AI error at work, who is liable? The AI charter is no longer a footnote

A chatbot that mistakenly promises a customer the wrong price, a CV-screening tool that consistently rejects a profile for a reason no one can explain, an automated reply sent to a customer with no human review. In all three cases, one question always comes up, who is liable. The answer, under both French and European law, leaves no doubt, it is the company, never its AI vendor.

This principle is nothing new in itself, it follows from a company's general liability for content produced by its employees, including when a tool takes part in producing it. But 2026 sharpens its practical reach. A leader who builds an AI tool into recruitment or customer relations takes on a responsibility that cannot be fully handed off to the technology's publisher, even where the product genuinely malfunctions. Several law firms specializing in digital law confirm this, the manager who automates a decision remains accountable for that decision.

Article 4 of the AI Act, in force since February 2025, formalizes this requirement as an AI competency obligation for any organization deploying or using an AI system. This obligation is not limited to knowing how to use a tool, it includes documenting supervised use. In practice, that is what an internal AI charter covers, a document specifying who approves the use of a tool, who supervises the decisions it produces, and who can step in when there is an error.

Within the professional network, a frequent confusion comes up, several leaders assume this obligation only applies to large companies or so-called high-risk systems, automated recruitment, credit scoring, biometrics. In reality, Article 4's AI competency obligation applies with no headcount threshold, to any professional use of an AI system, including a simple customer-service chatbot or a marketing content generation tool. A ten-person SMB using AI daily is covered exactly the same as a two-hundred-employee mid-sized company.

The good news for an SMB is that this charter does not need to be a fifty-page legal document drafted by a specialized firm. Three elements are enough for a first serious level of governance, the list of AI tools actually used in the company and their intended purposes, the person responsible for approving each use, generally the head of the relevant department, and a simple procedure to follow when a result is contested by a customer, a candidate, or an employee.

This requirement layers on top of GDPR, which has governed all personal data processing since 2018, including when it runs through an AI tool. The two regulations stack rather than replace one another. An SMB that has already worked on its GDPR compliance has a useful foundation, its processing register, to build its AI charter on, but it cannot simply reuse that existing base without adding the piece specific to overseeing AI systems.

In practice, what protects a business is not the tool it chose, it is its ability to show that this use is documented, supervised, and overseen. A company that cannot produce any trace of who approved the use of an AI tool, nor of the procedure followed when there is an error, finds itself in a weak position facing an unhappy customer or an audit, regardless of how good the tool actually is. Orchestration tools like Cowork, which can log AI actions carried out locally and online, make it easier to build this usage log without dedicating an IT team to it.

This is exactly what the Framing step of the IMPACT method covers, following the usage inventory, defining the approval and oversight rules specific to each identified tool. An AI charter is not one more formal compliance exercise, it is what turns a usage inventory into genuinely operational governance, the kind that protects the company the day a tool gets something wrong. A five-business-day diagnostic lays the groundwork for this charter, sized to your company's actual reality.