Brand, trust, and AI: Governing commerce in the agentic era

In 2022, a grieving traveler asked Air Canada's website chatbot about its bereavement fares. The bot told him that he could book now and claim the discount later.

However, that policy didn't exist. When Air Canada refused the refund, the traveler took it to a tribunal, and in early 2024 the airline was held liable for what its chatbot had told him.

Air Canada's defense statement is the part worth remembering. It argued that the chatbot was a separate entity responsible for its own words. The tribunal rejected that argument outright, ruling that Air Canada is responsible for all information on its website, whether it comes from a static webpage or an AI-powered chatbot.

^{(Air Canada is a trademark of its respective owner. This article references publicly reported events for commentary and educational purposes only and does not imply any affiliation or endorsement.)}

This case is a small preview of a far bigger problem that surrounds the agentic era today. With AI moving from answering questions to taking actions on your brand's behalf, an important question comes up: Who is accountable for what it does, and what happens to the trust your brand spent years building?

The shift from generating responses to taking action

For the last few years, the risk AI could cause a brand was mostly just words. An AI chatbot might misinterpret a customer's question or an AI-generated marketing email might use the wrong tone. While it was embarrassing and sometimes costly, the damages were still usually recoverable.

Now, the agentic era has opened up new possibilities, and entirely new risks. AI is now being given the ability not just to say things but to perform actions, like placing an order, issuing a refund, booking a trip, and picking a product.

McKinsey frames the shift, stating that organizations can no longer worry only about AI saying the wrong thing, but also about AI taking unintended actions, misusing tools, or operating outside its intended boundaries.

“The question shifts from ‘Is the model accurate?’ to ‘Who’s accountable when the system acts?’” — Rich Isenberg, from The McKinsey Podcast episode, Trust in the age of agents

Agentic AI is borrowing the brand trust you've built

To be honest, people do not really trust AI to begin with. A global study by the University of Melbourne revealed that less than 46% of users are willing to trust AI systems, and have consistently expressed their low level of trust across various AI applications, including generative AI tools like ChatGPT.

When your brand puts an AI between itself and a customer, you are asking that customer to extend the trust they have with your brand to an AI system wearing your logo.

The difficult reality is that accurate, helpful interactions do not earn more trust, but every wrong answer can completely break it. This is especially important in ecommerce, where you rarely see a customer face-to-face, and trust has to be built across all digital touchpoints.

Your business remains accountable for every AI action

You cannot treat your own AI as a third-party tool that absolves you of responsibility. If it speaks and acts for your brand, its words are your words and its actions are your actions.

A recent report says that 80% of organizations say they have observed risky behavior from AI agents, from taking unintended actions to operating outside their guardrails.

When one of those actions causes real harm, like an unauthorized discount or a mishandled refund, the accountability should stay with the brand. This is not only morally right, but it a legal obligation as well.

In the United States, Europe, India, and many other jurisdictions, consumer protection laws strictly state that businesses are liable for the actions of the AI systems they deploy.

Governing commerce in the agentic era

Governance in the agentic commerce era includes thoughtfully deciding how AI is allowed to represent and act for you, and being able to stand behind the result. Here are a few principles to help you.

Define what your AI agents can do in your name. This covers what it can resolve, spend, promise, or recommend on its own, and where it must stop and hand off to a person.

It is important that you carefully define essential guardrails so everything is anchored to your real data, prices, and rules.

Be transparent that a customer is dealing with AI. Unlike what most business owners think, disclosing that a customer is dealing with AI is not a weakness, but adds to the trust they have in your brand.

Do it right by the books and your heart. While conversions matter, protect your customers by defining how your AI agents collect, use, store, and share personal data. Make privacy, transparency, and consent non-negotiable.

How to govern AI in ecommerce

Here are some operational practices that business owners can implement to govern AI in ecommerce.

Create escalation paths for high-risk decisions

Not every decision should be autonomous. Define situations where AI must immediately hand over the chat to a human, such as:

• Orders above a certain value

• Refunds beyond a threshold

• Legal or warranty disputes

• Angry or vulnerable customers

• Requests involving sensitive personal information

This keeps AI from making expensive or reputation-damaging decisions.

Keep detailed AI decision logs

Every action your AI takes should be traceable. Record everything from what information the AI received, which tools or systems it accessed, what decision it made, and why it made that decision. If a customer disputes an action, you need to have an audit trail instead of guessing what happened.

Regularly test your AI with edge cases

Challenge your AI with scenarios like:

• Expired coupon codes

• Out-of-stock items

• Duplicate refunds

• Contradictory customer requests

• Fraud attempts

• Ambiguous product questions

Continuously monitor AI performance

Track metrics like incorrect actions, human intervention rate, customer complaints involving AI, refund reversals, failed transactions, and customer satisfaction after AI interactions.

Assign clear ownership

Someone inside the company should own AI governance. That person or team should be responsible for reviewing incidents, updating guardrails, approving new AI capabilities, ensuring compliance, and measuring business impact.

Build a rollback mechanism

If an AI agent starts behaving unexpectedly after an update, you should be able to disable specific actions, revert to a previous version, and route customers back to human support to control its impact immediately.

Run periodic policy reviews

Your AI should reflect your latest business policies, so whenever you update return policies, shipping rules, pricing, promotions, or compliance requirements, review your AI to ensure it follows the new rules consistently.

Prepare an AI incident response plan

Mistakes are inevitable, but decide beforehand what happens when those mistakes occur. Clearly define:

• Who investigates AI incidents

• How customers are notified

• When compensation is offered

• How the issue is prevented from recurring

The speed and transparency of your response often matter as much as the mistake itself.

Closing thoughts

You may never be able to control every decision your AI agents make, but you can govern how they operate.

As AI becomes a standard part of every business, technology alone will not be able to set brands apart. Trust will. Customers will remember how responsibly your AI acted, how transparently you handled mistakes, and how well you protected their interests.

That's why, in this agentic era, the brands that stand out won't just have the smartest AI, they'll be the ones that govern it with accountability and earn trust through every interaction.