The C$812 precedent
In February 2024, a tribunal in British Columbia ordered Air Canada to pay a customer 812 Canadian dollars. The airline’s website chatbot had invented a bereavement fare policy — told a grieving passenger he could book now and claim the discount afterwards, which the real policy did not allow — and when he asked for the refund, the airline argued, with apparent sincerity, that the chatbot was a separate legal entity responsible for its own actions. The tribunal did not entertain it. The company answers for what its model says.
The verdict was cheap. The principle is not, because somewhere in that airline’s stack was a set of guardrails — whatever the vendor shipped, tuned however it arrived. Nobody in that organization decided the bot was allowed to improvise refund policy, and nobody decided it was not. That absence was the policy. Every AI system in production is operating under a guardrail policy right now; the only question is whether anyone in the business has read it.
The dial nobody is holding
Guardrails feel like an engineering topic because the failure modes arrive dressed as engineering: prompt injection, unvalidated output, a model with too much freedom to act. But strip the vocabulary away and every guardrail is the same underlying object — a trade-off between two costs that only the business can price. Block too little and you are one screenshot from an incident: Air Canada paid in a tribunal, and DPD paid in reach when a customer got its chatbot to swear at him and compose a poem about how useless DPD was, which the internet enjoyed over a million times before the company pulled the feature. Block too much and the feature stops being worth shipping — every legitimate question refused is a user quietly concluding the product does not work.
That is a dial, not a checkbox, and someone is always holding it. In most organizations today, the entity holding it is a framework default. I have written that most escalations are ownership gaps wearing a technical costume, and guardrails are the same phenomenon from the other side: a business decision wearing one.
Three layers, three questions
The technical shape of the answer is well mapped, and it is deliberately not the point of this piece. Input rails decide what reaches the model — prompt injection sits at the top of OWASP’s LLM risk list for a reason. Output validation decides what leaves the system, because a model’s answer is untrusted output until something checks it. And escalation rules decide when the system must stop and hand the case to a person. Toolkits like NeMo Guardrails implement all of this off the shelf; the engineering is an afternoon, the same afternoon the tracing and the tooling always are.
But look at what each layer actually encodes: what users may ask the system, what must never leave it — prices, promises, personal data, legal positions — and at what point of uncertainty or consequence a person must take over. Those are not engineering decisions. They are decisions about what the company is willing to have said in its name, and an engineer configuring a moderation threshold at 0.7 on a Thursday afternoon is answering them for the whole organization. Not through overreach — through vacancy. They were simply the only one at the keyboard when the question came up.
I have made the general version of this argument before: leave a rule unstated, and every engineer invents a private answer, and you discover the full range of those answers during an incident. Guardrail defaults are that mechanism running at production speed. The incident, when it arrives, will be traced back to a decision, and the uncomfortable finding will be that the decision was made by nobody.
The regulator has an opinion now
For some of us, this stopped being a philosophical point. The EU AI Act classifies AI systems that evaluate job candidates or make decisions about workers — screening, promotion, performance evaluation — as high-risk, by name, in Annex III. A platform I am responsible for sits squarely in that category, which concentrates the mind. For high-risk systems the Act requires an owned risk-management process, automatic logging, and human oversight designed into the system — not bolted on, designed in. It is a regulator writing down what this essay argues: the guardrail policy is a governance artifact, and someone accountable must sign it.
The dates just moved, and the movement is a trap. The Digital Omnibus agreed this summer pushed the Annex III obligations to December 2027, and the temptation is to read that as permission to defer. But the delay changed the deadline, not the category. The systems are high-risk now, the outputs influence livelihoods now, and a policy you intend to write in 2027 protects nobody in 2026. “We have time” is how the time gets spent.
Own it like a spend limit
The fix is almost insultingly small, which is exactly why it keeps not happening. Nobody would run a company where any engineer could set their own procurement budget, yet most AI features run under exactly that arrangement for risk: whoever touched the config last set the appetite. An unowned default is an open line of credit in the company’s name.
So treat guardrail policy the way you treat spend limits and access control — an explicit, boring, owned document. One page. What the system may do unsupervised. What it must always refuse. What gets escalated to a human, and at what confidence or consequence threshold. Who is allowed to move each of those lines. Signed by someone with the authority to accept risk on behalf of the business, because that is what the signature means.
Then put one rule under it: the page gets re-reviewed every time the model or the prompt changes. Defaults are not inherited once; they are re-inherited silently at every upgrade, and a policy that was deliberate at version one is an accident again by version four.
None of this slows the team down. It replaces a thousand implicit micro-decisions with one explicit decision, which is what governance is when it works. You cannot opt out of having a guardrail policy — every deployed system already has one. You can only opt out of knowing what it is.