“There’s no clear legal rule for who bears the loss when an AI tool exceeds its mandate,” writes one financial services consultant.

Aaron Cheiffetz is an analyst and executive strategist in the financial services industry, working with banking leaders on artificial intelligence governance, enterprise architecture, regulatory compliance and operational resiliency. He is based in Charlotte, North Carolina.

In the debit-card context, Regulation E generally limits a consumer's liability for unauthorized transfers involving a lost or stolen debit card to $50 if the loss is reported within two business days. But Regulation E excludes from its definition of an “unauthorized electronic fund transfer” a transfer initiated by a person to whom the consumer furnished the access device, unless the consumer has notified the financial institution that transfers by that person are no longer authorized.

The official commentary goes further: if a consumer furnishes an access device and grants another person authority to make transfers, the consumer can remain liable even when that person exceeds the authority given. Regulation E defines "person" to include both natural persons and organizations, including corporations.

What it doesn't say is how that rule applies when credentials are furnished to software operated by a company. A January research report by the Consumer Bankers Association asks whether sharing credentials with an AI tool could trigger this exclusion and leave the consumer responsible for the agent's mistakes.

In the credit-card context, the Truth in Lending Act, implemented by Regulation Z, provides a similar unauthorized-use framework that turns on whether another person had actual, implied, or apparent authority to use the account.

Source link