AI Product Liability Under Australian Consumer Law

If your business supplies a product or service in Australia, adding AI to it does not change your underlying legal obligations. The Australian Consumer Law (ACL) applies to AI-powered features the same way it applies to any other feature: the business that supplies the product remains responsible for meeting consumer guarantees, for not misleading customers, and for the safety of what it ships. You cannot point to "the model" as a defence, and you cannot outsource that responsibility to a vendor or an API provider. That is the core position. The genuinely open questions sit one layer down — in how courts and regulators will apply settled ACL concepts to probabilistic, non-deterministic AI behaviour — and that is where specific legal advice is required rather than general commentary.

What the ACL actually covers, and why AI features are not exempt

The ACL is set out in Schedule 2 of the Competition and Consumer Act 2010 (Cth). It sets consumer guarantees for goods and services, prohibits misleading or deceptive conduct, and regulates product safety. None of this is technology-specific. A recommendation engine, an AI-generated insurance quote, a chatbot that handles a customer complaint, or an automated triage tool in a healthtech product all sit inside the same consumer protection perimeter as a manually built feature performing the same function. The ACCC has been clear in its public commentary, including through its Digital Platform Services Inquiry, that existing consumer law applies to digital and algorithmic products — it does not treat "AI-powered" as a separate regulatory category.

For product and engineering leaders, the practical takeaway is that AI features need to be assessed against the same bar as everything else you ship: is it fit for the purpose it was sold for, was it supplied with due care and skill, and are your representations about what it does accurate.

Consumer guarantees: fit for purpose and due care and skill

Consumer guarantees under the ACL require that goods and services be fit for the purpose they are supplied for and delivered with due care and skill. These guarantees apply regardless of whether the underlying logic is deterministic code or a trained model. If you market an AI feature as capable of a specific outcome — accurate document extraction, reliable fraud detection, automated eligibility assessment — and it materially fails to do that, the ACL guarantee analysis is engaged in the same way it would be for a manual process making the same claim.

What is genuinely unsettled is how a court would assess "due care and skill" for a model that is correct most of the time but wrong in a minority of cases by design. Traditional software either does or does not execute as specified. AI systems have a known, non-zero error rate as part of their normal operation. Where the acceptable error threshold sits, and how it interacts with the guarantee standard, has not been tested in Australian courts in an AI-specific context. This is a live area, not a settled one, and any business operating in a regulated or safety-critical domain should treat it as a legal question rather than an engineering assumption.

Misleading conduct and disclosure of AI involvement

Separate from the guarantee question is the ACL's general prohibition on misleading or deceptive conduct. This is where disclosure obligations usually arise in practice: if a customer reasonably believes they are dealing with a human, or relying on a particular method of assessment, and that belief is false in a way that affects their decision, there is a misleading conduct risk — independent of whether the AI itself performed well. The Australian Government's 2023 "Safe and Responsible AI in Australia" consultation and subsequent policy work both flag transparency and disclosure as a priority area, which signals the direction regulators are likely to take, even though it does not yet translate into a prescriptive ACL disclosure rule specific to AI.

The practical implication: businesses should document and be able to justify what they disclose to customers about AI involvement in a decision or interaction, particularly where that decision affects price, eligibility, or access to a service. This is a lower bar than waiting for a specific AI disclosure law, and it is good practice regardless of how the legal position develops.

Who is liable when the AI gets it wrong — you, or your vendor?

This is the question we hear most often from technical leaders, and the ACL answer is comparatively clear: the supplier of the good or service to the end customer carries the primary consumer-facing liability, not the underlying model provider. If you build a product on a third-party foundation model or AI platform and ship it to your customers, your contractual arrangements with that vendor govern your ability to recover losses from them — but they do not change your obligations to your own customers under the ACL. This is a standard supply-chain liability structure, not something unique to AI, but it is easy to overlook when a feature's core logic sits inside a vendor's API rather than your own codebase.

Practical steps while the law catches up

Given the unsettled areas above, the sensible approach for product and engineering teams is to treat ACL compliance as a design input, not an afterthought: test AI features against the same fit-for-purpose and accuracy standards you would apply to any critical feature, keep clear records of what you represented to customers and when, build monitoring that can show how a model performed over time, and loop in legal counsel before shipping AI features into regulated domains such as finance, insurance, or health. None of this requires waiting for case law — it is defensible practice under the ACL as it stands today.

If your team is building or scaling AI-powered products and wants engineering and strategy support that accounts for this kind of regulatory context, our ai product strategy and ai engineering work is built around shipping production features responsibly, and our application modernisation work often surfaces exactly where these guarantees get tested in legacy systems. You can browse more insights on related topics.

This article is general commentary on how the ACL framework applies to AI features — it is not legal advice, and it does not replace advice from a lawyer with ACL and technology-specific experience. If you want to talk through how this applies to a specific product or feature you're building, get in touch.