What AI incidents actually cost, in documented money

The median documented regulator fine on an AI system is US$267,500 (n = 14). Deepfake payment fraud is the costliest operational failure per case: a median loss of US$25.6M (n = 5).

Figure 1. Median (dot) and range (line) of documented costs per category, headline cases only, in US dollars on a log scale. The categories are separate ledgers and are never added together. Market-value moves are not costs and are not shown.

Chart: PNG · SVG

The ledger by category

Table 1. Headline cases per category, in US dollars at the ECB reference rate on the decision or loss date; the native amount is authoritative. Each category stands alone: the ledger publishes no grand total. Market-value moves are one-day changes in market capitalisation that the financial press tied to an AI error; they are shown for scale and are not costs.

Which single control would have stopped the most?

By number of cases, grounded answers with a policy check: 18 of the 44 headline cost cases (41%), all 16 court sanctions plus Air Canada and Deloitte. By money, measured within each category:

Table 2. Share of each category’s documented money in cases where a control on the KH Labs list was the cheapest that would have stopped it. About 93% of regulator-fine money and 92% of damages money sit in cases about a missing lawful basis or consent for data (Clearview, Meta, Anthropic) or a company’s own false claims: legal-governance problems rather than runtime controls.

Cases

1. Moffatt v. Air Canada (BC Civil Resolution Tribunal, February 2024): CA$812.02

A website chatbot told a bereaved customer he could claim a bereavement fare after travel; the airline’s policy page said otherwise. The tribunal held the airline responsible for its chatbot’s statements. The sum is small; the precedent is not.

Cheapest control: grounded answers with a policy check.

Sources: CBC

2. Mata v. Avianca (S.D.N.Y., June 2023): US$5,000

Lawyers filed a brief citing six cases that did not exist, produced by ChatGPT. The court order: “A penalty of $5,000 is jointly and severally imposed”.

Cheapest control: verify every citation against a legal database before filing.

Sources: Court order

3. Arup, Hong Kong (January 2024): about HK$200M (about US$25.6M)

After a message about a confidential deal, an employee joined a video conference in which the “CFO” and colleagues were AI-generated, then made 15 transfers. The Hong Kong government confirmed the loss to the Legislative Council, and Arup confirmed it was the victim.

Cheapest control: a hard amount check, an out-of-band call-back for transfers above a threshold.

Sources: Hong Kong government · Dezeen

4. Deloitte Australia (October 2025): A$97,587 refunded on a A$440,000 contract

A government review contained a fabricated court quote and references to reports that do not exist; the revised version disclosed that a GPT-4o tool chain had been used. The refund figure came out at Senate Estimates.

Cheapest control: grounded answers with a policy check.

Sources: CFO Dive · PS News

5. Railway customers (October–November 2026): about US$740,000 in unauthorised AI usage

Attackers broke out of the hosting firm’s build isolation and used customers’ stored AI-provider keys against several model providers. Railway’s final incident report (10 November 2026) says it is working with the providers on reimbursement and will cover charges they decline to refund.

Cheapest control: spend caps and key hygiene.

Sources: BleepingComputer · Yahoo Tech

6. Replika / Luka Inc. (Italian Garante, April 2025): EUR 5M

A companion chatbot processed users’ data without an identified legal basis and had weak age checks.

No runtime control on our list addresses this; it is a lawful-basis problem, and it is coded that way in the ledger.

Sources: EDPB

What this means for a buyer

• The most common costly failure is an unchecked answer. Court sanctions, Air Canada and Deloitte share one cause: output nobody checked against a source. Grounded answers with a policy check cover 18 of the 44 headline cost cases.
• The most expensive operational failure is a payment approved on a fake call. A fixed rule, call back on a known number before any transfer above a threshold, addresses 74% of the documented fraud losses.
• Stolen AI keys are now a line on the cloud bill. Spend caps and key hygiene cover every documented stolen-key bill in the ledger, from US$1,700 to US$740,000.
• Most fine and damages money came from data rights and claims about AI, which call for legal review of data use and marketing before launch.

How we measured

Question. What did it cost, in money stated by a primary source, when an AI system failed, was misused or was misrepresented between 1 January 2023 and 12 November 2026? That covers an AI system’s output or action, unlawful data collection to build or run an AI system, a false claim about AI capability (“AI washing”), a crime using generative AI (deepfake, voice clone), and theft of AI compute (stolen model keys).

Inclusion criteria, written down before collection: a specific money amount is stated; it comes from an official or primary source (regulator, court, police, the company that paid or lost it) or from at least two independent reputable outlets; it is attributable to the AI incident; and the cost-fixing event (decision, ruling, settlement, loss, bill) falls in the window.

Headline bar. A case enters the headline figures unless it is single-source, annulled or vacated, a largely suspended judgment with no stated payable amount, a proposed order, recovered in full by police, an allegation without conviction, scope-borderline, or resting on one unverified account that several outlets repeat. 44 of 75 cases meet it as documented costs, and 2 market-value moves are shown for scale; every exclusion and its reason is in cases.csv, so a reader can check each call.

Money. The native amount is authoritative. US-dollar figures use the ECB reference rate on the decision or loss date. Each category reports a count, median and range on its own; the ledger has no grand total, and market-value moves are shown for scale only.

Controls. One primary control per case from the KH Labs list (grounded answers with a policy check, human handoff, a check on amounts and commitments, an injection-safe tool gate, spend caps and key hygiene, AI disclosure, pre-launch red-team testing, monitoring and a kill switch), or “none on list” when the cost came from a missing lawful basis, a company’s own misstatement, or an individual targeted outside any company system. A second coder, Claude Opus 5.5, coded the control field blind to ours: 84.8% agreement on headline cases (κ = 0.79), 86.7% on all cases (κ = 0.82). The model coded the control field only; every fact comes from sources.

Court-sanction tracker. We fetched the Damien Charlotin AI Hallucination Cases database on 12 November 2026 (“Last updated: 12 November 2026”) and parsed its breakdowns from the page’s own chart data.

What the numbers cover. The ledger counts documented costs only. Most AI losses are never published (fraud victims rarely disclose, and many settlements are confidential), so each category is a floor, not an estimate of total losses. Stolen-key bills (n = 3) and market moves (n = 2) have few cases, so their medians are illustrative. Several cases are under appeal, and where a primary page could not be fetched the figure rests on two reputable outlets, marked per case.

Data

• cases.csv (65 KB): one row per case (75): date, organisation, jurisdiction, failure path, amount and currency, USD at the ECB rate, status, source tier, headline flag or exclusion reason, control
• sources.csv (30 KB): one row per source: URL, publisher, date, type and a quote of 25 words or fewer
• summary.json (14 KB): every number on this page

Cite this study