AI in customer service for banks: chatbots, consumer law and the Air Canada case

In June 2023 the Consumer Financial Protection Bureau (CFPB) published an issue spotlight on chatbots in consumer finance. It found that "each of the top 10 largest commercial banks have deployed chatbots as a component of their customer service" [1]. A chatbot is software that answers customers in written or spoken conversation. The CFPB cited an outside estimate from Insider Intelligence that more than 98 million people in the United States used a bank's chatbot in 2022, projected to reach 110.9 million by 2026 [1]. The report also cites Bank of America's own figures for its assistant Erica: more than 1 billion interactions [1].

This page covers the rules for a bank that uses AI to talk to customers, as of 26 October 2026. It is part of the guide on AI in banking. The CFPB report is an issue spotlight, a type of research report, the Air Canada case is a tribunal decision in Canada, and the EU AI Act is law. A bank should confirm with its own counsel how each applies to it.

The CFPB's chatbot report and its status

The report's main point is: "Like the processes they replace, chatbots must comply with all applicable federal consumer financial laws" [1]. The report says it "is not intended to impose any obligations or define any rights" [1]. So the obligations come from the existing laws, and the report shows where chatbots can break them.

The CFPB withdrew 67 guidance documents on 12 May 2025, by this guide's count [2]. The chatbot report is not on that list: this guide found no entry in the withdrawal notice that names chatbots [2]. An Internet Archive copy of the CFPB's page, taken on 16 October 2026, still shows the report. The CFPB's live site refused automated requests when this guide checked.

The harms the CFPB found

The CFPB lists the harms customers reported, "including wasted time, feeling stuck and frustrated, receiving inaccurate information, and paying more in junk fees" [1]. Three of them affect how a bank designs a chatbot.

Disputes. "the ability for chatbots and scripts to recognize a dispute may be limited" [1]. Reveneau's view is that a chatbot should pass every dispute to a person, and that this is one of the first behaviours to test.

No way to reach a person. Customers "filed complaints with the CFPB about getting stuck" in loops with chatbots that never reach a human [1].

Privacy and security. "Chatbots can also raise certain privacy and security risks" [1]. The report has a section on "Security risks posed by impersonation and phishing" [1]. Phishing is a message that pretends to come from a trusted company to trick a person into giving up passwords or money.

Risk the CFPB names [1]	What can go wrong	A control to test
Inaccurate information	The chatbot states a fee, rate or policy that is wrong	Eval cases built from the bank's own fee schedules and policies
Disputes not recognised	A dispute is treated as a general question, and its deadline can pass	Eval cases written as disputes in many forms, checked for hand-off
No route to a person	The customer cannot leave the chatbot	A tested hand-off on request and after failed answers
Junk fees	The customer pays a fee that a correct answer would have avoided	Cases on fee waivers and fee triggers
Impersonation and phishing	Criminals copy the chatbot to collect customer data	Clear channels and customer warnings, reviewed by security staff

The Air Canada chatbot case

Moffatt v. Air Canada is a decision of the Civil Resolution Tribunal of British Columbia, a small claims tribunal, dated 14 February 2024 [3]. The case is about an airline and comes from one Canadian province, and it shows how one decision-maker treated a company's chatbot.

The airline's website chatbot told a customer that a bereavement fare could be claimed after travel: "The chatbot suggested Mr. Moffatt could apply for bereavement fares retroactively" [3]. The airline's own policy said otherwise. Air Canada argued it could not be held liable for information its chatbot provided. The tribunal rejected that: "It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot" [3]. It added that Air Canada did not explain "why customers should have to double-check information found in one part of its website on another part of its website" [3].

The tribunal found negligent misrepresentation: "I find Air Canada did not take reasonable care to ensure its chatbot was accurate" [3]. Negligent misrepresentation means a false statement made without reasonable care, which the other person relied on. It ordered Air Canada "to pay Mr. Moffatt a total of $812.02" [3], in Canadian dollars, including $650.88 in damages. A bank should plan for the tribunal's finding that a company is responsible for what its chatbot says. The post what the Air Canada chatbot ruling means for a company with an AI assistant covers the ruling in more detail.

The EU and the UK

In the EU, Article 50(1) of the AI Act says "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system" [4]. Article 50 falls under the Act's general date of application, 2 August 2026 [4]. A bank that buys its chatbot is a deployer, and should confirm that the system it buys meets this duty and that its own screens and messages do not hide it. The page the EU AI Act for banks covers the rest of the Act.

In the UK, the Financial Conduct Authority (FCA) points firms that use AI to the Consumer Duty, including the outcome: "Provide support that meets the needs of customers" [5]. The Bank of England and FCA survey of 2024 found that "an additional 36% of respondents expect to use AI for customer support (including chatbots)" within three years [6].

How banks use generative AI in customer service so far

Generative AI is AI that writes text, images or code, and a chatbot built on it can write answers that no one wrote in advance. That makes it more flexible than a scripted chatbot, and harder to check. The US Treasury reported in December 2024 that respondents to its request for information described generative AI as "leading firms to be cautious about deploying them broadly in customer-facing applications" [7]. The Office of the Comptroller of the Currency (OCC) wrote in spring 2026 that bank use of generative AI is "generally limited to specific use cases with guardrails and human-in-the-loop accountability to manage risk" [8]: limited tasks, set limits on what the system may do, and a person who answers for the result.

Voice channels add a separate risk. The Financial Crimes Enforcement Network (FinCEN) warns that "scammers may use deepfake voices or videos to impersonate a victim's family member, friend, or other trusted individual" [9]. A deepfake is a recording made or changed with AI to look or sound real. A bank that lets customers act by voice should test its identity checks against that risk. The page AI for fraud and financial crime covers FinCEN's alert.

How to test a bank chatbot before release

Reveneau's view is that a bank chatbot should pass a written set of tests before every release, and that the tests should come from the bank's own documents. An eval is a written, repeatable test of an AI system's answers against cases the bank chooses. For a chatbot, the eval set should include:

1. Questions about each fee, rate and policy, with the correct answer taken from the bank's current documents.
2. Disputes and complaints, written in many different ways, where the correct result is a hand-off to the right team.
3. Requests to speak to a person, and repeated failed answers, where the correct result is a hand-off.
4. Questions the chatbot must not answer, such as advice it is not allowed to give, where the correct result is a refusal and a referral.
5. Attempts to get one customer's data while talking as another person.

Run the set again whenever the model, the instructions or the bank's policies change, and keep each run's results with its date. The Air Canada tribunal found that the airline "did not take reasonable care to ensure its chatbot was accurate" [3]. A dated test record is one way a bank can show the care it took. The guide on LLM evals explains the method, and how to build an LLM eval dataset covers the cases. For the customer data the chatbot reads and stores, see customer data privacy and AI in banking.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau.