Can companies escape chatbot liability through careful training?

Germany's Higher Regional Court of Hamm (OLG Hamm, Judgment of May 12, 2026 – I-4 UKl 3/25) ordered a cosmetic surgery clinic to cease and desist after its website chatbot told a user that the clinic's two managing directors were "specialists in plastic and aesthetic surgery" and "specialists in aesthetic medicine" — titles neither doctor actually held. The clinic had shut the chatbot down but refused to issue a cease-and-desist declaration, so the court ruled on the merits: the chatbot's incorrect responses were "misleading commercial acts by the company itself" under Section 5(1) and (2)(3) of the German Unfair Competition Act (UWG).

The court's reasoning rests on two points the summary calls out explicitly. First, "the chatbot is not to be regarded as a 'third party' within the meaning of competition law" — it is part of the company's business organization, so its statements are attributed to the operator directly, not treated as an independent actor's speech. Second, and more consequential, "even correct programming does not preclude liability": the summary notes that the ruling applies even if the chatbot were trained exclusively on accurate data sets, the company would still answer for a false output. The Swiss law firm's gloss is the old doctrine applied to a new tool: cura in eligendo, instruendo, custodiendo — the company must carefully select, instruct, and supervise the AI it deploys, just as it would an employee or contractor.

This cuts in the opposite direction from Does the UN panel misframe the OpenAI breach as alignment?, where the UN panel's brief recast a corporate security failure as a technical alignment problem, sidelining the deploying organization's liability. OLG Hamm does the reverse: it refuses to let training quality or technical correctness function as a defense, and keeps responsibility squarely on the company that put the chatbot on its site. It also sharpens Can three-tier AI oversight actually prevent deployed system harms?, whose company-side duty was pre-deployment testing — this ruling extends that duty into the post-deployment output itself, under ordinary national competition law rather than the AI Act. The liability pattern also differs from Do small law firms misuse AI more often than large ones?, where the exposed party was the practitioner who submitted AI output into a legal filing; here it is the company that deployed the chatbot to the public, with no intermediary human reviewing each answer before a customer saw it.

The excerpt establishes a national unfair-competition holding, not a general theory of AI liability: the ruling is "not yet final," and the Senate granted leave to appeal to the Federal Court of Justice precisely because of "the particular significance of the issues regarding the attribution of false statements made by chatbots." The extensions to GDPR, the AI Act's Article 50 disclosure duty, e-commerce law, and personality/trademark rights are the law firm's forward-looking commentary, not holdings the court reached. What the ruling does establish, at least for German (and the firm argues, likely Swiss) unfair-competition law, is that accurate training data is not a liability shield — which implies companies deploying customer-facing chatbots need output-level monitoring (filters, guardrails, escalation, spot checks) rather than relying on input-side quality control alone.