Imagine discovering that your company’s AI chatbot has been giving customers inaccurate information about your products, services or professional qualifications. Your IT team explains that the system was trained on correct information and generated the misleading statements independently. Would that explanation protect your business from legal responsibility?
A recent German court ruling provides an important answer.
When AI Hallucinations Become a Legal Problem
On 12 May 2026, the Higher Regional Court of Hamm (Oberlandesgericht Hamm) delivered its judgment in Verbraucherzentrale Nordrhein-Westfalen e.V. v. Aesthetify GmbH (Case No. I-4 UKl 3/25). The case concerned a German aesthetic medicine company whose website featured an AI-powered chatbot designed to answer patients’ questions and facilitate appointment bookings.
On 3 April 2025, the chatbot incorrectly told visitors that two of the company’s managing directors, both physicians, held specialist qualifications in plastic and aesthetic surgery. It also described them using specialist titles that do not exist under Germany’s medical qualification system. Neither physician had completed the specialist training required for the relevant recognised title.
The statements mattered because medical qualifications can significantly influence patients’ decisions when choosing healthcare providers. Following a warning issued on 10 April 2025, the North Rhine-Westphalia Consumer Advice Centre brought legal proceedings against Aesthetify GmbH under Germany’s Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb, particularly Sections 3 and 5).
What the German Court Actually Decided
The company argued that the chatbot operated autonomously and had been trained using accurate information from its website. It maintained that individual responses could not be directly controlled or attributed to human decisions. After receiving the complaint, the company disabled the chatbot and introduced technical safeguards, including instructions and keyword filtering, to prevent the misleading statements from recurring.
The court nevertheless ruled against Aesthetify GmbH. It considered the chatbot’s responses misleading commercial practices attributable to the company operating the system. The judges emphasised that deploying the chatbot was itself a deliberate business decision and that the company retained sufficient influence over its operation. The fact that the company subsequently introduced effective safeguards also demonstrated that preventive measures had been technically possible.
The court granted an injunction prohibiting the misleading claims and ordered reimbursement of €260 in warning costs, plus interest. Importantly, this was not a judgment awarding compensation to patients for injuries caused by AI. It concerned misleading commercial communications under German consumer protection and competition law. The court initially permitted an appeal, while the Consumer Advice Centre subsequently reported that the judgment had become final.
Why This Matters Far Beyond Healthcare
For businesses, the implications extend well beyond the healthcare sector. Imagine a bank chatbot providing incorrect information about loan conditions, an e-commerce assistant inventing warranty terms or an AI recruitment tool misrepresenting employment requirements. Each situation would require its own legal assessment, but the central governance concern is similar: deploying AI does not necessarily distance an organisation from the consequences of information communicated through its systems.
This ruling also illustrates why AI governance cannot be limited to vendor contracts or general disclaimers. Organisations should identify information that carries legal or commercial significance, test chatbot responses against realistic customer questions, establish restrictions on unsupported claims and maintain procedures for monitoring and correcting inaccurate outputs. Supplier arrangements should address testing, incident cooperation, responsibility allocation and access to evidence, while recognising that contractual provisions do not necessarily eliminate obligations owed to consumers.
On 21 October 2026, the International Association of Privacy Professionals published an analysis examining four AI hallucination cases across Germany, China and the United States. Although the outcomes differed, the cases highlight the increasing importance of understanding how responsibility, reasonable safeguards and legally recognised harm interact when AI produces inaccurate information.
The Real Business Risk Is Losing Control of What AI Communicates
The German decision illustrates a particularly important distinction: a company may not be able to predict every response generated by an AI system, but it can still be responsible for choosing to deploy that system and managing foreseeable risks arising from its use.
As businesses give AI a greater role in customer communications, the quality of governance behind those systems may become just as important as the technology itself.
If your company’s chatbot made a misleading statement that influenced a customer’s decision, could you demonstrate that the organisation had taken reasonable steps to prevent it?
#AIGovernance #AILiability #CorporateGovernance #AICompliance #BusinessRisk
