Containment Isn’t Completion (Why AI Self-Service Is Failing Regulated Industries)

A chatbot closes a conversation. A claims model issues a denial. A bot tells a small business owner exactly what they wanted to hear. In every CX dashboard, all these events register as a win, the interaction ended without escalating to a human, which is what containment measures.

But here’s the catch: none of them tell you whether the underlying problem actually got solved.

And this has real-life consequences.

It’s the reason Air Canada owed a grieving customer damages for a chatbot’s invented refund policy. It’s also why New York City spent two years running a small-business chatbot that confidently told landlords and employers to break the law, and why the city eventually killed it outright.

Two industries, two different failure points, one identical root cause: a system optimized to end the interaction, not to resolve the obligation underneath it.

This isn’t an argument against automating customer service in regulated industries. It’s an argument against measuring it by the wrong thing.

Containment, and Why It’s Never the Finish Line (Case Studies)

The pattern in every one of these cases isn’t a model that broke. It’s a model that worked exactly as designed: closing the ticket, ending the chat, returning a verdict, while the actual obligation underneath kept existing.

Air Canada: the chatbot answered confidently and wrongly, and the company tried to disown it.

In November 2022, Jake Moffatt’s grandmother died.

He went to Air Canada’s website the same day and asked the chatbot about bereavement fares. It told him he could book now and apply for the discount within 90 days of the ticket being issued, even after travel. He booked, flew, and applied. Air Canada rejected the claim: its actual policy required the bereavement request before travel, full stop. The chatbot had simply invented a policy that didn’t exist.

What makes this a containment case rather than just a hallucination case is Air Canada’s defense. The airline argued the chatbot was, in the tribunal’s words, a separate entity “responsible for its own actions,” a legal position that the chat session was its own closed loop, accountable to no one once it ended.

The tribunal didn’t just reject this; it found the argument almost beside the point. Tribunal member Christopher Rivers wrote that “it should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.”

Air Canada also argued Moffatt should have cross-checked the chatbot’s answer against the airline’s own policy page, which the tribunal also rejected, noting there was no reason a customer should know one part of a company’s website is reliable and another isn’t.

The chat ended. The customer believed his question was answered. The company’s actual obligation, to give him accurate information he could rely on, was never met.

NYC MyCity: containment as a disclaimer, not a safeguard.

New York City’s MyCity chatbot was built to help small business owners navigate city regulations.

When journalists at The Markup tested it in 2024, it told employers they could legally take workers’ tips, told landlords they could refuse tenants using housing vouchers, and claimed there were no regulations requiring businesses to accept cash, all false, and all in the direction of “the law doesn’t apply to you,” which is the worst possible direction for a government tool to be wrong in.

It also gave different answers to the same question asked twice, meaning there was no stable, auditable “version” of what the bot actually told people.

The city’s response wasn’t to fix the retrieval and grounding problem. It was to make the disclaimer more prominent. The page now describes the bot as “a beta product” and warns users not to use its responses as legal or professional advice. That’s containment in its purest form: the interaction still ends cleanly, the bad advice still goes out, and the only thing that changes is who gets blamed for it.

Air Canada’s bot answered fast and wrong. NYC’s bot answered inconsistently and illegally. In every case, the contained moment looked identical to a completed one, until someone outside the company went and checked.

The Architecture Gap That Containment Can’t Hide

Both failures trace back to the same design gap: nobody built a layer that checks whether the interaction actually resolved the obligation, only one that checks whether the interaction ended.

In regulated industries, that gap isn’t cosmetic. Insurance, banking, credit unions, and healthcare don’t just have customer-service goals, they have legal ones: disclosure requirements, audit trails built to regulatory requirements, fiduciary duties, statutory timelines.

A contact center for a bank can’t treat “customer stopped replying” as a resolved dispute. A health plan can’t treat “claim status communicated” as the same thing as “claim correctly adjudicated.” But that’s exactly what containment-as-metric does: it collapses a regulatory obligation into a conversational one, and then scores the conversational one.

This is why full self-service keeps stalling out in these environments, not because the underlying AI isn’t capable of holding a conversation, but because nobody has built the verification layer that would let an organization say, with evidence, that the execution was actually met.

Air Canada had no system checking the bot’s claims against its own published policy. NYC had no system checking that the same question got the same answer twice, let alone the correct one. In both cases, the absence wasn’t an AI failure. It was an architecture failure: nothing downstream of the chat was built to catch what the chat got wrong.

That’s the real dividing line in regulated CX right now. It’s not “human agents vs. AI agents.” It’s whether containment is the finish line or just the first checkpoint, and whether anyone’s verifying what happens after the chat window closes.

What the Execution Layer Actually Needs

Containment will keep failing the way Air Canada and NYC failed it until the architecture has an execution layer that checks completion, not just closure. Four things that layer needs:

Grounding — Every answer the AI gives has to trace back to a live, version-controlled source of policy truth, not a static training snapshot. Air Canada’s bot wasn’t lying; it was answering from a policy that didn’t exist anywhere in the company’s actual systems. If the bot can’t cite the exact clause it’s drawing from, it shouldn’t be answering.

Consistency — The same question, asked twice, needs to return the same answer — and that answer needs to be logged somewhere auditable. NYC’s bot failed this at the most basic level: no stable version of the truth, no way to even diagnose the failure after the fact.

Escalation — Some categories of question shouldn’t be self-service at all, regardless of how confident the model sounds. Bereavement fares, eviction rights, tip withholding — anything with legal or emotional weight needs a hard rule that routes to a human, not a confidence threshold that hopes the model gets it right.

Audit — Someone inside the organization needs to be checking contained conversations against actual outcomes on a standing basis, not waiting for a journalist or a tribunal to do it first. Both Air Canada and NYC only found out their bots were wrong when someone outside the company went looking. Audit capability in regulated environments isn’t a feature you toggle on; it’s built to the institution’s specific compliance requirements.

Get these four right, and containment stops being a vanity metric and starts being what it was always supposed to be: the first checkpoint in a process that ends in completion, not the finish line itself.

This Is What CCIP Is Built For

The four-part framework above describes an execution layer. CCIP is that layer, purpose-built for regulated CX.

Air Canada’s bot answered from a policy that didn’t exist anywhere in the company’s systems. NYC’s bot had no live source of truth to check itself against. That’s the failure CCIP is built to prevent, it connects AI directly to the actual system of record (core banking, EHR, CRM) in real time, so an answer isn’t a guess, it’s a controlled lookup against a live, governed source of truth.

And it goes further than answering.

CCIP enables AI to update records, process requests, and trigger workflows, so the customer gets actual resolution, not just a response . That’s completion, not containment, by design.

It’s also built for the compliance load regulated industries carry: HIPAA, PCI-DSS, and GDPR compliance, backed by certified, secure integrations with major core platforms.

If your AI self-service is closing conversations without closing the gap underneath them, this is the execution layer that changes that.