AI Liability 2026: When the Chatbot Lies, the Company Is Liable
Within two weeks two rulings pointed in the same direction. The Higher Regional Court of Hamm ruled against a clinic for the invented statements of its chatbot, and the Munich Regional Court barred Google from publishing false AI Overviews. Both courts treat the AI output as the operator's own statement, not as third-party content. For you as a decision-maker, this means one thing: "the AI said it, not us" is worthless as a legal defence. This article explains the rulings and what companies with AI customer contact should check now.
Companies are liable for the false statements of their AI in 2026. On 12 May 2026 the Higher Regional Court of Hamm ruled (case 4 UKl 3/25) that a website chatbot is legally part of the business organisation and its invented statements are attributed to the operator, even with careful configuration. It is the first published German higher-court decision on chatbot liability, with an appeal to the Federal Court of Justice allowed. Two weeks later the Munich Regional Court (case 26 O 869/26) issued a preliminary injunction barring Google from publishing false AI Overviews about two publishers and classified Google as a direct infringer, because the AI overview makes an independent new statement. The host-provider privilege no longer applies to AI output, because it does not reproduce third-party content but creates a new statement. The EU withdrew its AI Liability Directive in 2025, so national law such as the UWG fills the gap. The numbers explain the pressure: customer-service chatbots hallucinate 15 to 27 percent of the time depending on the study, and up to 88 percent on legal questions. For companies this means liability belongs in product design, with guardrails, human oversight and a clear process for complaints.
Two rulings, one clear line
German courts answered a question in May 2026 that many companies had pushed aside. Who is liable when an AI makes false statements? The answer is the company that deploys the AI. Within two weeks two rulings pointed in the same direction, and both matter to anyone running a chatbot, an AI assistant or an AI-powered search.
Both cases treat the AI output as the operator's own statement. That shifts responsibility to where the AI is deployed, not to a maker or a supposedly separate third party. Liability becomes a question of product design rather than a theoretical residual risk.
OLG Hamm: The chatbot is part of your company
The most important ruling for companies comes from Hamm, not Munich. The Consumer Advice Centre of North Rhine-Westphalia sued a clinic operator whose website chatbot gave the doctors invented specialist titles such as "specialist in aesthetic medicine", titles that the medical associations' training rules do not recognise. The court treated this as a misleading commercial act under the German Act Against Unfair Competition.
The court's central point: a chatbot that acts on behalf of and in the appearance of a company is "not a third party within the meaning of the law". Its statements are attributed to the company. Careful configuration does not change this, because even an operator who feeds the model only accurate information bears the risk of unforeseen hallucinations. Using a chatbot does not, in principle, alter the company's responsibility.
Why this goes beyond the single case: it is the first published German higher-court decision on chatbot liability. The court expressly allowed an appeal to the Federal Court of Justice, because core questions of liability for AI-generated content need to be settled. The line could still be confirmed or refined, yet the signal to operators is already unambiguous.
Munich court: Google's AI answers are its own statements
The case that drew the most attention involved Google. Its AI Overviews had linked two Munich publishers to "scams, subscription traps and dubious business practices" and mixed them up with genuinely shady companies, even though that connection appeared in none of the linked sources. The Munich Regional Court barred this by preliminary injunction and classified Google as a direct infringer.
The AI overview summarises in its own words and structure and makes independent, new and substantive statements that do not appear in the search results.
Paraphrased reasoning of the Munich Regional Court, case 26 O 869/26The court rejected the argument that users could check the information themselves. Only Google has influence over the AI offering and the algorithms, so Google is liable itself. Google bears 80 percent of the legal costs and will most likely appeal. An analysis for the New York Times found that Google's AI Overviews answer correctly in 91 percent of cases, which at this scale still means millions of false answers per hour. The way AI answers pull traffic away from linked sources is something innobu has examined in its piece on the AI traffic shift and search .
Why the host-provider excuse no longer works
Classic platforms long enjoyed a liability privilege. Anyone who merely displays third-party content is liable only if they fail to act after a notice, the so-called notice-and-takedown procedure. This privilege from the Digital Services Act and the older Telemedia Act no longer applies to AI output, because the AI does not reproduce third-party content but creates a new statement.
With an AI answer there is no third party whose content could be blocked. The statement arises within your own system. Liability therefore shifts from indirect, the interferer liability after a notice, to direct, the operator's own responsibility for the statement. For companies this leads to a simple but uncomfortable conclusion: they cannot hide behind the technology.
The EU liability vacuum
A European rule was meant to harmonise AI liability. That rule no longer exists. The AI Liability Directive was proposed in 2022, halted in the European Commission's work programme in early 2025 and officially withdrawn in October 2025. National law remains, and German courts are now giving it shape.
AI Liability Directive proposed
The European Commission proposes a dedicated directive for civil liability in AI-related harm, alongside the reform of product liability.
Product Liability Directive adopted
The revised Product Liability Directive enters into force and covers software and AI as a product, but targets consumer harm.
AI Liability Directive withdrawn
Lacking agreement, the Commission halts the project in early 2025 and ends it officially in October. A harmonised EU liability law for AI has been missing since.
German courts fill the gap
The OLG Hamm and the Munich Regional Court apply national law, mainly the UWG, and attribute AI statements to the operator.
Without an EU-wide rule, the legal situation can differ between member states. In Germany the UWG, general personality rights and Section 824 of the Civil Code apply. The EU AI Act governs obligations and risk classes in parallel, but does not answer who pays for a specific harm. For how the AI Act's deadlines and duties fit together, see the piece on the EU AI Act high-risk deadlines .
How big the risk really is
Hallucinations are not a fringe issue, they are measurably common. That is what makes the liability question practical, because the error rate is not zero and cannot be fully trained away. The following figures show the scale across different applications.
How often an AI gets it wrong depends heavily on the domain. For narrow facts the rate is low, but for complex specialist and legal questions it rises sharply.
Even a low rate becomes a problem at high volume, and a high rate on sensitive topics is one anyway. For how hallucinations play out in a regulated sector, see the analysis of the AI hallucination test in finance .
Challenges and limits of the rulings
The decisions are a clear signal, but not the final word. Both were issued at early instances, the Munich case as a preliminary injunction and the Hamm case with an appeal to the Federal Court of Justice allowed. Higher courts can still correct the line.
Beware of two false conclusions: ignoring the rulings because they are not yet final underestimates the risk, since even a preliminary injunction with a penalty can be costly. Blocking every AI answer out of fear of liability throws away the benefit. Neither extreme is a strategy, what is needed is a controlled middle path.
What companies should do now
Anyone running AI with customer contact should treat liability as a design question, not a residual risk. The courts call for technical and organisational measures that actually control the accuracy and admissibility of the output. Five steps help you be prepared.
-
Set guardrails for sensitive statements
Make sure the chatbot does not freely phrase sensitive claims about qualifications, prices, legal matters or third parties. Topic filters and fixed answers reduce the risk at the source.
-
Build in human oversight
Do not rely on clean training data alone. Add escalation to humans and review the output with regular spot checks.
-
Log and monitor outputs
Record what the AI answers. Only then can errors be proven, corrected and documented in a dispute.
-
Respond quickly to complaints
In the Hamm case, switching off the chatbot without issuing a formal cease-and-desist declaration did not help. Set a clear process for notices and warnings.
-
Clarify responsibilities and contracts
Define who reviews the AI output and who is liable internally. Settle contractually with the AI vendor who answers for errors.
AI liability in 2026 is no longer a niche topic for lawyers, it is part of any serious product development. Setting guardrails, controlling outputs and handling complaints in a defined way reduces your risk markedly without slowing down AI use. For how AI security and data protection connect in practice, see the piece on AI security and data protection .
Further reading
Frequently asked questions
Yes. Under the OLG Hamm ruling of 12 May 2026 (case 4 UKl 3/25), a chatbot on your own website is legally part of your business organisation, not a separate third party. Its false statements are attributed to the company. Even careful configuration does not relieve you, because the operator bears the risk of unforeseen hallucinations.
On 12 May 2026 the Higher Regional Court of Hamm ruled against a clinic operator because its website chatbot spread invented medical specialist titles. The case was brought by the Consumer Advice Centre of North Rhine-Westphalia. The court treated this as a misleading commercial act under the German Act Against Unfair Competition (UWG) and allowed an appeal to the Federal Court of Justice. It is the first published German higher-court decision on chatbot liability.
On 28 May 2026 the Munich Regional Court (case 26 O 869/26) issued a preliminary injunction barring Google from spreading false statements about two publishers in its AI Overviews. The court classified Google as a direct infringer because the AI overview makes an independent, new statement rather than merely displaying third-party search results. Google bears 80 percent of the legal costs.
No. The planned EU AI Liability Directive was halted in early 2025 and officially withdrawn in October 2025. There is no harmonised EU liability law for AI. National law applies, in Germany primarily the UWG, general personality rights and Section 824 of the Civil Code. The revised Product Liability Directive does cover software and AI but targets consumer harm.
Treat liability as a design question. Useful steps are topic filters and guardrails for sensitive statements, human escalation and spot checks instead of blind trust in clean training data, logging and monitoring of outputs, a fast process for complaints including cease-and-desist declarations, and clear internal responsibilities and contractual terms with the AI vendor.