FCA authorised · FRN 724952 0117 325 0027Quote & buy →
AI insurance
AI chatbot insurance is cover for the claims that follow when a customer-facing chatbot or AI assistant gives wrong, misleading, defamatory or data-leaking answers in your business's name. It matters because tribunals and regulators treat a chatbot's words as the business's own, and one flawed answer can repeat across thousands of conversations.
Part of: AI insurance UK
In short
Yes, you are usually liable for what your chatbot says. In Moffatt v Air Canada (2024) a tribunal held that a chatbot is simply part of the business's website. In the UK, section 50 of the Consumer Rights Act 2015 can turn statements made to consumers on a trader's behalf into contract terms, and since 6 April 2025 the CMA can fine businesses up to 10% of worldwide turnover for unfair commercial practices, including misleading information. Chatbots also create data protection and defamation exposure. Professional indemnity, cyber and IP cover can each respond, subject to the policy terms; regulatory fines are a separate question.
This page is about AI that talks: chat assistants, customer service bots and voice bots that answer questions or quote terms. AI that acts, by making payments or changing systems, is covered in AI agent insurance.
A chatbot's risk sits in its words. The main exposures are:
One bad prompt or model update can repeat the same wrong answer many times before anyone notices.
The leading decision is Moffatt v Air Canada, 2024 BCCRT 149, decided by the British Columbia Civil Resolution Tribunal on 14 February 2024. The airline's chatbot wrongly told a customer he could claim a bereavement fare after travelling. The tribunal said that while a chatbot has an interactive component, "it is still just a part of Air Canada's website" (para 27). The customer had no reason to know that one part of the website was accurate and another was not. The airline was liable for negligent misrepresentation. The decision does not bind UK courts.
In the UK, consumer law points the same way. Under section 50 of the Consumer Rights Act 2015, anything "said or written to the consumer, by or on behalf of the trader" about the trader or the service becomes a term of a services contract if the consumer takes it into account when deciding to buy, or when making a later decision about the service. A chatbot answering for a business is arguably speaking on its behalf. Two details matter in practice:
Between businesses, a wrong answer a customer relies on can support a negligent misstatement or misrepresentation claim, depending on the facts and contract terms.
The unfair commercial practices rules in Part 4 of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025. Under section 226, a practice involves a misleading action if it provides false or misleading information, and misleading information includes information that, "although true, is presented in a misleading way". The CMA's guidance for businesses lists misleading actions, misleading omissions, aggressive practices and failing to act with professional diligence, alongside 32 practices that are always banned. It warns that the CMA and the courts can fine traders up to 10% of worldwide turnover, and that businesses may also have to compensate affected consumers.
On 9 March 2026 the CMA published guidance on complying with consumer law when using AI agents, which covers AI that handles customer service queries. It says "you are responsible for what an AI agent does in the same way you are responsible for what an employee does", including where a third party built or supplied it. It also says not to mislead customers into thinking a service is provided by a real person, and recommends testing, human oversight and monitoring.
If your chatbot serves people in the EU, Article 50 of the EU AI Act has applied since 2 August 2026. According to the European Commission, providers of AI systems that interact directly with people must design them so people are told they are dealing with AI, unless that is obvious, wherever the provider is based.
Whether any resulting fine can be insured is a separate issue: see are AI regulatory fines insurable.
Chatbots collect what users type and are often connected to customer records. Illustrative problems include a bot that shows one customer another's order history, or a prompt-injection attack that extracts data from the knowledge base. Under Article 82 of the UK GDPR, anyone who suffers material or non-material damage from an infringement can claim compensation from the controller or processor, and the ICO can investigate.
These incidents usually fall to a cyber policy for response costs and data liability, with PI relevant where you run the chatbot as a service for a client. See cyber insurance and AI risks and UK GDPR Article 82 compensation.
A chatbot can generate a confident, false statement about a real person or business. Under section 1 of the Defamation Act 2013, a statement is not defamatory unless its publication has caused or is likely to cause "serious harm" to the claimant's reputation; for a body that trades for profit, that means serious financial loss. A one-off answer may struggle to meet that test; a bot repeating the same false claim about a named competitor to many users is different (illustrative).
Chatbots can also reproduce copyright text or images. See AI IP infringement insurance and does PI cover defamation.
| Chatbot incident (illustrative) | Likely claim | Cover that may respond, subject to the policy terms |
|---|---|---|
| Bot quotes a discount or refund policy that does not exist | Customer holds you to it; possible complaint to regulator | Honouring the promise is usually your own uninsured cost; a third-party misrepresentation claim may fall under PI, depending on the wording |
| Bot you built for a client gives that client's customers wrong advice | Client sues you for its losses | PI (technology errors and omissions) |
| Bot reveals another customer's personal data | Breach response costs, ICO inquiry, compensation claims | Cyber; PI where it arises from services to a client |
| Bot repeats a false allegation about a named competitor | Defamation or malicious falsehood claim | PI or media liability, if defamation is included |
| Bot outputs text or images copied from a protected work | Copyright claim | IP infringement cover |
Check every policy for AI exclusions: see AI exclusions in insurance policies and does PI cover AI mistakes.
Insurers ask how a chatbot is controlled, and under section 3 of the Insurance Act 2015 you must make a fair presentation of the risk. Controls that help, and that mirror the CMA's expectations, include:
Write these down: see what to document about your AI use.
Apex has an AI insurance scheme with an insurer that names your specific AI work, such as the chatbots you build, run or deploy, in the policy as insured activity rather than relying on a generic business description. You choose from professional indemnity, cyber, product and public liability, and IP infringement cover, so several chatbot exposures can sit in one policy, and cover for US exposure is available, subject to the insurer's underwriting and the policy terms. To quote, we need a precise description of your AI work, your address, your turnover (including how much comes from the USA and Canada) and the limit of indemnity you want; you can start an AI insurance quote online in a few minutes. See AI insurance UK and affirmative AI cover vs silent AI.
Usually, yes. In Moffatt v Air Canada (2024) a tribunal held the airline responsible for its chatbot's wrong answer, calling the chatbot part of its website. In the UK, section 50 of the Consumer Rights Act 2015 can make statements made to consumers on a trader's behalf binding contract terms, and the CMA says businesses are responsible for their AI as for an employee.
Partly. Section 50(2) of the Consumer Rights Act 2015 lets a statement be qualified by something the trader said on the same occasion, so a clear caveat in the conversation may help. A general disclaimer elsewhere is weaker, section 57 stops traders excluding section 50 liability, and a misleading answer can still breach the DMCC Act 2024.
Yes, potentially. Since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 has let the CMA enforce consumer law directly and fine traders up to 10% of worldwide turnover. Its March 2026 guidance says businesses are responsible for what their AI agents do, including customer service bots supplied by third parties.
Often, subject to the policy terms. Cyber policies commonly cover breach response costs and data liability claims, which is where a chatbot revealing personal data usually falls. Check for AI exclusions. If you run the chatbot for a client, PI may also be relevant.
It is the safer course. The CMA's March 2026 guidance on AI agents tells UK businesses not to mislead customers into thinking a service is provided by a real person. For users in the EU, Article 50 of the EU AI Act has required disclosure that people are interacting with AI since 2 August 2026, unless it is obvious.
Tell us what your AI work is, where you are based, your turnover and the limit you need. It takes a few minutes online, and a broker will come back to you with options. Or call 0117 325 0027.
Start an AI insurance quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
