Who is responsible if an AI tool gives staff the wrong answer?

11 September 2026

The short answer: responsibility stays with the business

If an AI tool gives a staff member the wrong answer, the responsible party is usually the business that allowed, approved or failed to control how that tool was used. That does not mean the employee is never accountable for careless behaviour, or that the vendor has no responsibility. It means the business cannot say, "the AI told us to do it" and expect customers, regulators, insurers or a court to accept that as a serious answer.

The reason is simple. AI is not an employee, a director or a regulated professional. It does not owe your customer a duty of care in the way your business does. It does not understand your commercial promises, your risk appetite, your customer history, your contracts, your professional obligations or the limits of your staff's authority. If a member of staff sends a wrong price, gives poor advice, discloses personal data, approves the wrong refund, rejects a customer complaint or makes an HR decision because an AI answer sounded confident, the business still has to deal with the consequence.

The UK Information Commissioner's Office is very clear that organisations using AI need governance, responsibility and evidence. Its AI audit framework says senior management should sign off AI risks, appoint a nominated data protection lead or DPO where appropriate, assign technical and operational roles, and support policies with operational procedures for staff using AI systems. The ICO also links weak AI governance to UK GDPR accountability risks where staff do not understand their responsibilities.

That is the key lesson for a small business: the risk is not just the wrong answer. The risk is an unmanaged wrong answer, used by someone who did not know when to check, who to ask, or whether the tool was allowed for that purpose.

How responsibility breaks down in practice

There are usually four parties in the chain: the employee, the manager, the business owner or leadership team, and the AI supplier. Each has a different kind of responsibility.

For most UK SMEs, the biggest gap is not supplier liability. It is internal ownership. A staff member starts using an AI feature inside Microsoft 365, Google Workspace, Canva, a CRM, an accounting tool or a customer service platform. Nobody writes down the permitted uses. Nobody decides what must be reviewed. Nobody tells staff whether client files, financial data or HR information can be pasted in. Then the first mistake arrives and everyone asks whose fault it was.

A better setup is boring and clear. The owner or operations lead owns the policy. Managers own team adoption. Staff own following the rules. Someone with data protection responsibility reviews personal-data use. External advisers or technical suppliers help with configuration, contracts and controls. That is enough for many SMEs. You do not need an enterprise governance board for every small use case, but you do need named accountability before the mistake happens.

What UK guidance says about accountability

UK guidance is not telling small businesses to stop using AI. It is telling them to keep humans accountable, document the use and manage risk in proportion to the impact.

The Office for National Statistics reported in July 2026 that self-reported AI use among UK businesses with 10 or more employees had increased from around 12% in late 2023 to around 35% by June 2026. It also found that large language models were the most widely used AI technology in June 2026, used by 18% of businesses with 10 or more employees. In other words, staff use of AI is no longer theoretical. It is already inside normal business operations.

The ICO's guidance on explaining AI-assisted decisions says organisations should be transparent and accountable. Accountability means taking responsibility for complying with data protection principles and being able to demonstrate that compliance. The same guidance says organisations should identify who manages and oversees explainability requirements and make sure there is a capable human point of contact for people who want to query or contest a decision.

The UK Government AI Knowledge Hub says AI governance should provide oversight, accountability and strategic guidance. It also recommends an AI systems inventory that records each system's purpose, usage, risks, data elements, ownership and key dates. For a small business, that can be a simple spreadsheet. The important point is not the format. The important point is that someone can answer: what AI are we using, what does it touch, who owns it, what could go wrong and how do we check it?

If your AI use touches personal data, customer outcomes, staff management or regulated decisions, this moves beyond productivity. It becomes a governance issue. That does not mean you need legal advice for every prompt. It does mean you need thresholds for when a human review is mandatory.

What counts as a high-risk wrong answer?

Not every AI mistake needs the same response. A poor internal meeting summary is annoying. A wrong answer that affects a customer, employee, supplier, patient, tenant, applicant or financial record can become serious very quickly.

For a small business, high-risk AI outputs usually fall into seven groups. First, anything involving personal data, especially sensitive data, client files, employee records or customer complaints. Second, advice that a customer may rely on, including financial, legal, medical, technical, safety or professional advice. Third, employment decisions such as hiring, promotion, performance management, redundancy or disciplinary action. Fourth, financial approvals, credit control, pricing, refunds, payroll or supplier payments. Fifth, contractual promises, policy interpretations or service commitments. Sixth, public claims in marketing, tenders or proposals. Seventh, operational decisions where a wrong answer could cause missed appointments, poor safeguarding, unsafe work or serious service failure.

The rule should be simple: the more the AI output affects another person, the more human review you need. If the output only helps a staff member think, draft or organise, normal judgement may be enough. If the output becomes a decision, instruction, customer answer, record update or approval, someone needs to check it.

This is where businesses often go wrong. They write a policy saying "check AI outputs" but do not define what checking means. A useful policy says who checks what. For example, routine marketing drafts can be reviewed by the person posting them. Customer complaint replies need manager review. HR, legal, finance and regulated advice need a qualified person. AI-generated changes to CRM, accounts or project systems need an audit trail and a way to reverse mistakes.

What should you put in place before staff rely on AI?

The minimum sensible setup is an AI usage policy, an AI register and a review matrix. This does not have to be heavy. A two-page policy and a spreadsheet are better than a 40-page document nobody reads.

Your AI usage policy should answer six questions. Which tools are approved? What data is banned? What uses are allowed? What uses need manager approval? What outputs must be checked before use? What should staff do if something goes wrong? For most SMEs, the banned-data list should include passwords, private keys, confidential client files unless explicitly approved, special category personal data unless there is a lawful and controlled process, commercially sensitive contracts, payroll data and anything covered by a client confidentiality obligation.

Your AI register should list the tool, owner, purpose, data used, users, supplier, monthly cost, risk level, review date and fallback plan. The register matters because AI use spreads quietly. A team starts with ChatGPT. Then Copilot appears in Microsoft 365. Then the CRM adds AI call summaries. Then the accounts package suggests coding rules. Without a register, nobody sees the full picture.

Your review matrix should be even simpler. Low-risk outputs can be checked by the user. Medium-risk outputs need manager or subject-matter review. High-risk outputs need a qualified person and evidence. Prohibited uses are not allowed until the business has taken specific advice and designed controls.

Expect to spend £500 to £2,000 putting basic policy, training and register work in place for a small team if you do it with external help. A deeper governance setup for regulated, multi-site or data-heavy businesses can cost £3,000 to £10,000 or more. That may sound dull compared with buying another AI tool, but it is far cheaper than cleaning up a preventable mistake.

When this is NOT right for you

A formal AI accountability process is probably too much if your business is experimenting with low-risk personal productivity only, such as brainstorming headings, rewriting internal notes or summarising public information. In that case, start with three simple rules: do not paste confidential data, do not rely on AI for final decisions and check facts before sharing anything.

It is also not right to create governance theatre. A small business does not need a committee for every AI use. If you turn AI policy into paperwork nobody understands, staff will go back to using tools quietly. The point is not to impress a regulator with complexity. The point is to make good behaviour easy.

But doing nothing is not a serious option once AI affects customers, staff, money, compliance or operational commitments. If a wrong answer could cost someone money, deny them a service, expose private data, damage a relationship or create a contractual problem, the business needs a named human owner and a review rule.

The honest test is this: if the AI answer was wrong and a customer asked how it happened, could you explain your process without sounding careless? If the answer is no, fix the process before the tool becomes normal business practice.

Is This Right For You?

This applies if your staff already use ChatGPT, Copilot, Gemini or AI features inside everyday business tools, especially where outputs influence customers, finance, HR, contracts, marketing claims, operational scheduling or client advice.

It may not be the right priority if your team only uses AI for low-risk drafting, brainstorming or internal summaries that never leave the business without normal human editing. Even then, you still need basic rules, because low-risk use can become high-risk quickly when people get comfortable.

If you want a simple starting point, treat AI like a junior assistant with unusual speed and uneven judgement. It can help. It cannot be the accountable person.

Frequently Asked Questions

Can I blame the AI vendor if the tool gives a wrong answer?

Sometimes you may have a contractual claim if the supplier failed to provide the service, security or commitments it promised. But that does not remove your responsibility to customers, staff or regulators for how your business used the output.

Is an employee personally responsible for using a bad AI answer?

An employee can be responsible for ignoring clear rules, acting carelessly or using a tool for a banned purpose. But if the business has no policy, training, approved-tool list or review process, the bigger accountability problem sits with management.

Do we need a human to check every AI output?

No. Low-risk drafting and internal productivity tasks do not need heavy sign-off. You need human review when the output affects customers, staff, money, legal obligations, personal data, operational commitments or public claims.

What should our AI policy say about wrong answers?

It should say which uses are allowed, which are banned, what must be checked, who signs off higher-risk outputs, how staff report mistakes and what manual fallback applies if an AI workflow fails.

Does UK GDPR apply if staff use AI at work?

Yes, if personal data is involved. The business must still comply with UK GDPR principles, including fairness, transparency, security and accountability. AI does not remove those duties.

Should AI-generated customer replies be sent automatically?

Only for low-risk, tightly controlled responses where the source knowledge is approved and there is clear monitoring. Complaints, refunds, sensitive situations, advice and unusual cases should go to a person before anything is sent.

What is the simplest way to reduce AI accountability risk?

Create a one-page approved-use policy, keep an AI register and define three review levels: user check, manager check and qualified-person sign-off. That covers most SME risk better than vague advice to "use AI responsibly".