Can Businesses be Sued for AI Mistakes?
Artificial Intelligence (“AI”) is being increasingly integrated into modern business operations, with many companies utilising these tools to increase productivity and operational efficiency through automated decision-making, document drafting and content generation. While these technologies offer significant benefits, they also create legal risks where inaccurate outputs cause financial loss, reputational harm or other damage. This raises the question: can businesses be held liable for mistakes made by AI? Although AI systems continue to improve, businesses should not rely on them without appropriate human oversight. A business may still be responsible where its use of AI causes harm or breaches existing Australian law. This article considers how misleading or deceptive conduct, negligence and privacy law may apply to AI-related mistakes.
Artificial Intelligence: Business Applications, Benefits and Risks
AI refers to computer systems that can perform tasks usually associated with human intelligence, including analysing information, recognising patterns and making decisions. Businesses use AI to improve efficiency, reduce costs and automate repetitive processes, particularly where large amounts of data must be analysed.
Different AI systems are designed for different tasks. Generative AI refers to systems that create new content, including text, images and videos, in response to user instructions. ChatGPT, Claude and Gemini are examples of generative AI tools used by businesses for content production, research assistance and data analysis. Machine learning is a broader form of AI that identifies patterns in data and uses them to make predictions or recommendations. Natural language processing enables computer systems to process, interpret and generate human language.
Many businesses use AI-powered chatbots to provide customers with assistance outside normal business hours. AI can also help employees draft documents, summarise lengthy files and organise information. Businesses may also use AI to create marketing content and analyse customer engagement. These applications can improve workplace efficiency, but they still require appropriate human oversight.
Despite these benefits, increased reliance on AI creates several risks. AI systems may produce false or misleading information, commonly described as an AI hallucination, while presenting that information confidently. Privacy and confidentiality risks may also arise where employees enter personal, sensitive or commercially confidential information into an AI system. Some providers may retain or use submitted information depending on their terms, settings and contractual arrangements. Businesses should therefore assess an AI provider’s data practices and introduce appropriate safeguards before using the system.
Can Corporations be Sued?
The ability of a corporation to be sued derives from the separate legal entity doctrine. This principle was established by the House of Lords in Salomon v A Salomon & Co Ltd [1897] AC 22, where it was determined that a company is a legal person separate from its shareholders and directors. As a consequence, a corporation may own property, enter contracts, and sue or be sued in its own name. Although the doctrine originated in the United Kingdom legal system, it is also recognised in Australian law. Section 124 of the Corporations Act 2001 (Cth) provides that companies have ‘the legal capacity and powers of an individual’, thereby enabling it to commence legal proceedings and to be the subject of legal proceedings. AI systems, by contrast, are not currently recognised as legal persons under Australian law and therefore cannot themselves be sued.
Existing Causes of Action
Misleading or Deceptive Conduct
The Australian Consumer Law (“ACL”) provides one way businesses may be held responsible for AI-related mistakes. Section 18 prohibits conduct in trade or commerce that is misleading or deceptive or likely to mislead or deceive. A business does not need to intend to mislead someone for section 18 to apply; the overall effect of the conduct is what matters. However, an incorrect AI output will not automatically breach the ACL. The information must be misleading or likely to mislead in its particular context. For example, a business may face liability if it publishes false AI-generated advertising claims or provides misleading information to customers through an AI chatbot without appropriate review.
Businesses may also face legal risks if they exaggerate or misrepresent how they use AI. This practice is sometimes described as “AI-washing”. For example, a business might claim that its products are powered by advanced AI when AI plays only a limited role in its operations. Although Australian courts have not yet established a specific category of liability for AI-washing, existing laws dealing with misleading representations may apply.
A useful comparison is greenwashing, where businesses make false or exaggerated environmental claims. In proceedings brought by ASIC under financial services legislation, Vanguard admitted making misleading claims about the environmental screening applied to one of its investment funds. Although that case did not concern AI or the ACL, it demonstrates the risks businesses face when their public statements do not accurately reflect their operations.
Negligence
Negligence may arise where a business owes another person a duty of care, fails to take reasonable care and causes harm as a result. However, a business will not automatically be negligent simply because an AI system produces an incorrect output. Whether liability arises will depend on the relationship between the parties, how the AI was used, the type of harm suffered and whether the business took reasonable precautions.
For example, a business might provide AI-generated advice to a client without checking its accuracy. If the client reasonably relies on that advice and suffers harm, the absence of appropriate human review may be relevant in determining whether the business took reasonable care. The level of review expected may be greater where the information concerns important financial, legal, medical or safety decisions.
A negligence claim would ordinarily focus on the actions of the business rather than the AI system itself. Relevant matters may include whether employees were trained to use the system, whether it’s known limitations were considered and whether important outputs were checked before being provided to customers.
Privacy and Confidentiality
Businesses using AI must also consider their obligations under the Privacy Act 1988 (Cth). These obligations apply to organisations covered by the Act, known as APP entities. Some small businesses may be exempt unless a specific exception applies. The Australian Privacy Principles (“APPs”) regulate the handling of personal information rather than every type of confidential information.
- APP 1 requires APP entities to manage personal information openly and transparently. This includes maintaining an up-to-date privacy policy and taking reasonable steps to implement practices and procedures that support compliance with the APPs.
- APP 3 generally permits an organisation to collect personal information only where it is reasonably necessary for its functions or activities. Sensitive information generally requires the person’s consent unless an exception applies.
- APP 5 requires reasonable steps to notify individuals of specified matters when their personal information is collected. APP 6 generally restricts the use or disclosure of personal information for a purpose different from the purpose for which it was collected, unless the individual consents or another exception applies.
- APP 11 requires APP entities to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Personal information must generally be destroyed or de-identified when it is no longer needed for a permitted purpose, unless its retention is required or authorised by law.
Before using an AI product, a business should assess the provider’s privacy terms, security arrangements and approach to retaining user inputs. Businesses should also limit the personal information entered into AI systems, train employees and introduce clear internal policies. Confidential business information may require separate protection through contracts, employment obligations or confidentiality agreements.
Conclusion
Businesses can be sued where their use of AI breaches existing Australian law, but liability does not arise simply because an AI system makes a mistake. It will depend on how the system was used, whether its outputs were properly reviewed and whether the mistake caused legally recognised harm.
Businesses should treat AI as a tool rather than a substitute for human judgment. Clear policies, employee training, privacy controls, careful selection of AI providers and human review of important outputs can help businesses use AI effectively while reducing their legal and commercial risks.
How OpenLegal Can Help
OpenLegal can assist businesses in managing the legal risks of using AI. This can include reviewing AI provider terms, preparing internal AI and privacy policies, and advising on liability where an AI-related mistake has caused loss or harm. If you are concerned about how your business uses AI, OpenLegal offers a free 15-minute consultation to discuss your matter and how we may be able to assist.
Visit openlegal.com.au to learn more.
This article is not intended to be legal advice and is general information only.
By Intern Charlotte.
