Meta shifts legal risk of its AI errors to the customer

Meta has published a proposed change to its commercial terms that, if nothing remedies it, will take effect on October 30. The move has three fronts that should be read carefully: liability for errors in its AI functions, the use of content that companies publish on its platforms, and automated crawling of domains and web pages. For an SME using Meta tools for advertising or communication, this is not a minor detail: it is a shift in risk allocation that should be understood before signing anything.

The clause that changes the board: AI fails and the customer pays

The proposed text acknowledges that AI functions may make mistakes and not always provide accurate, complete, or adequate results. So far, nothing unusual. What stands out comes next: customers would be solely responsible and assume each and every risk associated with those functions and the resulting content. In other words, Meta designs the model, admits it can be wrong, and shifts the cost of failure to the user.

The analysts cited in the original information do not hide their surprise. Frank Dickson, of Dickson Research, notes that the clause completely reverses liability. Mike Wilkes, CISO of Aikido Security, agrees: only Meta controls the model that generates the result, so shifting the risk to the customer seems bewildering to him, and he anticipates enterprise customer churn if such onerous conditions are imposed.

Own content, broad license, and automated crawling

The second block affects data ownership and use. The proposed wording grants Meta a license over the intellectual property-protected content that the company shares, publishes, or uploads on its products. The license also extends to content published by someone on behalf of the company, such as an agency or service provider managing the page. And it is granted to provide, develop, improve, research, and maintain Meta's products.

The third front is crawling. The text allows Meta to use automated software—spiders, bots, crawlers, and user agents—and create test credentials to access, index, cache, analyze, and collect domains, web pages, or URLs associated with its products or services, as well as obtain periodic updates. The company later clarified, in statements reported by CIO.com, that those crawling conditions applied only to its advertising and business products, that it is not changing its use of crawlers, and that content owners can still use robots.txt to indicate their preferences. However, the published wording did not yet reflect that clarification, and the company announced that there would be a modification.

What it means for an SME and its IT team

Beyond the media noise, the change forces a review of the fine print of services already used daily. For an SME with a social media presence and paid campaigns, the risk is not abstract: AI-generated text that goes wrong, an inappropriate image, or incorrect data in an ad can lead to claims that, under this wording, would fall on the user company. And if the agency or provider manages the page, the license extends the umbrella over their content.

On the technical side, crawling should be scrutinized. Although Meta clarifies that it respects robots.txt, the original text leaves the door open to broad interpretations. For an IT team with its own website, internal documentation, or catalogs, it is time to review what is published and under what conditions.

Concrete recommendations from ForgeNEX

1. Inventory of Meta services. Identify which accounts, pages, and campaigns the company uses, who manages them, and which providers have access.
2. Contract review. Check whether the new terms affect contracts with agencies or partners and who assumes the risk of an AI error.
3. Generative AI usage policy. Define what can be published without human review and establish double validation for ads and sensitive content.
4. Content control. Review what proprietary material is uploaded to Meta platforms and assess the license granted.
5. robots.txt and best practices. Even if Meta says it respects preferences, keep the file updated and review what is publicly exposed.
6. Traceability. Keep records of decisions made with AI and human reviews, in case you need to defend yourself.

This move fits a trend we have seen this year: providers increasingly push responsibility toward the customer while AI sneaks into daily life. We discussed it when talking about record GDP promises and financing doubts for SMEs, and also in the case of WhatsApp and its hidden instructions to AI. The lesson is the same: read the fine print before it takes effect.

The chosen date, October 30, the eve of Halloween, has not gone unnoticed by analysts. Dickson sums it up ironically: Meta hands out the tricks and keeps the treats. For an SME, the joke can be expensive if the terms are not reviewed in time. At ForgeNEX we recommend not waiting until the last day: review, document, and decide wisely which services to keep and under what conditions.

Source: Computerworld. Analysis and adaptation: ForgeNEX.