Hallucination Risk in Guest-Facing AI: Guardrails, Escalation, and Liability

Your booking assistant will not tell a guest it does not know. It will produce a fluent, well-punctuated, entirely invented answer about your cancellation policy, and the guest will believe it. That is not a bug you patch. It is a property of the technology you have to design around.

A guest messages your booking assistant at 11pm from an airport lounge. She has a shellfish allergy and wants to know whether the tasting menu at your restaurant can accommodate it. The assistant answers immediately, warmly, and specifically. It tells her the kitchen prepares an allergen-free version of every course on request and that she should simply mention it on arrival. None of that is true. Your chef runs a fixed menu with three shellfish courses and requires 48 hours' notice for substitutions, which is documented in a PDF the assistant was never given.

Nothing in that exchange looks like a failure. There is no error message, no spinner, no apology. The answer is grammatical, confident, and helpfully specific, which is precisely what makes it dangerous. Systems that generate language do not have a mechanism for expressing the absence of knowledge. They produce the most plausible continuation of the conversation, and a plausible continuation of "can you accommodate my allergy" is "yes, of course." The industry has settled on the word hallucination for this, which is unfortunate, because it implies a rare malfunction rather than a permanent characteristic of how the technology works.

Hotels have adopted guest-facing AI faster than almost any other operational technology in the last decade. Roughly 92 percent of properties have adopted or are adopting AI guest messaging, and guest communications is the single most-cited area of expected AI impact among hotel IT decision-makers. Voice deployments are following the same curve. What has not kept pace is the control layer. Most properties bought a conversational product, connected it to a website, and never defined what the system is forbidden to answer, what happens when it is unsure, or who is on the hook when it invents a policy.

What a Wrong Answer Actually Costs

The instinct is to treat all errors as embarrassing but survivable. That instinct is wrong, and it is wrong in a way that matters for how you spend your control budget. Hallucinations in a hotel context sort into severity tiers that differ by three orders of magnitude in consequence, and the controls appropriate to a tier-four error are wasted on a tier-one and insufficient for a tier-five.

A wrong answer about pool hours generates mild irritation. A wrong answer about pet policy generates a guest arriving with a dog you cannot house. A wrong answer about a cancellation penalty generates a chargeback and a review. A wrong answer about accessibility generates a guest who cannot use the room they booked. A wrong answer about an allergen generates an ambulance. These are not points on a single scale; they are different categories of event requiring different institutional responses.

The useful discipline here is that tiers three, four, and five should never be answered generatively at all. They should be answered by retrieval, quotation, or refusal. A model that composes a novel sentence about your cancellation policy is doing creative writing about a contract, and no amount of prompt engineering makes that safe. The line is not between good models and bad models. It is between answers that are looked up and answers that are composed.

Grounding Reduces the Problem. It Does Not Remove It.

Every vendor you evaluate will tell you their system is grounded in your property's data and therefore does not hallucinate. Retrieval-augmented generation, or RAG, is the standard architecture behind this claim: the system retrieves relevant documents from your knowledge base and instructs the model to answer only from them. It genuinely helps. Grounded deployments commonly report error rates below five percent against fifteen to thirty percent for ungrounded ones, and the engineering literature on hallucination prevention is consistent that retrieval is the single highest-leverage intervention available.

The claim that it eliminates hallucination is false, and there is unusually clean evidence for that. Stanford's RegLab ran the first preregistered empirical evaluation of commercial retrieval-grounded AI research tools, in a domain where the vendors had explicitly marketed hallucination-free citation. Published in the Journal of Empirical Legal Studies, the study found the tools hallucinated between 17 and 33 percent of the time depending on the product. These were mature, expensive, heavily engineered systems from LexisNexis and Thomson Reuters, sold to a profession that audits its sources for a living. Academic work on groundedness in long-form retrieval-augmented generation and on detecting ungrounded output at inference time reaches the same conclusion from the other direction: retrieval constrains the model, it does not bind it.

The reason matters for how you write your vendor questions. RAG fails in at least four distinct ways, and only one of them is the model's fault. Retrieval can return nothing relevant, in which case a poorly configured system answers anyway from parametric memory. Retrieval can return a stale document, in which case the system is faithfully grounded in last season's rates. Retrieval can return two conflicting documents, in which case the system silently picks one. And the model can retrieve correctly and then still synthesise a claim the source does not support, which is the failure mode the Stanford work measured.

There is no configuration in which a language model reliably says "I do not know" without being explicitly built to. Abstention is not a default behaviour you inherit. It is a feature you specify, test, and pay for.

The Liability Question Is Already Answered

Hotel executives frequently ask whether a property can be held responsible for something a vendor's chatbot said. The answer arrived in February 2024 and has not been seriously contested since. In Moffatt v. Air Canada, 2024 BCCRT 149, a passenger relied on a chatbot's description of the airline's bereavement fare policy, which the chatbot had invented. Air Canada refused the refund and argued, remarkably, that the chatbot was a separate legal entity responsible for its own statements.

The tribunal rejected that outright, finding the airline liable in negligent misrepresentation and holding that a company is responsible for all information on its website whether it appears on a static page or comes out of a conversational interface. The American Bar Association's analysis and subsequent practitioner commentary treat the point as settled: the deploying business owns the output. The award was around eight hundred Canadian dollars. What Air Canada actually lost was the argument that a vendor sits between a company and its own words.

Two adjacent exposures follow the same logic. The first is consumer protection enforcement. The FTC's Operation AI Comply has been running since September 2024, and two years on the enforcement posture has intensified rather than softened. The relevant risk for a hotel is not that you overclaim about AI in your marketing, though some do. It is that a system making unsupportable representations to consumers about price, availability, or terms is the kind of conduct the Commission already has a theory for.

The second is the duty of care around allergens. Hospitality has a long and unforgiving line of cases establishing that assuring a guest a dish is safe when it is not is actionable negligence, and several jurisdictions now impose affirmative training and disclosure duties on food service operators. Nothing about routing that assurance through software changes the analysis. If anything it worsens your position, because a chat transcript is far better evidence of what was represented than a server's recollection.

Seven Guardrails That Actually Hold

The good news is that the control set is well understood and most of it is configuration rather than engineering. The bad news is that almost no hotel deployment has all seven, and the ones that matter most are the ones vendors are least eager to discuss because they reduce the apparent capability of the product.

Two of these deserve elaboration because they are routinely misunderstood. Confidence thresholds with abstention mean the system is configured to decline rather than answer when retrieval quality falls below a set bar. Vendors resist this because it makes their containment rate look worse, and containment rate is the number they sell on. You should want a lower containment rate with zero tier-four errors over a higher one with occasional invented refunds. Insist on seeing the abstention rate alongside the containment rate, and treat a vendor who cannot report abstention separately as a vendor without the feature.

Knowledge base freshness is the control that decays fastest and is owned by nobody. A property loads its policies at go-live, changes its pet policy in March, and the assistant confidently quotes the old one until someone complains in July. This is not a hallucination in the technical sense. The system is behaving correctly and grounding faithfully in a document that is wrong. It produces identical guest harm. Assign a named owner and a review cadence tied to a date already on the calendar, the same way you would with any other operational document set.

Escalation Design: The Handoff Is the Product

Most escalation logic in deployed hotel systems is a single rule: hand off when the guest asks for a human. That is the weakest possible trigger, because it depends on the guest recognising that the answer they just received was wrong. In a hallucination scenario the guest specifically does not recognise it. The answer was confident and plausible. She is not going to ask for a human; she is going to arrive expecting an allergen-free tasting menu.

Useful escalation is triggered by system state and content classification, not by guest dissatisfaction. The system should hand off when it retrieves nothing, when it retrieves conflicting sources, when the topic classifier flags a prohibited domain, when the guest's message contains distress or medical language, when a monetary commitment is implied, and when the conversation has looped more than twice without resolution. Each of these is detectable before the guest knows anything is wrong.

The overnight case is where most properties quietly fail. A trigger that routes to a human is only a control if a human exists at the other end. Properties running lean overnight coverage need an explicit answer to what happens at 2am: either the assistant is scoped much more narrowly outside staffed hours, or the handoff creates a tracked ticket with a stated response time and the guest is told plainly when to expect a reply. What you cannot do is fire a handoff into an unmonitored inbox and record it as a resolved escalation.

Containment rate is the metric vendors sell on and the metric that will hurt you. A system that answers everything has simply moved your error rate somewhere you cannot see it.

The Prohibited List Every Property Needs

Write this list before you launch, keep it short enough that the general manager can recite it, and make it a contractual requirement in your vendor agreement rather than a configuration setting a vendor update can silently reset. At minimum, guest-facing AI at a hotel should never generate an answer on: food allergens and dietary safety; medical questions of any kind including proximity to care; accessibility accommodations and ADA-related capability; legal or contractual interpretation beyond verbatim policy quotation; any statement of price, availability, or refund entitlement not read directly from the system of record; anything concerning another guest; and any characterisation of a safety or security incident.

Every item on that list shares a property: being wrong is materially worse than being unhelpful. That is the test to apply when you extend the list for your own asset. A resort with a dive operation adds water safety. A property with a licensed spa adds treatment contraindications. A ski hotel adds avalanche and terrain conditions. The category is not sensitive topics; it is topics where a confident wrong answer causes harm that an honest refusal would not.

Note that prohibition does not mean silence. The correct behaviour is a warm, specific, immediate handoff: acknowledgement of the question, a clear statement that a member of the team will answer it personally, and an actual named route with a time commitment. Guests do not resent being handed to a human. They resent being handed to nobody. Properties building this layer properly usually find the work sits at the intersection of messaging configuration and front desk operating procedure, which is exactly the scope of a structured guest experience systems engagement rather than a vendor implementation call.

Transcripts, Evidence, and the Thing Nobody Configures

Full transcript retention is the least discussed and most consequential control in this entire framework, because it determines whether you can see your own failure rate and whether you can defend yourself when one surfaces.

Most hotel deployments retain a summary or a truncated window, often because the vendor's default storage tier is cheaper that way. That default is wrong for a hotel. If a guest claims your assistant promised a full refund, the transcript is either your complete defence or the plaintiff's exhibit, and in both cases you need it. Air Canada's position was undermined precisely because the exchange was documented. The lesson is not to retain less; it is to be correct more often and to be able to prove what was said.

Retention also enables the only reliable way to measure hallucination in production, which is human sampling. Automated confidence scoring tells you what the model believed about itself. It does not tell you whether the answer was true. Pull fifty transcripts a week at random, weight the sample toward tier three and four topics, and have a supervisor mark each answer correct, incorrect, or abstained. That number is your actual error rate. Almost no property has it, which means almost no property knows whether its guardrails work.

Set retention policy deliberately rather than by default. Balance the evidentiary case for keeping transcripts against data minimisation obligations, which for European-facing properties now sit alongside the Article 50 transparency duties that became enforceable in August 2026. A defensible position is a defined retention window measured in months rather than indefinitely, with tier four and five conversations flagged for longer retention, and personal data handled under the same rules as any other guest record. The NIST AI Risk Management Framework is a reasonable structure to hang this on if you need something to point an owner or an insurer at.

A Thirty-Day Sequence

This work does not require a project team. It requires a week of decisions and three weeks of verification.

Days 1 to 5. Establish the baseline. Pull two hundred real transcripts from the last quarter and read them. Mark every answer that was wrong, and sort the wrong ones into the five severity tiers. This is uncomfortable and it is the most valuable week of the exercise, because it converts hallucination from an abstract vendor topic into a specific list of things your system told your guests. Most properties doing this for the first time find at least one tier four error they never knew about.

Days 6 to 10. Write the two lists. The prohibited topic list and the escalation trigger list, both short, both approved by the general manager, both handed to the vendor as configuration requirements with a written confirmation that they were implemented. Ask specifically whether each is enforced server-side or is a prompt instruction, because a prompt instruction is a suggestion.

Days 11 to 20. Fix the knowledge base and the integrations. Audit every document the retrieval layer can see for accuracy and date. Remove anything superseded, because a stale document in the index is worse than a missing one. Confirm that price, availability, and refund answers come from the property management system rather than from documents. Assign a named owner for knowledge base currency with a quarterly review date.

Days 21 to 30. Test adversarially and stand up sampling. Have three people who did not build the configuration spend an hour each trying to make the system say something false about an allergen, a refund, or an accessible room. Log every success and close it. Then start the weekly fifty-transcript sample and put the error rate on the same report as your other operating metrics. If it is not on a report somebody reads, it will not stay low.

What Good Looks Like

A well-governed guest-facing AI deployment twelve months in has an unremarkable profile. Containment sits somewhere in the sixties rather than the nineties, because the system declines a meaningful share of what it is asked. Abstention is measured and reported separately. The prohibited topic list is in the vendor contract. Overnight handoffs land in a monitored queue with a stated response time. A supervisor samples transcripts weekly and the tier four error count is a number the general manager can quote. Nothing about it is impressive in a demo.

That profile is the point. The competitive advantage in guest-facing AI is not the breadth of what the system will answer. It is the reliability of what it does answer plus the speed of the handoff on everything else. The relationship between rating and revenue is well documented, and the academic work on reputational effects of guest ratings is unambiguous that trust compounds slowly and breaks quickly. A single tier four failure that reaches a review is worth more downside than a year of marginal containment improvement is worth upside, particularly given that 40 percent of consumers will pass on a hotel with poor reviews even at a lower price.

The properties that will look smart in three years are not the ones whose assistant answered the most questions. They are the ones who decided early which questions a machine was never going to be allowed to answer, and who built a fast, warm, staffed path for everything on that list. That is a hospitality decision wearing a technology costume, which is roughly true of most of what gets called AI strategy in this industry, and it is why the framework above is mostly about operating procedure rather than models.

Frequently Asked Questions