Banks face liability over use of AI chatbots, report finds

• 

• Key insight: When banks use AI chatbots to provide customer support on decisions about mortgages and loans, they can risk violating consumer-protection laws.
• Supporting data: Corporations remain liable when chatbots give wrong answers, create endless doom loops, or fail to solve problems, former regulators argue in  a new report. 

Banks that use AI agents for customer service may be breaking consumer-protection laws if the technology makes decisions impacting a customer's finances or blocks a consumer from getting help, according to a new report by former regulators.

Processing Content

"If something is illegal or unlawful, the fact that a chatbot does it isn't a shield from liability," said Adam Teitelbaum, a former director of consumer protection at the Office of the Attorney General for the District of Columbia, and a co-author of the study.

Teitelbaum and his co-author, Stephanie Nguyen, a former chief technologist at the Federal Trade Commission, are pressing for more enforcement at the state level amid the Trump administration's retreat from enforcing consumer-protection laws.

"Given the scale and speed of how these technologies are being deployed, what's happening is we're seeing in real time how people are being impacted like guinea pigs in an experiment," Nguyen said.

Using consumers as a testbed for unproven AI systems has created a massive, systemic breakdown, Nguyen argued. When companies deploy AI chatbots as intermediaries, they are responsible for every false answer, dead end, roadblock and broken promise, she added. 

The study identifies false information as one of three areas in which misconduct by chatbots could trigger state bans for unfair and deceptive practices.  Those agents have shown repeatedly they can "hallucinate" and go rogue, routinely providing false or misleading information. 

AI chatbots also can obstruct consumers' access to a live human being, and they may provide an inadequate service that fails to solve a customer's problem. In addition to enforcement actions at the state level, individual consumers harmed by chatbot failures can pursue lawsuits under state consumer-protection statutes.

"AI chatbot" is a general term used by the study's co-authors to encompass everything from automated voice assistance to AI-enabled help to any automated chatbot on websites, apps and search engines.

Amid the rapid spread of this technology, financial institutions and vendors to banks and fintechs are actively seeking to manage their downside risks. But banks and fintechs face a delicate balancing act in managing AI compliance while staying competitive. Some financial firms are seeking guidance from regulators because operating without regulatory standards creates legal risks, experts say.

"If you're doing something to manage your risk, and you think that's right, but a competitor is willing to take more risk, that can yield outcomes that put [a company] at a financial disadvantage," said Benjamin Saul, a partner at the law firm Steptoe.

Banks are quick to differentiate between agentic AI and AI chatbots that are based on machine-learning and are widely used in banking. Small, midsize and regional banks have largely been cautious about using agentic AI at scale in customer service because of the need for ongoing oversight.

At large banks, however, AI chatbots increasingly rely on both machine learning and agentic AI to handle complex work with minimal human involvement. For example, Bank of America's virtual assistant Erica, which has handled more than 3.2 million customer interactions, is a hybrid system that is built on machine-learning but has evolved to perform agentic AI functions, experts said.

"Corporations cannot hide behind AI to dodge accountability," said Teitelbaum, who is currently a senior fellow at the nonprofit Protect Borrowers. He and Nguyen are urging policymakers to mandate that companies give customers the option of immediately connecting to a human being in a single click.

At the state level, the Conference of State Bank Supervisors released an AI supervisory framework last month that provides specific instructions for examiners to evaluate financial institutions. State officials have subpoena authority to audit internal AI model code as well as examine complaint logs to enforce existing consumer-protection statutes. 

"State attorneys general are on the front lines," said Teitelbaum. "They already have the investigative tools to look under the hood of these systems — and the authority to hold companies accountable when their chatbots fail."

Read more:

• Inflation likely to spark more rate hikes: Boston Fed's Collins
• Why Citi remains cautious on key profitability metric
• Goldman's Solomon wants 'clear human accountability' on AI
• BofA says it's ready to 'move forward' after $1.21B penalty

As for federal oversight, the Office of the Comptroller of the Currency, the Federal Reserve and the Federal Deposit Insurance Corp., expressly excluded agentic AI from interagency model risk management guidance that was revised in April. However, the prudential regulators still expect banks to maintain strong compliance and risk-management programs when using AI, experts said.

The Consumer Financial Protection Bureau has largely halted enforcement under the Trump administration. It has issued past guidance requiring a bank or creditor that uses machine learning or complex AI algorithms to provide a specific reason to an applicant who was denied credit. 

Customer service has been a compliance focal point for many years. Historically, companies have used what the industry calls "phone tree loops" and moved workers offshore to cut costs.

"This is just the next evolution of the customer-service function," said Teitelbaum. "Providing a service that you've promised customers can sometimes be expensive, and it can sometimes save your bottom line by keeping people from being able to cancel a service quickly because a lot of people are just going to give up."