"The chatbot said it, not us." Two courts have now said: yes, you.

Whatever the AI agent on your site promises, you've promised. In 2024 a Canadian tribunal ordered Air Canada to honor a bereavement discount its chatbot had invented. The airline argued that the bot was 'a separate legal entity responsible for its own actions'. The tribunal called that remarkable and ruled against it. In May 2026 the Higher Regional Court of Hamm in Germany reached the same conclusion about a clinic whose website chatbot gave its doctors specialist titles they didn't hold. The court treated the bot as part of the business, so its answers were the company's answers. The ruling isn't final yet, because the court allowed an appeal to the Federal Court of Justice.

Small teams are putting AI agents on their sites under that rule, and they should keep doing it. What the agent is allowed to say is now a business decision, and the owner makes it.

Where general-purpose bots go wrong

Support bots still get answers wrong, and the cause is usually the same: a general-purpose language model asked something it was never given. It produces the most plausible shape of an answer, in your brand's voice, with total confidence. Your returns window becomes 60 days because that's a common number. Your plan includes a feature because the sentence flowed.

A bot that's wrong 15 percent of the time on policy questions is writing 15 percent of your policy for you, and you find out which parts when a customer holds you to one.

Three controls that change the risk

One: ground every answer in your own pages. The agent retrieves from your live site at question time and can only assert what it found. If retrieval comes back empty, the right output is 'I don't know, here's how to reach us'. That one rule takes invented policy off the table.

Two: show the receipt. A citation on each grounded answer lets the customer check and lets you audit. When something looks off, the citation points to the page that produced it. Often the page was ambiguous and needs a rewrite, so the fix is on your website, where you can make it.

Three: define what the agent must not decide. Refunds over a threshold, cancellations, anything with a legal edge: these get an escalation rule that pulls a human in, notifies them wherever they are, and lets them take over the live chat. The agent explains and the human commits. That split is effectively what the courts are asking for.

All three controls, built in

Agentmatica ships with all three. A shopper asks whether they can return a jacket after 60 days. The agent reads your returns page, answers with the window that page states, and shows the page under the reply. If none of your pages cover it, the agent says it doesn't know and tells the shopper how to reach you.

A shopper asks for a refund on a large order. Your escalation rule pulls you in, you get the notification in Slack, Telegram or email, and you take over the live chat to make the call yourself. When it's done you hand the chat back and the agent carries on. Private directives set the lines it holds in between, such as never quoting a delivery date or always sending cancellations to you.

The same grounding is what makes it safe to let the agent sell. When a shopper asks which jacket suits wet weather, it recommends from your catalog, shows the options as product cards, and on Shopify or WooCommerce adds the one they pick to the cart with a checkout link.

What a careful setup gets you

A grounded agent that cites its sources and declines when it has nothing to cite is more trustworthy than the average human reply. It answers from the written policy, it doesn't get tired at 11pm, and it leaves a permanent, searchable record of exactly what was said and why.

Start with your returns, refunds and shipping pages. Read them the way a shopper would, fix anything a stranger could misread, and decide which requests always come to you, because those pages and rules are what your agent will say.