Faye Travel Insurance

Daniel Green

AI Risk Governance Leader

A new middle layer is forming between travelers and the companies that serve them, and it's AI. It already sits between you and your airline, your hotel, your travel advisor, your insurer. It will soon sit between the advisor and the suppliers they book with. We are no longer asking these agents to search. We are asking them to decide and to pay.

And the industry hasn't answered the question that comes with it: when the agent gets it wrong, who owns the mistake?

Picture the ordinary version. You tell your agent to book a week in Lisbon. It picks the flights, accepts the terms, chooses a hotel, buys travel insurance and enters your card details. It also books a nonrefundable room you didn't want, picks a policy that excludes the one thing you'd actually claim for and misses a baggage rule that costs you $200 at the counter.

Who pays? The answer is in the fine print, and it's you. Meta's terms for Muse say you're responsible for all transactions it makes on your behalf. A rival agent goes further: it appoints itself your legal agent, makes its commitments binding on you and caps its own liability at $100. The agent gets the delegation. You keep the risk.

We settled this for humans a long time ago. Walk into a shop and ask the associate the price. They say $10. At the register the owner says $50, and says the associate was badly trained. That’s not your problem. The person wore the shop's shirt and spoke for the shop. The owner answers for them.

Courts and regulators have already applied that rule to software. When Air Canada argued in 2024 that its Chatbot was a separate legal entity responsible for its own actions, a Canadian tribunal rejected the argument and made the airline pay. In March, the UK's competition regulator told businesses they are responsible for their AI agents exactly as they are for employees, even when a third party built them. When the airline's bot or the hotel's bot gets it wrong, that's settled. The company wears the shirt.

The agent on your phone breaks that model. It isn't wearing the airline's shirt. It's wearing yours. The law's default is that the principal answers for the agent, and the companies building these products know it.

That reverses how travel works.

 The industry's answer to "who is liable" is currently "nobody, so no.  

Risk in this industry is deliberately spread: the advisor carries errors-and-omissions coverage, the tour operator is bonded, the insurer holds reserves. Route the whole trip through one general-purpose agent and that structure collapses onto the party least able to carry it. When travel advisors use the same agents for clients, the advisor's duty doesn't transfer to the bot, and the advisor has no recourse upstream.

Suppliers see the same gap. An agent arriving with a customer's credentials looks like an attacker arriving with them. That’s why Delta won't take third-party agent bookings and Amazon cut off Muse within two weeks of its launch. The industry's answer to "who is liable" is currently "nobody, so no."

Blocking is a pause, not an answer

Agents are already using the old rails, phoning call centers and filling in web forms. Three things need deciding, and supplier technology teams will build most of the plumbing.

First, verifiable mandates. Every agent purchase should carry a signed record of what the traveler authorized: dates, price ceiling, refundability and what the insurance has to cover. American Express has shown what a mandate buys: the agent purchase protection it announced in April covers errors only where the purchase deviates from an authenticated intent, and not where the instruction was "best" or "really nice." Vague delegation, no protection.

Second, terms a machine can read. If the refund rule, baggage limit or coverage exclusion sits in a PDF and the agent misses it, that’s a disclosure failure, not a consumer failure. "Clear and conspicuous" needs a machine-readable equivalent.

Third, errors-and-omissions cover for agents. Every human who books travel for someone else carries it. The companies deploying software to do the same job should carry it too, and stand behind mistakes made inside the mandate. A supplier doesn't need to know who the agent is so much as who underwrites its mistakes. That is a new insurance category, and it will exist whether or not we design it on purpose.

None of this needs new law to start. It needs the companies that profit from the middle layer, starting with the agent platforms, to accept that delegation runs both ways. If you take the booking, you take the mistake. This industry spent a century deciding who owns a bad fare quote, a missed connection and a denied claim. We can't hand those decisions to AI and leave the consequences unassigned.