Before you edit anything: freeze the agent, then capture the call ID and timestamp, the audio, the transcript, the tool-call log and the system prompt revision live at that moment. A rushed prompt edit destroys that last one permanently, and on Vapi pay-as-you-go you have 14 days. Then call your lawyer: whether the promise binds you is a contract question, not an engineering one.
What do I do in the next hour?
Six steps. None of them cost money, and none of them involve buying anything.
- Do not edit the prompt yet. This is the single most common and most expensive mistake. On most platforms the configuration that spoke to your customer is the configuration you are about to overwrite.
- Stop the bleeding, not the evidence. If the same wrong answer could go out again, pause the agent or route that intent to a human. Pausing a phone number or disabling an agent does not delete past calls; publishing an edited prompt can make the old one unrecoverable.
- Write down the call ID and the exact start time, with the UTC offset. Everything else is retrieved by that key.
- Export the artefacts to storage you control — your own S3 bucket, your own drive, anywhere that is not the vendor’s retention clock. Vapi, Retell AI, ElevenLabs and Twilio all default differently, and one of them keeps pay-as-you-go call artifacts for only up to 14 days. Details in the evidence hold below.
- Freeze the customer-facing side too. Whatever the customer received in writing — the SMS confirmation, the email, the CRM note, their own screenshot — is evidence, and it is usually the copy that survives.
- Tell the customer you are looking into it and give a date. Do not confirm the promise and do not deny it. You do not yet know which one is correct.
Freeze before you fix: the only copy of the prompt that spoke to your customer is often the one you are about to overwrite.
Do I need a lawyer for this?
Yes, and that call should be early — before you decide whether to honour the promise, and before you put anything in writing to the customer that concedes or denies liability.
We build AI sales agents. We are not lawyers, and this page is not legal advice. Whether a statement made by your agent binds your business is a question of contract and consumer-protection law in your jurisdiction, and it turns on facts we cannot see: what your terms say, how the statement was made, what the customer did in reliance on it, and which country and state you are both in. The right first call is a commercial or consumer-law solicitor or attorney admitted where your business operates. If you sell to consumers, your regulator’s guidance on misleading conduct is the second thing to read, and it is jurisdiction-specific too.
What we can help with is the half nobody writes about: making sure that, by the time your lawyer asks what the agent was actually told to say, the answer still exists.
Is this as bad as it feels?
Probably not, and the honest reason is worth knowing.
The case every article on this subject cites is Moffatt v. Air Canada, 2024 BCCRT 149, decided by British Columbia’s Civil Resolution Tribunal on 14 February 2024. It is a small claims decision. The airline was ordered to pay CAD 812.02 in total, of which CAD 650.88 was damages. Not a class action, not a penalty, not an injunction — the price difference, interest and the tribunal filing fee.
More usefully: the remedy tracked the gap, not the promise. The tribunal did not order Air Canada to honour the bereavement fare its chatbot described. It put the passenger in the position they would have been in had the misrepresentation not been made, which is a different and usually smaller number. The applicant claimed CAD 880 in the application, calculated CAD 880.36 in submissions, and received CAD 650.88, because the tribunal added the taxes and airport charges back into the counterfactual fare.
We are not telling you this outcome applies to you — it was one tribunal, one province, one set of facts, and Canadian tort law is not your law unless you are in Canada. We are telling you that the shape of the exposure in the leading example is “the difference between what they paid and what they should have paid”, not “the chatbot wrote you a blank cheque”. Take that to your lawyer as a question, not as a conclusion.
What exactly should I preserve? The First-Hour Evidence Hold
This is the part that has no published playbook, so here is ours. We call it the First-Hour Evidence Hold: seven artefacts, captured in one pass, before anyone touches a configuration. The column that matters is the last one, because each artefact has a specific thing that destroys it.
| # | Artefact | Where it lives | What destroys it |
|---|---|---|---|
| 1 | Call or conversation ID, and start timestamp with UTC offset | Platform call log; your webhook payload | Nothing, if you write it down now. Everything else is keyed to it. |
| 2 | Audio recording, stereo or dual-channel if offered | Platform artefact store, or your own bucket if you configured one | The platform retention clock. Mono-only exports lose who spoke when. |
| 3 | The transcript exactly as the platform produced it | Platform artefact store | Re-transcribing later with a different ASR model. That is a new document, not the record. |
| 4 | The system prompt revision in force at that timestamp — the version ID, not “the current prompt” | Version history, if your platform has it and it is switched on | Publishing an edited prompt. On platforms without versioning, this is gone the moment someone saves. |
| 5 | Tool-call and function-call log, including what each tool returned | Platform call log; your own API logs | Log rotation on your side. A wrong price is often a correct model reading a stale tool response. |
| 6 | Knowledge-base or retrieval log: which documents were pulled in | Platform retrieval log | Re-indexing the knowledge base, which changes what would be retrieved today. |
| 7 | Everything the customer received in writing, plus their own screenshot | CRM, email logs, the customer | Nothing much — this is the copy that survives, and in the Air Canada case it was the customer who still had it. |
Item 4 is the one people lose. It is also the one that decides the whole argument, because “was the agent told to offer that discount, or did it invent it?” is a completely different conversation from “the agent said something wrong”. The first is a configuration failure you can show; the second is an unbounded claim about your system. If you cannot produce the prompt revision, you are arguing the second case whether you meant to or not.
Will my evidence still exist when the complaint arrives?
This is a scheduling problem, not a legal one, and it is the reason the hold has to happen in the first hour rather than the first week. Default retention differs enormously between platforms. Every figure below comes from that vendor’s own documentation, read on 10 September 2026.
| Platform | Default retention of calls, transcripts and logs | Is the prompt revision pinned to the call? |
|---|---|---|
| Vapi | Pay-as-you-go: up to 14 days for calls and 30 days for chats. Enterprise: configurable retention policies. | Not by default. Vapi’s call object has an optional assistantVersion field described as “This is the assistant version to use for this call. Supported only with direct assistantId. Omit to follow the latest version.” Vapi’s versioning page says history “Keeps every published version so you can review what changed and when”, so you can reconstruct by timestamp. The call record does carry assistantVersion under assistantActivations, but Vapi documents that as null for organisations not on assistant versioning. |
| Retell AI | Keep forever, with no automatic deletion, is the default. Per-agent options run from 1 day to 730 days. | Yes. Get Call returns agent_version, and Retell’s versioning page labels published versions “immutable”. |
| ElevenLabs Agents | 2 years by default. Configurable to any number of days, to -1 for unlimited, or to 0 for scheduled deletion. The setting applies separately to transcripts and to audio. | Only if agent versioning was switched on for that agent. It is opt-in per agent, and ElevenLabs states that “Once versioning is enabled on an agent, it cannot be disabled.” |
| Twilio Programmable Voice | No automatic expiry documented on the Recording resource page, read 10 September 2026; recordings are billed as stored until you delete them. Metadata of a deleted recording is kept for a further 40 days. | Not applicable. Twilio carries the audio; the prompt lives in whatever is orchestrating the call. |
Now put a real timeline against those numbers. In Moffatt, the chatbot statement was made on 11 November 2022. The customer first emailed asking for the refund on 17 November 2022 — six days later. Air Canada’s representative acknowledged the chatbot had provided “misleading words” on 8 February 2023, roughly three months after the call. The decision issued on 14 February 2024, twelve months after that email and fifteen months after the call. One case is not a dataset, but the shape is instructive: the first contact came in days, the escalation in months, and the adjudication over a year later.
The threshold, stated as a rule: if your platform’s default artefact retention is shorter than the gap between the promise and the escalation, your evidence is not a record — it is a scheduled deletion. On a 14-day default, Moffatt’s six-day first email lands inside the window; the three-month escalation does not. Below roughly 90 days of default retention, export every call to storage you control as a nightly job, not as an incident response. Above it, a hold triggered by complaint is defensible. The 90 is not an industry average — nobody publishes one, and we are not going to invent one — it is the three-month gap in the single case above.
Running that nightly export honestly costs something: a webhook consumer or a scheduled job, a bucket with a lifecycle policy and an owner who notices when it stops. Half a day to build, and then it is somebody’s job. The alternative is discovering the cost on the day you need the file. If you run agents on your own infrastructure — which is how Zian deploys private models for partners — the artefacts land inside your retention policy from the start and the vendor clock stops being your problem.
What did the Air Canada chatbot case actually decide?
Worth reading in full, because the commentary flattens it. Tribunal Member Christopher C. Rivers found that Air Canada owed the passenger a duty of care and that its chatbot’s statement about retroactive bereavement fares was a negligent misrepresentation. On the airline’s argument that it was not responsible for what its chatbot said, the decision reads:
In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission. While a chatbot has an interactive component, it is still just a part of Air Canada’s website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.
And on the standard: “I find Air Canada did not take reasonable care to ensure its chatbot was accurate.”
Two findings in that decision get almost no coverage and both are about evidence rather than about AI. Air Canada raised a defence based on its own tariff but did not file the tariff: “Air Canada is a sophisticated litigant that should know it is not enough in a legal process to assert that a contract says something without actually providing the contract.” And on the damages figure, the tribunal recorded that “when a party fails to provide relevant evidence without sufficient explanation, an adjudicator is entitled to draw an adverse inference”, then accepted the passenger’s number because the airline had produced nothing better.
Read that as an operator rather than as a lawyer and it says something blunt: the party that could not produce its own documents lost on the points where documents mattered. The passenger had kept a screenshot. That is the entire argument for the evidence hold.
Here is the tribunal’s damages arithmetic in full, from paragraphs 38 to 44 of the decision, all figures in Canadian dollars:
| Leg | Actually paid | Counterfactual bereavement fare |
|---|---|---|
| Vancouver to Toronto | 695.00 fare + 62.12 charges + 37.86 GST = 794.98 | 380.00 fare + 62.12 charges + 22.11 GST = 474.23 as stated at paragraph 38 |
| Toronto to Vancouver | 681.00 fare + 67.12 charges + 97.26 HST = 845.38 | 380.00 fare + 67.12 charges + 58.13 HST = 505.25 |
| Total | 1,630.36 | 979.48 |
| Damages awarded | 1,630.36 less 979.48 = 650.88, plus 36.14 pre-judgment interest and 125.00 in tribunal fees = 812.02, payable within 14 days | |
One footnote for anyone reproducing that table, because we checked the arithmetic against the decision text on 10 September 2026 and it does not close. At paragraph 38 the tribunal lists a bereavement fare of 380.00, plus 62.12 in fixed-rate charges, plus 22.11 in GST, and states the total would have been 474.23. Those three figures sum to 464.23. The CAD 10 difference is the tribunal’s own, not a transcription error at our end, and 474.23 is the number it carried into the 979.48 counterfactual and therefore into the 650.88 award — so the order stands on it. Paragraph 39 has no such gap: 380.00 + 67.12 + 58.13 = 505.25 exactly. We are flagging it rather than quietly correcting it, because the figure the tribunal ordered is the figure that matters and every secondary account of this case reproduces the totals without checking the components.
My AI agent promised a customer a discount we do not offer. Do I have to honour it?
That is the lawyer’s call, not ours. But there are three practical questions worth having answered before you make it, and you can answer all three from the evidence hold.
- Did the agent invent it, or was it told to say it? Artefact 4 answers this. If the prompt or a tool response genuinely contained that discount, you have a configuration error and a much harder position. If the agent fabricated it against an explicit instruction, that is a different conversation with your lawyer.
- Did the customer act on it? Reliance is what turned a wrong answer into damages in Moffatt. A customer who was told something wrong and then did nothing differently is in a different position from one who booked, paid or cancelled something because of it.
- What does the gap actually cost? Often the difference between honouring the promise once and arguing about it is a number small enough that the commercial answer is obvious. Work it out before the meeting, not during it.
What you should not do is have the agent apologise on your behalf in a way that admits anything, or let a support rep offer a remedy before you know which of the three answers above applies.
What do I do over the next seven days?
- Day 1-2: complete the hold for the disputed call, then run the same query across the last 30 days of calls. If the prompt could produce that answer once, it produced it more than once. Search transcripts for the specific claim, not for the customer’s name.
- Day 2-3: get the count. “One customer” and “forty customers” are different problems and your lawyer will ask.
- Day 3-4: now fix the prompt — with the fix published as a new version, dated, described, and with the old version left intact.
- Day 4-5: add the specific claim to your regression tests so the next prompt change cannot reintroduce it. A single assertion that the agent never mentions a discount percentage is worth more than a paragraph of instruction telling it not to.
- Day 5-7: stand up the nightly artefact export if you do not already have one, and set a retention period you chose rather than one you inherited.
How do I stop my AI agent promising things we do not offer?
Prevention is a design problem and we have written it up separately rather than re-arguing it here. The three that matter for this failure mode:
- How to write guardrails for autonomous AI agents — why a negative instruction in a prompt is the weakest control available, and what to use instead for commitments like prices and discounts.
- AI agent confidence thresholds — how to make the agent decline to answer rather than guess when it is out of its depth, which is the specific behaviour that would have prevented this.
- Human in the loop for AI sales agents — where to put the human so that a commitment is confirmed by a person before it reaches a customer.
If the incident was a telephony or handover problem rather than a content one, our write-up on AI agent warm transfer failures covers that path. The full index of these guides sits on the Zian AI questions and answers hub.
Frequently asked questions
My AI voice agent gave a customer wrong information. What do I do first?
Freeze the agent and capture the evidence before you edit the prompt. You need the call ID and timestamp, the audio, the platform transcript, the tool-call log and the system prompt version that was live at that moment. Editing the prompt first is the one action that permanently destroys the record of what the agent was instructed to do.
Is my business liable if my AI agent promises something we do not offer?
That is a question for a lawyer admitted in your jurisdiction, and the answer depends on your terms, the customer reliance and where you both are. The most cited decision is Moffatt v. Air Canada, 2024 BCCRT 149, in which the Civil Resolution Tribunal of British Columbia rejected the argument that a chatbot is a separate legal entity responsible for its own actions, and awarded CAD 650.88 in damages for negligent misrepresentation. It is a Canadian small claims decision and it does not decide your case.
How long do AI voice platforms keep call recordings by default?
It varies more than most operators expect. Read on 10 September 2026: Vapi keeps call artifacts up to 14 days on pay-as-you-go, ElevenLabs Agents retains conversation data for 2 years by default, and Retell AI keeps data forever unless you set a per-agent retention period. Twilio documents no automatic expiry on its Recording resource and bills storage until you delete.
Will editing the system prompt destroy my evidence?
It can. On platforms with versioning switched on, publishing a change creates a new immutable version and the old one survives. On platforms without versioning, or with versioning available but not enabled, saving an edit overwrites the only record of what the agent was told. Export the prompt text and its version identifier before you change anything.
Should I just honour what the agent promised?
Sometimes the gap is small enough that honouring it once is cheaper than arguing, but make that decision with your lawyer and after you know whether the agent was instructed to say it, whether the customer acted on it, and how many other customers heard the same thing. Do not let a support representative offer a remedy before those three answers exist.
Working with us
Zian AI builds autonomous AI sales agents for phone, SMS, email and WhatsApp, with SmartReach AI and PrecisionPitch AI handling channel orchestration and script testing. For teams that need artefacts to stay inside their own retention policy, we deploy private models on customer infrastructure.
Zian is in partnership-application beta. There is no free trial and no self-serve signup. If you want to talk to us about running agents where the evidence trail is yours, Apply For Partnership.