A tribunal held an airline to what its chatbot said. A consultancy's revised report disclosed its AI use, after errors were found in the first. The question in both was the same: who was entitled to know, and when.
Jake Moffatt asked Air Canada's website chatbot about bereavement fares after his grandmother died. The chatbot told him he could apply for the reduced fare after travelling, within ninety days of the date his ticket was issued. That was wrong; the airline's actual policy did not allow retrospective claims. When he applied, the airline refused, and in February 2024 the British Columbia Civil Resolution Tribunal decided the dispute. Air Canada argued that it could not be held liable for what its chatbot said. The tribunal read that as suggesting the chatbot was a separate legal entity responsible for its own actions, called it a remarkable submission, held the airline liable for negligent misrepresentation and ordered it to pay. The sum was small. The principle was not: the organisation is responsible for what its tool says to a person entitled to rely on it.
Less than two years later, in a different country and a different kind of work, the same question surfaced. Deloitte's 237-page report to the Australian Department of Employment and Workplace Relations contained a fabricated quotation from a Federal Court judgment and citations to works that do not exist. A University of Sydney researcher found them. The revised version, dated 26 September 2025, disclosed that a generative AI system had been used in producing it. By then the errors had been reported in the press. The revised report said the tool chain was licensed by the department and hosted on the department's own Azure tenancy. The question here is what the readers of the published report were told about how it was made, and when.
Both cases turn on a question that was live before anything went wrong. Who was entitled to know what, and when? Moffatt was entitled to accurate policy, and the airline's tool gave him something else under the airline's name. The readers of the published report were entitled to know how it had been produced, and the disclosure in the report came with the revised version. Neither case is about whether the tool was good. Both are about a decision the organisation's people had to make and did not make, which is what to tell the party on the other side.
AIRS-J/1 treats that decision as a scoreable behaviour. The Standard's dimension E2, Stakeholder Alignment and Disclosure, describes it in two parts. Before a decision holds, who must be consulted; after it holds, who must be informed. And in the work product itself, disclosure of AI involvement, uncertainty, limitation and self-interest to parties entitled to know, without prompting. Level 2, the threshold for competence, requires the person to identify, unprompted, who must be consulted and who must be informed, and to disclose AI involvement and material uncertainty in the work product. Level 1 is identifying the parties but engaging them after the decision is fixed, or disclosing only when asked. Level 0 is omitting a party entitled to be consulted or informed, or concealing AI involvement from a party entitled to know.
The Standard adds a note that matters for your function. Disclosure of AI involvement is assessed at Level 2, not as a bonus. Its absence, where a recipient would reasonably want it, is Level 0. The anchor turns on what the recipient would reasonably want, not on whether harm followed.
Hong Kong's privacy regulator put the checking duty on paper in March 2025. The Office of the Privacy Commissioner for Personal Data published a checklist for organisations writing internal policies on generative AI use by employees. Per the Commissioner's own summary of it, internal policies should make employees responsible for verifying the accuracy of AI outputs, for example by proofreading and fact-checking, and for correcting and reporting biased or discriminatory outputs. It also recommends that policies give instructions on when and how to watermark or label AI-generated output. The checklist is guidance, not law. Its value is that it names the employee who checks as a person with a duty, and the label as something the organisation decides on in advance rather than after a complaint.
This article does not claim that other regulators in the region have gone that far. Singapore's Personal Data Protection Commission issued advisory guidelines in March 2024 on the use of personal data in AI recommendation and decision systems. They are advisory and do not change the data protection statute. In both cases above the consequence was a payment to the person or client affected, and public attention, not a regulatory fine. That exposure is real and it landed on named organisations.
For HR and L&D: the checking duty in the Hong Kong checklist is a role description. If nobody in the organisation is named as responsible for checking a class of AI-assisted work, the duty exists and is held by no one.
The useful question for your function is not whether to have a disclosure policy. It is which classes of work carry a recipient entitled to know, and what a fitted disclosure looks like for each. Level 3 in the Standard is communication fitted to each recipient's decision, so the recipient can act without a further round of clarification. Three classes cover most of what leaves an organisation.
A board paper. The recipient is a director who will vote on it and carry the consequence. A fitted disclosure says which sections were AI-drafted, which figures were generated rather than retrieved from a system of record, and which claims were verified by a named person. A line reading "AI tools were used in preparing this paper" falls short of Level 3, because the director cannot act on it. A line reading "The market-sizing in section 3 was AI-generated from the two cited reports and has not been independently checked" is the kind of fitted disclosure Level 3 asks for, because the director now knows where to push.
A client deliverable. The recipient is paying for professional work and is entitled to know how it was produced, because they will put their own name on what follows from it. The Deloitte case shows the cost of the disclosure arriving in the revised version. A fitted disclosure appears in the first version, in the methodology section, and says what the tool did and what the people did. A client who would be surprised to learn, later, that the analysis was machine-drafted is a client who was entitled to know earlier.
A public notice. The recipient is anyone who reads it and acts on it, and they have no way to ask questions. That is the Moffatt situation. A fitted disclosure here is less about a label and more about the decision upstream: should a tool be answering this question to the public at all, under the organisation's name, without a reviewer? If the answer is yes, the organisation has decided to stand behind every answer the tool gives. The tribunal held the airline to exactly that.
Disclosure that arrives in the revised version has answered the wrong question. The right question was live before the first version went out.
The highest level in E2 is not more disclosure. It is disclosure framed as a standing expectation for a class of work rather than a one-off courtesy. A person at Level 4 does not decide afresh, for each board paper, whether to say which sections were AI-drafted. They have stated the rule that every board paper says so, and the rule would carry forward to the next paper.
That is where a compliance function and the Standard meet. The function can write the expectation. The Standard assesses, in scenarios, whether a person behaves as if such an expectation exists. The two are separate records, and an organisation that has the first and not the second has a policy and no evidence that its people decide as the policy expects.
For trainers and facilitators: the three classes of work above are a session exercise. Give a group a real board paper or client deliverable from their own organisation, with AI use in it, and ask them to write the one disclosure sentence a recipient could act on. Most first attempts are the generic line. The difference becomes visible in ten minutes.
The tool will keep producing the work. Who is told how it was produced, and when, is a decision a person makes, and the Standard scores it.
AIRS-J/1 assesses how a person decides, not what they know. A result is not a measure of intelligence, personality, AI technical skill or domain expertise, and it is not a substitute for supervision, professional licensing or regulatory authorisation. This article is not legal advice and does not describe the law of any jurisdiction beyond the public facts of the cases named. The cases cited concern organisational liability and professional conduct; neither scored anyone against the Standard, and the link between them and E2 is an argument. The three classes of work are a reading aid, not a compliance checklist.
AIR APAC publishes these articles in the institution's voice. Every figure carries its source and its limit. All articles.
Judgment was always built on the job, by doing junior work badly and being corrected. AI now does the junior work. Organisations are removing the apprenticeship and keeping the expectation.
Two managers, the same AI output, two different decisions. Which was right, and would the Jakarta team have decided as the Seoul team did? Until judgment is scored on one published scale under like stakes, nobody can answer either question.
When an AI-assisted decision goes wrong, the first reflex is to blame the tool. The Standard scores that at Level 0. The second is to abandon every decision made the same way. That is Level 1. Good correction tells a poor decision from an unlucky one.