What it is
Make a one-page list of the ways your company uses AI, with the rules that apply to each. In the documented cases, companies were held to rules they already knew: answer for what you tell customers, protect personal data, do not mislead in advertising, check what you file. The tool was new. The rule was old.
What the evidence shows
Decisions and guidance by courts and regulators in four countries, insurers’ standard policy wording in the United States, and the text of the European Union’s AI Act are the basis for this advice. Each rule is stated for the place where it applies.
Rules that existed before AI
- You answer for what your AI tells customers (Canada, British Columbia). Air Canada argued that the airline was not liable for its chatbot’s wrong answer. The tribunal held that a company is responsible for all the information on its website, whether it comes from “a static page or a chatbot”.
- Privacy law covers what staff type into AI tools (Australia, Victoria). The state’s privacy regulator found a government department in breach of two privacy principles after a worker typed case details into ChatGPT: the duty to keep personal information accurate, and the duty to protect it from unauthorized disclosure.
- Consumer law covers the AI you use (United States). The Federal Trade Commission banned Rite Aid from facial recognition for five years. The Commission said the chain had used the system without testing it, checking its vendors or training staff.
- Advertising rules cover what you say about AI (United States). The Securities and Exchange Commission fined two investment advisers under its existing marketing rule for claiming AI they did not have. The Federal Trade Commission took action against a “robot lawyer” service and an AI-detection vendor over untested claims.
- Advertising rules apply however the ad was made (United Kingdom). The Advertising Standards Authority says its code applies whether or not an ad was made with AI, and that automation “doesn’t transfer liability”. It relied on an earlier ruling where Google’s automated tools put together an ad for a small clothing retailer. The regulator held the retailer responsible.
- Hiring tools can bring the vendor into court (United States). A federal court let a nationwide age-discrimination claim go ahead as a collective action against Workday, whose AI screens job applicants for its customers. In July 2025 the court widened it to AI features of a product Workday bought later. The rulings are preliminary, and no court has found Workday liable.
- Professional duties are unchanged (United States, England and Wales). Courts penalized or referred lawyers for filing AI output nobody had checked, at firms in New York, England, Wyoming and Alabama. One US court wrote that as lawyers move to AI, the duty to check their sources “remains unchanged”.
Your insurance may not cover AI output (United States)
Trade press reports that Verisk’s ISO, which writes standard policy wording that US insurers use, issued three optional endorsements dated January 2026: CG 40 47, CG 40 48 and CG 35 08. An endorsement is an add-on to a policy. These let an insurer remove cover under a general liability policy for losses that come from generative AI. Ask your broker at renewal whether AI is excluded, and what cover for it costs.
Rules written for AI: the European Union’s AI Act
The AI Act (Regulation (EU) 2024/1689) covers organizations that use AI in the EU, not only those that build it. The Act calls users “deployers”. Its rules start on different dates. The dates below come from Article 113, in the text as amended up to 27 July 2026.
| Since or from | What applies | Article |
|---|---|---|
| 2 February 2025 | Organizations that use AI must “take measures to support the development of AI literacy of their staff”. In plain terms: help your staff understand AI. | 4 |
| 2 August 2026 | AI systems that talk to people must be designed so that people are told they are dealing with AI, unless that is obvious. Anyone who publishes a deep fake must say it was artificially generated. A deep fake is a realistic image, sound or video of something that did not happen. | 50 |
| 2 December 2027 | Duties for those who use “high-risk” AI systems in the areas listed in Annex III. The list includes recruiting or selecting people, decisions about workers, and assessing whether a person is creditworthy. | 26 |
For high-risk systems, Article 26 says the user of the system must:
- use it according to the supplier’s instructions;
- put people with “the necessary competence, training and authority” in charge of overseeing it;
- as an employer, tell workers and their representatives before using such a system at work;
- tell people when such a system makes or helps make a decision about them.
How to do it
- List every use of AI in the company. Include tools staff have adopted on their own. For each, note what it does and who it affects: customers, staff, job applicants, nobody outside.
- Mark the uses that touch people. Answers to customers, personal data, hiring and staffing decisions, credit decisions, and anything you publish or advertise.
- Match each marked use to the rules you already follow. Ask of each: if a person did this, which rule would apply? That rule applies.
- If you operate in the EU, check the three AI Act dates above against your list. Hiring tools and credit checks are the uses most likely to fall under “high-risk”.
- Check your sector’s regulator. Professional bodies, financial regulators and data-protection authorities have published guidance on AI. Read the one that covers you.
- Write the result into your AI-use policy and give the list to whoever owns AI in the company.
- Ask your insurer or broker whether your policies exclude losses from AI, before renewal.
- Review the list every six months. New tools arrive and dates pass.
What to measure
- Whether the list of AI uses is complete and dated.
- The share of uses that touch people which have a named rule and a named owner.
Where it fails
- Waiting for an AI law. Every penalty on this page came under rules older than the tool.
- Assuming the vendor carries the risk. In the Rite Aid case the buyer was penalized, not the two vendors. The UK advertising regulator says automated ad tools do not move responsibility away from the advertiser. In the United States, your own liability insurance may exclude AI losses.
- Treating it as a one-off. The EU’s dates for high-risk systems were amended in 2026. Check them again when you review.
- Looking only at your home country. Rules follow where your customers and staff are.
By company size
- Micro and small: an hour with a list. Most small firms have three to five AI uses and one or two that touch people.
- Medium: the AI owner keeps the list and reviews it twice a year.
- Mid-market and enterprise: the list becomes a register, kept with legal and compliance, and checked before any new AI tool is bought.
Company cases
Companies that did this
What happened without it
- Air Canada The airline argued it was not liable for what its chatbot said. The tribunal held that a company answers for everything on its website.
- Delphia (USA) and Global Predictions The regulator applied its existing rule against untrue statements in advertising. No AI-specific rule was needed.
- Department of Families, Fairness and Housing (Victoria) The regulator found two breaches of the state’s privacy principles: on keeping personal information accurate and on protecting it from unauthorised disclosure.
- Rite Aid The regulator acted under consumer-protection law. It also said Rite Aid had not kept to an earlier order on overseeing its suppliers’ data security.
Sources
No published study tests this practice directly, so it is rated Common practice. The rating rests on the company cases above and on the sources below.
- Moffatt v. Air Canada, 2024 BCCRT 149. British Columbia Civil Resolution Tribunal, 14 February 2024. decisions.civilresolutionbc.ca
- US Federal Trade Commission (25 September 2024). FTC announces crackdown on deceptive AI claims and schemes. Press release. ftc.gov
- US Securities and Exchange Commission (18 March 2024). SEC charges two investment advisers with making false and misleading statements about their use of artificial intelligence. sec.gov
- Office of the Victorian Information Commissioner (September 2024). Investigation into the use of ChatGPT by a Child Protection worker. ovic.vic.gov.au
- R (Ayinde) v London Borough of Haringey and Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin). High Court of England and Wales, 6 June 2025. judiciary.uk
- European Union. AI Act, Regulation (EU) 2024/1689, Article 4 (AI literacy), consolidated text of 27 July 2026. European Commission’s AI Act Service Desk. ai-act-service-desk.ec.europa.eu
- European Union. AI Act, Article 26 (obligations of deployers of high-risk AI systems). ai-act-service-desk.ec.europa.eu
- European Union. AI Act, Article 50 (transparency obligations). ai-act-service-desk.ec.europa.eu
- European Union. AI Act, Article 113 (entry into force and application). ai-act-service-desk.ec.europa.eu
- European Union. AI Act, Annex III (high-risk AI systems). ai-act-service-desk.ec.europa.eu
- Advertising Standards Authority (11 June 2026). AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit 'Run'. asa.org.uk
- Mobley v. Workday, Inc., No. 3:23-cv-00770 (N.D. Cal.). Order of July 2025 (Dkt. 158). storage.courtlistener.com
- Independent Insurance Agents & Brokers of America (21 October 2025). Verisk to roll out new general liability exclusions for generative AI exposures. Trade press. independentagent.com
- Insurance Business (16 September 2026). ISO's generative AI exclusion is already on thousands of CGL policies. Trade press. insurancebusinessmag.com
Related practices
- Write a one-page AI-use policy staff will actually read Put the rules for AI on one page: which tools are allowed, what must never be typed in, who checks the output, and who to ask. Then build the most important rule into the work itself, because a page alone gets ignored. Do first · Effort: low (days, one person)
- Keep a person checking anything that goes to a customer or carries legal weight Before AI output leaves the company or is relied on in a decision, a named person checks it against real sources and signs it off. Make the check a step in the process, with time allowed for it. Do first · Effort: medium (weeks, a few people)
- Claim only what your AI has been tested to do If you tell customers that your product or service uses AI, or how well it works, hold the evidence before you say it. Regulators treat “AI-powered” and “98% accurate” as factual claims like any other. Do next · Effort: low (days, one person)
- Name one accountable AI owner Give one named senior person the responsibility for AI: priorities, budget, risk and results. Shared responsibility tends to mean nobody decides. Do first · Effort: low (days, one person)