Who's liable when the AI gets it wrong?
You are. The AI doesn't sign contracts, carry insurance, or show up in court. That's exactly why every AI system touching your business needs a human in the loop at the right points — not as a formality, but as the actual control.
The longer version
This is the question that separates serious AI implementation from toys. A chatbot that writes a slightly off marketing email is a shrug. An agent that sends a wrong quote to a customer, approves a refund it shouldn't, or gives bad advice with your company name on it — that's your liability, your reputation, your money.
The answer isn't to avoid AI. It's to design the authority levels deliberately. I think about it in three tiers: the AI drafts and a human approves (quotes, customer-facing messages, anything with money attached), the AI acts within strict guardrails and a human reviews the log (scheduling, follow-ups, data entry), and the AI runs fully autonomously only where the worst case is trivially reversible. Most small businesses should live in the first two tiers for a long time.
This is also a contract question. Your agreements with AI vendors should say who's responsible when the system errs — and most vendor terms put it all on you. Know that going in. And if you're in a regulated or high-trust industry, some decisions should never be delegated to AI at all. Saying "the AI decided" is not a defense anyone will accept.
How BIS handles this
Every system I build has explicit human checkpoints, and they're part of the design — not bolted on after. The boundary document spells out what the AI can do on its own, what needs approval, and what it can never touch. My Regulated tier exists specifically for businesses where a wrong answer has real consequences: tighter boundaries, more checkpoints, everything logged. You stay liable — so you stay in control.