | Promises a discount or deadline that doesn't exist | The company |
| Draft quote | Wrong figure or clause | Whoever signs and sends the quote |
| Meeting summary | Attributes a decision to the wrong person | The company, toward colleagues and clients |
| CV screening | Rejects candidates for no valid reason | The company, with extra duties (high risk) |
The tool's vendor has its own responsibilities, but they are usually limited by contract. Read the terms: vendors often exclude any warranty on the accuracy of generated content.
How to protect yourself without giving up AI
The Professor is no enemy of AI, quite the opposite. Datini did not stop sending agents around the Mediterranean: he chose them with care, made them write, checked the books. The same method works today.
- One owner per tool. A name and surname, not "the department".
- Human review where mistakes are costly. Quotes, contracts, customer communications, anything that binds the company.
- Be transparent. Tell customers when they are talking to a chatbot and where to find the official terms. A practical example is in Website chatbot: when you really need one.
- A simple log. Who used what, for which document, who checked it. Merchants kept ledgers; you can keep a shared sheet.
- Written rules for staff. Our article on ChatGPT at work: rules for employees is a good start.
- Review the vendor contract. Where data goes, what is guaranteed, who answers in case of an incident.
For a view tailored to your business, the SME page lists the areas we work in, and among our services you will find AI strategy and training programs.
What to do on Monday morning
- List where AI speaks in your name. Chatbots, automatic emails, quotes, forms: for each, write down who checks it.
- Add a human check to anything that binds the company. One rule is enough: no quote or contract goes out without a second reading.
- Reread your vendor's terms. Look for warranties, liability limits and data handling, and note the questions to ask.
AI is an excellent agent: fast, tireless, never asks for time off. But it signs in your name. If you want to put this chain of responsibility in order, book a free introductory call: in half an hour we will see together where your company is exposed and what is really needed.
The Professor of Penzai
