If your startup sells a generative AI product — a chatbot, a drafting assistant, an AI-powered analytics tool — a question has probably crossed your mind: when the model gets something wrong, who wears the liability? For a while, founders could half-plausibly tell themselves the law hadn’t caught up. That comfort is now officially gone. In October 2025, Treasury published the final report of its Review of AI and the Australian Consumer Law, and its headline conclusion was not “we need new AI laws”. It was the opposite: the existing Australian Consumer Law (ACL) is, in the report’s words, broadly capable of adapting effectively to AI-enabled goods and services. There is no AI carve-out coming, and no AI-specific liability regime to wait for. The rules that apply to your generative AI tool are the ones that have been sitting in Schedule 2 of the Competition and Consumer Act 2010 (Cth) all along — and some of them bite harder than founders expect.
Your AI Tool Is Probably a “Good” — Which Matters More Than It Sounds
The ACL draws a hard line between goods and services, and the definitions are mutually exclusive: a supply is characterised as one or the other, and different guarantees and liability provisions attach to each. Software sits awkwardly on that line — but the statute and the case law lean firmly one way. The definition of “goods” in section 2 of the ACL expressly includes computer software, and in ACCC v Valve Corporation (No 3) [2016] FCA 196 the Federal Court confirmed that software supplied purely digitally — no disc, no box — is still goods. Valve, a US company with no Australian subsidiary, also learned that supplying Australian consumers while carrying on business here is enough to attract the ACL regardless of what your terms of service say about governing law.
Why does the label matter? Two reasons. First, it determines which consumer guarantees apply: goods carry the guarantees of acceptable quality and fitness for any disclosed purpose, while services carry guarantees of due care and skill and fitness for purpose. Second, only goods can ground a defective-goods action under Part 3-5 (more below). Treasury’s review acknowledged genuine uncertainty at the margins — modern AI products are usually a mixed supply of software, cloud infrastructure and ongoing services — and Finding 2 of the report recommends targeted amendments to the definition of “goods” to more clearly capture digital products. Until that happens, the safe working assumption for a generative AI startup is that at least the software layer of your product is goods, and the ACL applies in full.
One more scoping point founders routinely miss: ACL protections are not limited to consumers in hoodies. A business customer paying up to $100,000 for your product gets the non-excludable consumer guarantees too — we covered that trap, and what your limitation of liability clause can and can’t do about it under sections 64 and 64A, in our earlier post on consumer guarantees and SaaS.
You Might Be the “Manufacturer” of a Model You Didn’t Build
Part 3-5 of the ACL gives anyone injured by a safety defect in goods a statutory damages claim against the manufacturer — no contract required, no negligence to prove. Goods have a safety defect under section 9 if their safety is not what persons generally are entitled to expect. For most pure-software generative AI tools this regime will rarely be the front line, because it compensates personal injury and property damage rather than bad business decisions. But it moves to centre stage the moment AI sits inside anything that can hurt someone — health and wellbeing apps, safety-adjacent monitoring tools, AI embedded in devices — and Treasury specifically discussed emerging concerns about psychological harm from AI chatbots and companions.
The catch for startups is who counts as the “manufacturer”. Section 7 of the ACL casts the net far beyond whoever trained the model. You can be a manufacturer if you hold yourself out as the maker of the goods, if you apply your own brand to them — which is exactly what a startup does when it wraps a third-party foundation model in its own product — or, in some circumstances, if you import goods whose actual manufacturer has no place of business in Australia. Building on top of OpenAI or Anthropic does not put daylight between you and manufacturer liability; branding their model as your product tends to do the opposite.
The statutory defences are narrower than founders assume. The state-of-the-art defence in section 142 protects a manufacturer only where the defect could not have been discovered by anybody given the scientific and technical knowledge at the time of supply — an objective, high bar. Treasury’s report addressed this directly: “the model is a black box” is not the defence founders hope it is, and if a known class of failure in LLMs could have been discovered and mitigated, the defence is highly unlikely to run. The report also flagged (Finding 4) that the time of supply defence sits uneasily with software you keep updating after sale — where you retain post-supply control over the product, expect amendments that keep you on the hook for defects your updates introduce.
Hallucinations Can Be Misleading Conduct — and Fault Is Irrelevant
For a generative AI product, the sharpest day-to-day exposure is not product safety. It is section 18: the prohibition on misleading or deceptive conduct in trade or commerce. Section 18 has no fault element. It does not matter that you acted honestly, that the error came from the model rather than a human, or that your terms said outputs may be inaccurate. If your product misleads users in trade or commerce, the conduct is yours. The Federal Court has already applied this to algorithms: in the Trivago proceedings, an algorithm that highlighted hotel offers based on advertiser fees while the site claimed to surface the best deals cost the company $44.7 million in penalties for false or misleading representations. And in a much-cited Canadian decision, Moffatt v Air Canada, an airline was held liable in negligent misrepresentation when its support chatbot misstated the airline’s bereavement fare policy, and was ordered to pay the customer the fare difference — the tribunal gave short shrift to the argument that the chatbot was somehow a separate entity responsible for its own words. That reasoning is persuasive, not binding, here — but it is exactly how you should expect an Australian court to react.
Two practical consequences. First, capability claims are representations: “eliminates errors”, “lawyer-grade accuracy”, “fully automated compliance” — if the product can’t reliably do what the marketing says, you have a section 18 problem and potentially a section 29 false-representations problem. Section 18 itself carries no pecuniary penalty — it exposes you to damages and injunctions — but section 29 does, and since the Doubling Penalties Act commenced in March 2026, maximum penalties for companies are the greater of $100 million per contravention, three times the value of the benefit obtained or, where that value can’t be determined, 30% of adjusted turnover during the breach period. Exaggerated AI capability claims sit squarely within the ACCC’s ongoing focus on misleading conduct in the digital economy, and ASIC has already warned financial services firms explicitly about AI-washing. Second, what your product tells users is your conduct. Treasury’s report worked through the supply chain: a small business that deploys an off-the-shelf chatbot is liable to its own customers for what the chatbot says, though it may have recourse up the chain under the consumer guarantees if the tool wasn’t fit for purpose. If you are the startup supplying that chatbot, you are the one that recourse points at.
What a Generative AI Startup Should Actually Do
- Write marketing like it will be read out in court. Claim what the product reliably does, disclose material limitations, and make accuracy caveats prominent in the product — not buried in clause 14.3.
- Draft terms within the law’s limits. You cannot exclude the consumer guarantees (section 64); where your product is not of a kind ordinarily acquired for personal, domestic or household use — which covers many, but not all, B2B supplies — section 64A often lets you limit liability to resupply, subject to a fair-and-reasonable override, and cap what is left — but a clause that overreaches risks being an unfair contract term, which now attracts penalties.
- Design for the failure mode. Human-in-the-loop for high-stakes outputs, guardrails on what the product will assert as fact, logging so you can reconstruct what the model told a user, and a process for correcting and notifying when it gets something materially wrong.
- Know your position in the supply chain. Map where you’d be the manufacturer, what your upstream model provider’s terms actually give you if their model causes your liability, and whether your data and model licensing allocates that risk or ignores it.
- Watch the reform pipeline. The Government has said it will consult states and territories on the review’s identified amendments to the definitions of “goods” and “manufacturer”, and the economy-wide unfair trading practices prohibition passed by Parliament in July 2026 takes effect on 1 July 2027. None of it will loosen the current settings.
The Bottom Line
Treasury looked hard at whether generative AI breaks the Australian Consumer Law and concluded it doesn’t — which means every founder selling an AI product in Australia is already operating under a no-fault misleading conduct regime, non-excludable statutory guarantees, and a product liability framework that can treat you as the manufacturer of a model you licensed from someone else. The startups that get burned won’t be the ones whose models occasionally hallucinate — every model does. They’ll be the ones whose marketing promised otherwise, whose terms pretended the ACL didn’t exist, and whose products asserted fictions to users with nobody watching.
This article is general information only, not legal advice — how the ACL applies depends on your product, your customers and your contracts. Viridian Lawyers advises Australian AI and technology startups on consumer law compliance, customer terms and liability risk. If you’re shipping a generative AI product and haven’t stress-tested your claims and terms against the ACL, get in touch.
